An email arrives from a supplier you’ve paid for years. Same name, same signature, same friendly tone. Their banking information has changed, and they’d like this month’s invoice sent to the new account. Your bookkeeper updates the payment details and sends the money.
Two weeks later, the real supplier calls asking why they haven’t been paid. The money is gone. It went to a criminal who was never your supplier.
What Social Engineering Fraud Is
Social engineering fraud happens when a criminal pretends to be someone your business trusts, such as a vendor, a customer, a coworker or the owner, to trick an employee into sending money or changing payment instructions. No one breaks through a firewall. The scheme works because a real employee, acting in good faith, approves the payment.
It is one of the most expensive frauds businesses face. In its 2025 Internet Crime Report, the FBI recorded more than $3 billion in reported business email compromise losses from 24,768 complaints, second only to investment fraud.
Why Your Policy Might Not Pay
Many business owners assume their crime or cyber policy covers this. Often it doesn’t, or it covers only part of the loss.
- Your employee sent the money. Traditional crime coverage is built for theft, forgery and computer fraud. When your own employee knowingly authorizes the transfer, insurers often deny the claim under those coverages. Social engineering coverage is usually a separate coverage or endorsement that has to be added.
- Lower limits. When the coverage is included, it often carries its own limit, which can be much lower than the rest of the policy.
- Verification conditions. Some policies require that a change in payment instructions was confirmed by calling a number already on file. Skip that step, and coverage can fail.
- Which policy responds. The coverage may sit on a crime policy, a cyber policy, both or neither. The wording on each one matters.
Before You Send Money
- Verify any banking change by calling a known, trusted phone number, not one listed in the email.
- Require a second approval for new payees, changed account details and unusual payments.
- Train employees to slow down when a request is urgent, confidential or arrives right before a large payment.
- Write the verification steps down so everyone follows the same process every time.
If It Happens
Speed matters. Call your bank right away and ask it to recall the payment. Report the fraud to the FBI at ic3.gov. Notify your insurance agent and insurer promptly, and keep every email involved.
Review Your Coverage Before an Email Tests It
Our team reviews your crime and cyber policies to show you whether social engineering fraud is covered, how much would be paid and what conditions you must meet. Learn more about our business insurance services, call or text (973) 909-9889, or book a 15-minute consultation.