How payment diversion usually works
Most schemes follow one pattern. An attacker gains access to a mailbox — the business's own, a vendor's or a customer's — or registers a look-alike domain, waits for a real payment conversation, and sends new bank instructions inside it. The money goes out by wire or ACH, and by the time the real vendor asks about it the funds have moved on.
The scale is large. The FBI's Internet Crime Complaint Center reported about $2.77 billion in business email compromise losses in 2024 and $55.5 billion in exposed losses between October 2013 and December 2023.
Where cyber insurance may respond
Many cyber policies include social-engineering or fraudulent-instruction coverage for money an employee is deceived into sending. It is frequently sublimited well below the policy limit and may carry a condition that the business verified the instruction through a callback or other procedure. Some carriers also offer invoice-manipulation coverage when the business's own customers are tricked into paying a criminal.
The cyber policy may also pay to investigate the compromised mailbox and to notify anyone whose data was exposed in it, even when the stolen funds themselves are handled elsewhere.
Where crime insurance may respond
Commercial crime policies traditionally cover employee theft, forgery and computer or funds-transfer fraud, where a criminal manipulates systems or instructs a bank directly without the business's knowledge. Many crime forms add a separate social-engineering or fraudulent-instruction agreement, also usually sublimited.
Because both policies can carry similar-sounding coverage with different definitions, a loss may fall under one, both or neither. When both apply, other-insurance clauses decide how they share it.
Controls that matter for coverage and prevention
The control that stops most diversion is simple: confirm any change in payment instructions by calling a phone number already on file, never one supplied in the message. The FBI recommends verifying account changes through secondary channels, and CISA advises employees to verify suspicious messages without replying or using any number or link in them.
Dual approval above a set amount, multi-factor authentication on email and banking, and a hold period on new payees are the cybersecurity basics that reduce the exposure further. Follow whatever procedure the application describes, because some coverage depends on it. Contractors can see how this applies on the construction cyber liability insurance quote page.
More on Cyber & Technology Risk
Cyber Insurance vs. General Liability: Where One Stops and the Other Starts
General liability answers for injury and property damage; cyber insurance answers for data, networks and money moved on false instructions. Here is where the line usually falls.
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
When a Contract Requires Cyber Insurance: What to Check Before You Sign
More owners, general contractors, lenders and agencies now write cyber insurance into their agreements. Here is how to read the requirement before it becomes a condition you cannot meet.
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
Ransomware and Cyber Insurance: What a Policy May Do After an Attack
When systems are encrypted and a demand appears, a cyber policy can fund the response — but the steps in the first hours matter. Here is what to know before it happens.
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
Frequently asked questions
Does cyber insurance cover wire fraud?
It may, through social-engineering or fraudulent-instruction coverage, if included and the loss fits the wording. That coverage is often sublimited and may carry a verification condition.
What is the difference between social engineering and funds-transfer fraud?
Social engineering involves an employee being deceived into sending money. Funds-transfer fraud typically involves a criminal instructing a bank directly without the business's knowledge. Policies define each differently.
Do I need crime insurance if I have cyber insurance?
It is often worth evaluating. Crime policies cover employee theft and certain computer and funds-transfer fraud that a cyber policy may not, and the two should be coordinated.
Can a callback procedure affect coverage?
Yes. Some social-engineering coverage is conditioned on verifying payment changes as described in the application, so following that procedure matters for coverage as well as prevention.
What if the fraudulent email came from a vendor's real account?
Coverage depends on the wording. Some forms distinguish between spoofed messages and compromised legitimate accounts, which is worth checking before a loss.