Commercial Crime Insurance

Social engineering fraud

Many of today's losses come from social engineering, where a criminal impersonates a vendor, executive or customer and convinces an employee to send money or change payment details. Because the employee authorized the transfer, a standard computer fraud or funds transfer fraud agreement may not respond. Some insurers offer social engineering coverage by endorsement, often with a lower sublimit and conditions such as verifying payment-change requests by phone. If your business pays vendors by wire or ACH, ask about it specifically.

How crime insurance differs from cyber insurance

The two overlap but are not the same. Cyber liability focuses on data breaches, network security events, ransomware and related costs such as notification and forensics. Crime insurance focuses on direct financial loss from theft and fraud, including employee dishonesty. Some cyber policies include limited funds transfer or social engineering coverage, and some crime policies include computer fraud. Reviewing both together helps avoid gaps and overlaps.

Crime insurance vs. fidelity bonds

You may hear crime coverage called a fidelity bond or employee dishonesty bond. These protect the business itself against losses from employee dishonesty, which is similar to the employee theft insuring agreement. A third-party or janitorial bond protects your clients against theft by your employees while working at their premises. Some client contracts require these bonds.

Who commonly needs crime coverage

• Any business with employees who handle money, checks, payments or inventory
• Nonprofits, which often rely on a small staff and volunteers to manage funds
• Retailers and restaurants that handle cash
• Professional firms that pay vendors electronically
• Property managers that handle tenants' rent and deposits
• Businesses with contracts or lenders that require crime coverage
• Cleaning and service companies working inside client premises

Common exclusions and conditions

• Theft by owners or partners is generally excluded
• Losses discovered after the policy period, or outside the discovery window, may not be covered
• Inventory shortages proven only by an inventory count are often excluded
• Prior dishonesty: coverage for a specific employee generally ends once you learn of dishonest acts by that employee
• Indirect losses, such as lost income, are generally excluded

Controls that reduce risk

• Separate duties so no one person handles a transaction from start to finish
• Require dual approval for payments above a set amount
• Verify any change to vendor payment details by calling a known number
• Reconcile bank statements promptly, with someone outside accounts payable reviewing them
• Run background checks where lawful and appropriate