Short answer
Whether a cyber policy covers deepfake fraud depends on the wording. Deepfake losses usually fall under social engineering coverage, which often carries a sublimit well below the main policy limit. Some carriers have reportedly begun adding AI-related exclusions at renewal, while others have added coverage that names deepfakes directly. Reading your own policy is the only reliable way to know where you stand.
What social engineering coverage is
Social engineering coverage responds when someone tricks an employee into sending money or data, rather than breaking into a system. A fake invoice, a spoofed email or a cloned voice asking for a wire can all fall into this category. The glossary entry on social engineering explains the term.
Carriers often limit this coverage to a sublimit. That is a smaller cap inside the policy. A firm with a $1 million cyber limit may find the social engineering portion is far lower. Terms vary, so the policy and its endorsements need to be read together.
Why deepfake fraud wording is changing at renewal
Industry commentary suggests cyber rates have softened in 2026, while some of the fine print has been changing. A Cloud Security Alliance research note describes generative-AI exclusion endorsements appearing across several lines of insurance, including cyber. Please confirm that detail against the original note before publishing.
The market is moving in two directions. Some carriers may carve AI-generated impersonation out of social engineering coverage. Others have publicly announced coverage that names deepfakes and voice cloning. Two policies at a similar price can therefore respond very differently. None of this means a given policy excludes deepfake fraud. It means the wording deserves a check.
Three questions to ask about your policy
Start with these:
- Is deepfake or AI impersonation excluded or covered? Look for language about AI-generated content, synthetic media or impersonation, in the policy and in any endorsement.
- What is the sublimit? Find the social engineering limit and check whether it fits the size of payments your firm makes.
- What verification is needed before paying? Many policies expect the firm to confirm a payment request, often by callback, before sending money. Skipping that step can reduce or remove coverage.
Where deepfake losses land: cyber or crime policy
A fraudulent transfer may sit in a cyber policy, a crime policy or both. Each form defines the loss differently, and some require that the loss be a direct result of the fraud. Courts have reached different conclusions on how that language applies to social engineering claims, so the exact wording matters.
Firms with both policies should check that the two do not leave a gap between them. The comparing cyber quotes page covers the social engineering and cyber crime line and the related questions about where these losses land.
Why quotes with the same limit are not the same
Two quotes can both show a $1 million limit and still differ on the items above. One may include a generous social engineering sublimit and clear callback conditions. Another may cap it low or add AI-related language. Price alone will not show the difference.
Comparing cyber quotes explains what to line up side by side, including sublimits, conditions and exclusions.
Real-world example
Consider a hypothetical 12-person engineering firm with a $1 million cyber policy. At renewal, the broker sends two quotes. Both show $1 million and similar premiums.
Reading the wording shows a difference. The first quote includes a $250,000 social engineering sublimit and requires a callback before payment. The second includes a $50,000 sublimit and an endorsement with language about AI-generated content. The firm cannot tell from the price which policy suits it better.
The owner asks the broker to explain the endorsement and decides which limit and conditions match the firm’s payment habits.
What to check before renewal
Firms may want to review:
- Whether the policy or any endorsement mentions AI, deepfakes or impersonation.
- The social engineering sublimit and whether it fits the firm’s largest typical payments.
- What verification the policy expects before money is sent.
- Whether a separate crime policy exists and how it interacts with the cyber policy.
- Whether the firm follows a written callback rule that matches those conditions.
Hardcover insight
Firms with cyber insurance often assume they are covered for any fraud that involves email, phone or video. The headline limit can give that impression. The social engineering section is usually where the answer sits. Reading that one section before renewal, instead of after a loss, is one of the more useful steps a firm can take.
Related questions
Does cyber insurance cover deepfake fraud?
It depends on the policy. Coverage may fall under social engineering or crime provisions, often with a sublimit and verification conditions. Some policies may exclude AI-related impersonation, and others may address it directly.
What is a social engineering sublimit?
It is a lower cap within the policy that applies to losses where someone is tricked into sending money. It is often much smaller than the main limit.
Are carriers excluding deepfakes?
Some are reported to be adding AI-related exclusions, while others have added coverage that names deepfakes. Wording differs by carrier and policy, so each one needs to be read.
Is deepfake fraud covered by a cyber policy or a crime policy?
It can fall under either, depending on the wording of each. Firms with both should check that they work together without a gap.
What should I ask my broker at renewal?
Ask whether AI impersonation is excluded or covered, what the social engineering sublimit is and what verification is required before payment.