Short answer
Your cyber policy wire fraud coverage is probably smaller than your headline limit. In quotes we ran in 2026, most $1M options capped social engineering at $250K. A few offered $500K, and some offered none. Check your declarations page for the sublimits, because the exact terms depend on your policy.
How much does a cyber policy wire fraud claim pay?
Money sent to the wrong account is the most likely cyber loss for a small architecture or engineering firm. It is also the part of the policy with the smallest limit.
Here is what we saw across 152 $1M options in 2026:
- Social engineering was capped at $250K in 124 options and $500K in 10. Seventeen options included none.
- Invoice manipulation was capped at $250K in 113 options and $50K in 20. Nineteen options included none.
- Client funds coverage was missing from 66 options, or 43%.
- Ransomware sat at the full $1M in every option.
No option gave the full $1M for social engineering. These figures come from quotes we ran, so they don’t describe the whole market. Some carriers and standalone crime policies offer higher limits.
What is a sublimit on a cyber policy?
A sublimit is a smaller cap inside the overall limit. The policy may say $1M, but a specific coverage pays no more than its own sublimit.
A firm that buys “a $1M cyber policy” may assume $1M applies to every loss. For wire fraud, the sublimit usually controls the payout instead.
Which coverages apply to cyber policy wire fraud?
Three coverages handle most money-loss scenarios. Each can have a different limit, or none at all.
- Social engineering: Covers losses when someone tricks your staff into sending money, often through a fake email.
- Invoice manipulation: Covers losses when a fraudster alters or spoofs an invoice, and a payment goes to the wrong account.
- Client funds: Covers money you hold or move on behalf of a client.
Triggers and verification conditions vary by carrier. Some policies require a callback or other verification step before they respond. Read these conditions in the policy form itself.
Example: a spoofed invoice email
A small civil engineering firm told us that a spoofed email “from” the firm reached one of its clients. The email redirected an ACH payment, and the client lost about $7K.
This is the invoice manipulation scenario. A loss like this is small compared with a $1M limit, yet it shows how quickly fraud reaches a design firm’s payments. Whether any policy would respond to a loss like this depends on whose money was lost, the policy wording and the verification conditions. Ask your broker how your own policy handles it.
How big is the wire fraud problem?
The FBI’s 2025 Internet Crime Complaint Center report put business email compromise at about $3.05 billion in reported losses, according to a McDonald Hopkins summary. Small firms handle invoices and payments by email every week, so they face the same exposure.
What to check on your declarations page
Pull out your declarations page and look for these items:
- The social engineering limit, and whether it appears at all
- The invoice manipulation limit
- Whether client funds coverage is included
- The retention that applies to these coverages
- Any verification or callback condition in the policy form
Our guide to comparing cyber liability quotes has sections on social engineering and cyber crime, and on client funds and invoice manipulation. If you want a second set of eyes, request a policy review and we’ll go through the limits with you.
When is a higher social engineering limit worth paying for?
A higher limit makes the most sense for firms that handle client funds or move large payments. Examples include firms that pay subconsultants on behalf of an owner or manage project funds. A firm that rarely handles large transfers may weigh the extra premium differently. The right answer depends on your payment practices and your contracts.
Related questions
Does a $1M cyber policy cover $1M of wire fraud?
Usually not. In quotes we ran in 2026, none of the $1M options gave the full $1M for social engineering. Most capped it at $250K.
What is the difference between social engineering and invoice manipulation coverage?
Social engineering generally addresses staff being tricked into sending money. Invoice manipulation addresses altered or spoofed invoices that redirect a payment. Policies word these differently, so read the form.
Does cyber insurance cover client funds?
Not always. Client funds coverage was missing from 43% of the options we quoted in 2026. Confirm that it appears on your declarations page.
Does cyber insurance cover ransomware at the full limit?
In the quotes we ran in 2026, ransomware sat at the full $1M in every option. Your own policy may differ, so check the declarations page.
Can I buy a higher limit for wire fraud?
Some carriers and crime policies offer higher limits, and the best social engineering limit we saw in a $1M cyber quote was $500K. Ask your broker what options exist for your firm.