Short answer
If your firm wired money to a scammer, the policy that pays depends on how the fraud happened and which policies you carry. Social engineering, funds transfer fraud and invoice manipulation are three different coverages, and they often have different limits. Professional liability usually does not respond to any of them. Because coverage names and wording vary by carrier, the actual policy language controls.
Why “insurance covers fraud” is not a safe assumption
Many owners assume a cyber policy covers any fraud involving email or a bank transfer. In practice, coverage depends on what actually happened. Was an employee tricked into sending the money? Did someone log in and send it without anyone knowing? Did a client pay a fake invoice that appeared to come from your firm?
Each situation can fall under a different part of a cyber policy, a crime policy or neither. The comparing cyber quotes page also notes that some losses land under cyber, some under crime and some under neither.
Which coverage typically responds
This table shows how losses are often grouped. Names and wording vary by carrier, so treat it as a starting point.
| What happened | Coverage that typically responds |
|---|---|
| An employee was tricked into sending money | Social engineering |
| A hacker logged in and sent a wire | Funds transfer fraud or computer fraud |
| A client paid a fake invoice that appeared to come from you | Invoice manipulation, if the policy includes it |
| A client sues your firm over the loss | Possibly cyber liability, rarely professional liability |
Each of these may sit in a cyber policy, a crime policy or both. The glossary entries on social engineering and cyber liability explain the terms.
Social engineering, funds transfer fraud and invoice manipulation
Social engineering applies when someone persuades a person at your firm to send money. The employee made the transfer, but only because of a deception. Policies often attach verification conditions, such as a callback before paying.
Funds transfer fraud applies when someone else initiates the transfer from your account without your staff knowingly sending it. Some policies call this computer fraud.
Invoice manipulation applies when your client pays a fake invoice that appears to come from you. The money never left your account, but your client’s payment went to a fraudster. Not every policy includes this coverage, and the comparing cyber quotes page shows where to find the client funds and invoice manipulation line.
Why these coverages often have separate sublimits
Policies commonly cap these coverages with a sublimit, which is a smaller limit inside the main policy limit. The three coverages above can each carry a different one. A firm with a $1 million cyber limit can therefore find that a payment fraud claim is capped well below that figure.
The actual numbers vary by carrier, firm and year, so check the declarations page and any endorsements instead of relying on a general figure.
Does professional liability cover payment fraud?
Professional liability usually does not respond to these losses. It is designed for claims that a firm’s professional services were deficient, not for money lost to a scam. Some professional liability forms include narrow cyber extensions, so the wording is worth a look, but firms should not assume it applies.
Real-world example
Consider a hypothetical 10-person engineering firm. An email that appears to come from a subconsultant asks the bookkeeper to update bank details. She updates them and pays an invoice. A week later, the real subconsultant asks why they have not been paid.
That looks like a social engineering loss. The firm checks its policies and finds a cyber policy with a social engineering sublimit and a separate crime policy. Whether either responds depends on the wording and on what verification steps the firm followed before paying.
Now change the facts. A fraudster takes over the firm’s email, sends a client a fake invoice and the client pays it. That may be an invoice manipulation question instead, and the answer depends on whether the policy includes that coverage.
What to do in the first hour
Speed matters after a payment fraud. Take these steps in order:
- Call your bank. Ask whether the transfer can be recalled or frozen.
- Report the fraud. File a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. The FBI’s Recovery Asset Team works best when it hears about a transfer quickly.
- Notify your insurer or broker. Do this before taking other steps, since policies often have notice requirements.
- Preserve the evidence. Keep the emails, call logs and payment records.
The phishing and IT security checklist has a section on what to do if money was sent.
What to check in your policies
Firms may want to review:
- Whether the policy includes social engineering, funds transfer fraud and invoice manipulation, and which are missing.
- The sublimit for each coverage.
- What verification the policy requires before paying a request.
- Whether the firm has both a cyber policy and a crime policy, and how they fit together.
- Who at the firm knows to call the insurer first after a fraud.
Why this matters
The FBI’s Internet Crime Complaint Center has reported business email compromise as one of its largest loss categories in recent years. Those figures reflect complaints filed, so they do not capture every loss. Check the IC3 reports for current numbers.
Hardcover insight
Firms often learn which of these coverages they have only after money has moved. A short review of the sublimits and conditions beforehand is much easier than reading them in the middle of a claim. The most common surprise is that a large headline limit sits next to a much smaller payment fraud sublimit.
Related questions
Does cyber insurance cover wiring money to a scammer?
It may, depending on the policy. Coverage is often found under social engineering or funds transfer fraud provisions, usually with a sublimit and conditions. Review the wording.
What is the difference between social engineering and funds transfer fraud?
Social engineering involves an employee who was tricked into sending money. Funds transfer fraud involves someone initiating the transfer without the firm knowingly doing so.
What is invoice manipulation coverage?
It addresses situations where a client pays a fraudulent invoice that appears to come from your firm. Not every policy includes it.
Does professional liability insurance cover payment fraud?
Usually not. Professional liability responds to claims about professional services. Some forms include narrow cyber extensions, so check the wording.
Who should I call first after sending money to a scammer?
Call your bank right away to try to stop or recall the transfer. Then report to IC3 and notify your insurer or broker.