The Cyber vs. Crime Policy Confusion
The first mistake many teams make is assuming that either their 'cyber' policy or their 'crime' policy will inherently cover a BEC loss. The reality is that these sophisticated scams often fall into a gray area between the two. A standard cyber policy is primarily
designed to cover data breaches and system failures—an attacker hacking your network. A traditional crime policy covers direct theft, like embezzlement or forgery. With BEC, however, no systems are typically breached, and no funds are directly 'stolen' by an outsider. Instead, a trusted employee is tricked into sending the money. The cyber insurer may deny the claim because no hack occurred, while the crime insurer denies it because the payment was made willingly by an authorized employee.
Ignoring the 'Voluntary Parting' Exclusion
This leads to the most common and brutal reason for a denied BEC claim: the 'voluntary parting' or 'false pretense' exclusion. This clause, often buried in standard crime policies, states that the insurer won't cover a loss if an employee is induced by a trick or dishonest act into willingly sending money or property. From the insurer's perspective, because an employee authorized and executed the wire transfer, the company 'voluntarily parted' with its funds, even though it was under fraudulent inducement. Courts have repeatedly sided with insurers on this point, making it a powerful tool for claim denial unless a policy has specific language to override it.
Missing the Social Engineering Endorsement
The specific solution to the voluntary parting trap is a 'Social Engineering Fraud' or 'Fraudulent Instruction' endorsement. This is not standard and must be explicitly added to a policy. This rider is specifically designed to fill the gap, providing coverage when an employee is manipulated into making a fraudulent payment. However, many businesses either don't know to ask for it, or they misunderstand its limits. Social engineering coverage is often 'sub-limited,' meaning the payout cap can be significantly lower than the overall policy limit—a business with a $1 million crime policy might only have $100,000 in coverage for this specific, and increasingly common, type of fraud.
Believing Technical Defenses Are a Substitute for Following Protocol
Even with the right endorsement, coverage can be voided if a company fails to follow its own internal security procedures. Insurers are increasingly looking at whether employees adhered to established protocols, such as requiring dual authorization for large transfers or performing out-of-band verification—like a phone call to a known number—before changing vendor payment details. If an insurance application states that Multi-Factor Authentication (MFA) is required for email access, and it wasn't properly implemented, an insurer can deny the claim based on material misrepresentation. Ultimately, the policy is a contract, and failing to uphold your end of the security bargain gives the insurer a clear path to denying a claim.
