Cyber Liability vs. Funds-Transfer Fraud Coverage

A finance employee receives an email that appears to come from the company’s chief executive and urgently wires $90,000 to a new account. In a different incident, a hacker steals banking credentials and makes an unauthorized transfer without the employee’s knowledge. Both losses involve computers and money, but the insurance analysis may differ. Cyber liability, computer fraud, funds-transfer fraud, employee theft, and social-engineering coverage are separate concepts. The name on the policy does not determine coverage; the insuring agreement and facts do.

The FTC advises small businesses considering cyber insurance to decide whether they need first-party coverage, third-party coverage, or both, and to examine coverage for data breaches, network attacks, vendors, business interruption, cyber extortion, defense, and incident-response services. That is a useful framework, but it does not mean every cyber policy includes funds-transfer fraud. The FBI’s Internet Crime Complaint Center describes business email compromise (BEC) as a scam that targets businesses and individuals performing funds transfers, often using compromised or spoofed accounts to induce unauthorized transfers.

Cyber liability: incidents, response, and claims

A cyber policy may combine first-party and third-party coverage. First-party coverage may reimburse the insured’s own specified costs after a covered cyber event, such as forensic investigation, legal advice, customer notification, credit monitoring, data restoration, crisis communications, cyber extortion response, and business interruption. Third-party coverage may address claims alleging privacy violations, failure to protect information, or network-security harm. The policy may have sublimits, waiting periods, retentions, vendor requirements, and exclusions for particular types of data or events.

The key trigger can be a security failure, privacy event, defined cyber incident, or other contract term. A computer outage caused by ordinary equipment failure may not satisfy the same definition as a malicious intrusion. A business interruption grant may require an interruption caused by a covered cyber event and may apply a waiting period before lost income is payable. A data restoration provision may pay to restore electronic data but not necessarily its commercial value or the cost to upgrade software. Read the specific wording and endorsements.

Cyber coverage is not limited to hackers outside the organization. A compromised vendor or cloud provider can affect the insured’s data or operations. Some policies address events at service providers; others impose restrictions, exclusions, or limited sublimits. The FTC recommends that businesses ask whether a policy covers attacks on vendor-held data, what incident response services are available, whether the insurer has a 24-hour hotline, and how defense or regulatory-investigation expenses are handled. The business should identify its critical suppliers and compare the policy’s dependent-business-interruption terms.

Funds-transfer fraud and computer fraud are distinct grants

A crime policy may provide separate computer-fraud and funds-transfer-fraud insuring agreements. In broad terms, computer fraud can require a dishonest act involving unauthorized entry or manipulation of a computer system that directly causes a loss of money or securities. Funds-transfer fraud may require a financial institution to transfer money from the insured’s account based on an unauthorized instruction. Exact words differ, and courts can interpret them narrowly. The insured must satisfy all causal, actor, system, account, and loss requirements in the actual form.

A social-engineering loss can look different. The employee is deceived by an impersonation and intentionally authorizes a transfer, believing it to be legitimate. The employee’s action may be authorized in the ordinary banking sense even though the request was fraudulent. A narrow funds-transfer agreement may require an unauthorized instruction and fail to match this scenario. Some insurers offer a separate social-engineering or fraudulent-instruction endorsement, often with its own sublimit, verification condition, retention, and definition of covered person. Do not assume a cyber policy or crime policy automatically includes it.

A BEC scheme may use email spoofing, account takeover, a fake invoice, a compromised vendor mailbox, or a message that mimics an executive’s writing style. The IC3 recommends using a secondary channel or multifactor authentication to verify requests that change account details, checking the complete sender address, and acting quickly if funds are sent. Those controls reduce risk, but they are not substitutes for insurance terms. A policy might require the insured to follow a documented call-back procedure before acting on a payment instruction.

Causation and sequence matter. If a hacker changes the bank account on file and then initiates an unauthorized transfer, the facts may support one grant. If the attacker sends an email and a trained employee independently approves a wire, the insurer may argue the transfer was voluntary. If both account compromise and human deception occur, multiple grants or exclusions could be implicated. The insured should preserve the original email, headers, bank records, approval logs, call recordings, device images, and timeline to support the coverage analysis.

Why the boundary between cyber and crime coverage is blurry

A single incident can involve a cyber intrusion, a social-engineering deception, and a financial crime. Policies can overlap or leave gaps. A cyber policy may provide breach response but exclude the value of funds transferred. A crime policy may cover unauthorized system access but exclude voluntary transfers induced by deception. An endorsement could add social-engineering cover with a much lower limit than the rest of the crime policy. Other-insurance language may make one policy excess of another or allocate a shared loss. Compare the full contracts before an incident occurs.

Commercial cybersecurity coverage can also be subject to special Texas market rules. TDI Bulletin B-0022-21 lists commercial cybersecurity among certain commercial lines exempted from rate and form filing requirements, subject to the bulletin’s scope and statutory framework. This is a filing rule, not a coverage promise. A Texas buyer should not infer that a policy is standardized or that the Department approved every bespoke term. Obtain the policy form, declarations, schedules, endorsements, and application answers.

The boundary also affects valuation. A cyber policy might insure the cost of responding to a breach and restoring systems, while a crime policy pays a covered direct loss of money. A business-interruption extension might address lost net income during a defined system outage, but not the transferred principal. If stolen funds are later recovered, the policy may require cooperation and credit the recovery. Do not add separate coverages together to exceed the actual economic loss, and do not assume two policies each pay the same amount independently.

Examples: determine which grant fits

Example one: An attacker compromises the company’s online banking credentials and sends a wire without employee approval. Review funds-transfer or computer-fraud wording for unauthorized access, direct causation, transfer instruction, and covered account. Example two: A vendor email account is hacked, and an employee approves the vendor’s changed bank details. Review social-engineering coverage because the employee voluntarily acted on a fraudulent instruction; check call-back controls and any sublimit. Example three: An attacker encrypts the company’s server and steals customer records but does not transfer money. Focus on cyber incident, privacy liability, response expenses, data restoration, and business interruption.

Example four: A bookkeeper uses legitimate credentials to divert funds into a personal account. Employee-theft wording may be relevant, and a computer-fraud grant might exclude losses caused by an employee. Example five: A criminal spoofs the CEO’s email from an external account, but the company’s treasury employee notices the new account number and calls a known phone number before sending funds. The control prevents the loss; if funds had been sent, document whether the policy required that same call-back step. Example six: A software vendor’s outage prevents customer transactions but no data is accessed. Dependent system failure and business-interruption wording become important.

How to compare policies before buying

1. List the business’s likely losses: breach response, privacy claims, ransomware, network interruption, vendor outage, fraudulent transfer, employee theft, and funds recovery.
2. For cyber, identify first-party and third-party insuring agreements, incident triggers, waiting periods, service-provider coverage, and required notice.
3. For crime, inspect computer fraud, funds-transfer fraud, social-engineering, employee theft, money and securities, and transit agreements separately.
4. Ask whether voluntary transfers induced by impersonation are covered and whether a verification protocol or dual approval is a condition.
5. Compare per-claim and aggregate limits, sublimits, retentions, deductibles, discovery periods, and loss-discovery/reporting deadlines.
6. Read exclusions for voluntary parting, authorized users, insiders, prior events, contractual payment obligations, and system failure.
7. Check other-insurance provisions and coordinate cyber, crime, bank, and vendor contracts.
8. Match security controls and application answers to actual practice; never state that a control exists if employees do not consistently use it.

Security controls can support both prevention and insurability. The FTC recommends multifactor authentication, least-privilege access, regular patching, encryption, backups, employee training, incident-response plans, and oversight of vendors. For payment fraud, separate approval from initiation, verify bank-detail changes using known contact information, require dual authorization above a threshold, and reconcile accounts frequently. The policy’s application may ask about these controls, and a false answer can create disputes. Controls should be written, tested, and applied to executives as well as junior staff.

What to do after a suspected transfer fraud

Time matters. The IC3 advises victims to contact the financial institution immediately and request contact with the receiving bank; report the incident to the FBI and file an IC3 complaint. The business should also notify its insurer according to the policy and use any breach hotline before hiring vendors if the contract requires consent. Preserve evidence, stop further payment instructions, reset credentials through clean devices, and coordinate legal, banking, IT, and insurance response. Do not assume a bank recovery effort or a police report itself satisfies insurance notice.

A coverage notice should describe what happened without speculating beyond known facts. Include the time, sender address, transaction, amount, account information, discovery process, controls used, and steps taken to contact the bank. Ask the insurer what records it needs and whether consent is required for forensic or legal expenses. Maintain a timeline and copies of submissions. A carrier may investigate the relationship between the electronic event and the transfer; complete, consistent documentation helps evaluate the right coverage agreement.

Common exam traps

• Assuming every cyber policy covers transferred money.
• Confusing an unauthorized banking instruction with an employee-authorized payment induced by a fake email.
• Treating computer fraud, funds-transfer fraud, employee theft, and social engineering as one agreement.
• Assuming cyber liability limits apply to crime losses or that a crime policy pays for breach notification costs.
• Ignoring a separate endorsement, sublimit, waiting period, retention, or verification condition.
• Assuming funds-transfer fraud requires malware; policy definitions may focus on an unauthorized instruction.
• Assuming an employee’s voluntary action is always covered or always excluded without reading the grant.
• Overlooking other-insurance provisions when both cyber and crime policies may respond.
• Failing to notify the bank and insurer quickly after a transfer.

Prepare for the Texas P&C exam with the Texas Property and Casualty exam prep course. Work through policy-focused questions to practice applying these concepts.

Frequently asked questions

A fraud’s technical label rarely resolves the claim by itself. Map the sequence of events to the wording of each potentially relevant insuring agreement.