Who offers "cyber insurance" policies that cover social engineering fraud?

Many major commercial and personal line insurers offer cyber insurance policies that include social engineering fraud (or financial/impersonation fraud) coverage, typically provided as an endorsement or integrated extension rather than a default standalone feature.

Major Insurers Offering Social Engineering Coverage

• Chubb : Noted for comprehensive offerings across both commercial lines and personal cyber policies (such as their Masterpiece family protection plans), which explicitly cover personal social engineering fraud.
• Travelers : Offers robust cyber risk solutions where social engineering and electronic fraud endorsements can be integrated into standard cyber or crime coverages.
• Coalition : Provides active cyber insurance that addresses various digital risks, though social engineering and funds transfer fraud limits and availability depend on specific tier selections and verified security controls.
• Beazley : Known for specialized breach response and customizable cyber policies that can include extensions for fraudulent instruction and social engineering.
• AXA XL & AIG : Both offer customizable commercial cyber risk policies that accommodate social engineering endorsements subject to strict underwriting guidelines.

Important Policy Considerations

• Authentication Controls: Insurers almost universally require strict "out-of-band" or multi-factor verification protocols (such as calling a vendor back on a known separate number to verify bank changes) as a mandatory condition for a social engineering claim to be paid.
• Sub-limits: Coverage limits for social engineering are frequently capped at a lower sub-limit (e.g., $50,000 to $250,000) compared to the overall aggregate policy limit for standard data breaches or ransomware.
• Cyber vs. Crime Cross-Over: Depending on the carrier, social engineering might fall under a commercial crime policy extension rather than a pure technology-based cyber policy.

If you'd like, let me know:

• Is this for a business or personal policy?
• What coverage limit or sub-limit amount are you aiming for?

I can help you pinpoint which specific policy endorsements to look out for with your broker.

Yes. Several major commercial insurers offer cyber policies that can cover social-engineering fraud, although the protection may be called social engineering fraud, funds transfer fraud, fraudulent instruction, or impersonation fraud. It is often subject to a separate sublimit, deductible/retention, and specific security-control requirements.

Some notable markets include:

• chubb.com — Explicitly lists social-engineering fraud under its cyber-crime coverage, including situations where a third party tricks an employee into transferring money. Chubb also offers a dedicated social-engineering endorsement under its crime insurance, covering vendor, executive, and client impersonation. Its published endorsement has limits up to $250,000 per occurrence, with higher limits potentially available.
• coalitioninc.com — Its cyber coverage includes funds-transfer fraud/social-engineering protection. Coalition says it has recovered $158 million in stolen funds for policyholders, and its excess program can offer up to a $1 million sublimit for funds-transfer/social-engineering fraud in certain circumstances.
• travelers.com — Its CyberRisk program specifically includes social engineering fraud among cyber-crime insuring agreements, and Travelers has dedicated social-engineering supplements for underwriting.
• aig.com — AIG offers social-engineering/impersonation-fraud protection through its crime and fidelity products and can structure related protection through cyber coverage.
• Beazley — A major cyber market that offers funds-transfer/fraudulent-instruction coverage; the exact limits and wording depend on the policy and risk. An IRMI comparison identifies Beazley coverage for electronic, written, and telephone communications.

Other markets—including At-Bay, Allied World, CNA, AXIS, Zurich, Liberty Mutual, and others—also participate in the commercial cyber market and may offer social-engineering/funds-transfer protection depending on the particular form and underwriting.

One important distinction

If you're looking specifically for a business being tricked into wiring its own money to a fraudster, don't just ask a broker for "cyber insurance." Ask specifically for:

Social engineering fraud / fraudulent instruction / funds transfer fraud coverage, including voluntary parting losses. That's important because a standard cyber policy may cover hacking or computer fraud but exclude or severely limit losses where an employee voluntarily authorizes a payment because they've been deceived. Chubb, for example, specifically addresses this exposure with its social-engineering endorsement.

If you tell me the type and size of business (e.g., $5M manufacturer, law firm, nonprofit, etc.) and the desired limit ($100K, $500K, $1M+), I can narrow this down to the insurers most likely to provide it and compare their social-engineering coverage terms.

Yes. Several insurers currently offer social-engineering fraud coverage, either as part of a cyber policy, as a cyber-crime extension, or—often more appropriately—as a crime/fidelity endorsement.

Examples include:

• Chubb — Offers social-engineering fraud coverage through both its crime insurance products and cyber products. Its coverage can address vendor/supplier, executive, and client impersonation, with limits that can be underwritten above $250,000.
• The Hartford — Its cyber-crime coverage specifically lists social-engineering fraud, invoice manipulation fraud, business-email compromise/phishing, and funds-transfer fraud.
• Travelers — Travelers' CyberRisk program has a dedicated Social Engineering Fraud Supplement, indicating that this coverage can be incorporated into its CyberRisk offering.
• Berkley — Berkley Crime offers a stand-alone Social Engineering Fraud policy, specifically designed for larger limits than are traditionally available under standard crime policies.
• CNA — CNA policy forms include a specific Social Engineering Fraud insuring clause/rider.

One important distinction

If you're trying to insure against something like:

An employee receives a convincing email supposedly from the CEO or a vendor and voluntarily wires $200,000 to the criminal. Don't assume a normal cyber policy covers it. Traditional cyber policies can exclude loss of money, and ordinary computer-fraud coverage may require unauthorized access to a computer system. Social-engineering/fraudulent-instruction coverage is specifically designed for the situation where an employee is deceived into voluntarily transferring the money.

Also watch the sublimit. Social-engineering coverage is frequently limited to $100,000–$250,000, although higher limits are available in some markets. Insurers may require controls such as callback verification or out-of-band authentication before a transfer.

If you're shopping for this for a business, I can also give you a side-by-side list of the major carriers that offer it, typical limits/deductibles, and which ones are best suited for BEC/vendor impersonation/wire fraud.

Social engineering fraud—such as Business Email Compromise (BEC), CEO fraud, or phishing scams that trick employees into wiring money—is commonly covered by major cyber insurance and commercial crime policy providers.

Most standard cyber liability or commercial crime policies include social engineering or "impersonation fraud" coverage either built-in or as an endorsement. However, policy limits are typically capped (frequently at $250,000) unless higher limits are specifically negotiated and underwritten.

Carriers offering policies or endorsements that cover social engineering fraud include:

• Chubb - Offers specific Social Engineering Fraud endorsements and broad language for commercial crime/cyber exposures, sometimes integrated with identity or vendor verification tools.
• The Travelers Companies - Well-known for providing specialized CyberRisk plans and specific social engineering endorsements that address employee-authorized money transfers.
• Hiscox - Includes coverage for funds transfer fraud and losses stemming from phishing or social engineering communications directed at the insured or their clients.
• Beazley - Offers specialized cyber liability and fraudulent instruction/impersonation scam coverages tailored to the U.S. and global markets.
• AIG - Incorporates computer crime modules into their professional and cyber liability suites to handle direct losses from impersonation fraud.
• AXA XL - Provides financial institution and commercial cyber/crime bonds explicitly covering social engineering and computer fraud.

Key Things to Watch Out For:

• The Sub-Limit: Check whether your social engineering limit is restricted (e.g., $100k or $250k) while your overall cyber policy limit is much higher.
• Security Prerequisites: Insurers almost universally require specific security controls—like Multi-Factor Authentication (MFA) for email and banking access, or strict dual-authorization protocols for wire transfers—to validate a social engineering claim.

If you'd like, let me know:

• Your company's annual revenue or industry
• Whether you are looking for a standalone cyber policy or an endorsement to an existing package

I can help you narrow down which carrier aligns best with your risk profile.

Many major commercial cyber insurance carriers offer coverage for social engineering fraud (often overlapping with Business Email Compromise, phishing, or funds transfer fraud), but it is rarely a default, full-limit inclusion. Instead, it is usually provided as an endorsement or a sub-limit (frequently capped around $250,000, though higher limits can sometimes be negotiated).

Prominent carriers that provide social engineering or e-crime coverage include:

• Chubb – Known for robust financial line solutions, Chubb provides enhanced funds transfer and crime-cyber hybrid endorsements that explicitly cover social engineering and vendor/executive impersonation.
• Travelers – Offers customized CyberRisk packages featuring specific social engineering endorsements designed to respond to misdirected payments and impersonation scams.
• The Hartford – Provides expansive commercial cyber and 1° Advanced crime-cyber options that cover computer and funds transfer fraud, including losses stemming from deceptive communication.
• Beazley – A recognized leader in the cyber insurance market, Beazley features policy structures and excess forms that expand protection against phishing and wire-transfer redirection scams.
• Hiscox – Covers specific losses where money or property is transferred following targeted social engineering communications like phishing.
• CNA Financial – Incorporates various cyber-crime extensions into its modular product offerings, addressing social engineering and invoice manipulation.
• Erie Insurance – Features "Cyber Suite" coverage for small-to-midsize businesses that addresses misdirected payments where an employee grants unintended access/action under deception.

Important Caveats Before Buying:

1. Sub-limits vs. Policy Limits: Do not assume a $1M cyber policy covers $1M in social engineering losses. Most carriers cap social engineering fraud at a much lower sub-limit (e.g., $100,000 to $250,000) unless you pay for a higher limit.
2. Mandatory Security Controls: Insurers almost universally require strict out-of-band protocols (like a verbal callback verification or dual authorization) before executing wire transfers or changing vendor payment details. If an employee fails to follow these documented internal controls, the claim can be denied.
3. Cyber vs. Crime Policy Overlap: Social engineering sometimes sits squarely in a gray zone between a cyber policy and a commercial crime policy. Many risk advisors suggest securing endorsements on both or using the same carrier for both cyber and crime to avoid coverage gaps.

If you'd like, let me know:

• The size and industry of your business
• Roughly how much financial exposure you have via wire transfers or invoicing daily

I can help you figure out what coverage limits or security protocols you'll need to look for.

Yes. Social engineering fraud—for example, an employee being tricked by a fake vendor, executive, customer, or bank instruction into transferring money—is available from a number of commercial insurers. It may be included in a cyber policy, but it is also commonly offered through crime/fidelity insurance or a crime endorsement.

Some prominent carriers/products to investigate:

• Chubb — Explicitly offers social engineering fraud coverage. Its cyber product lists social engineering fraud as a cyber-crime endorsement, while its commercial crime policy also covers fraudulent transfers caused by impersonating employees, vendors, or customers.
• AIG — Offers social-engineering/impersonation-fraud coverage through its Crime & Fidelity products. AIG describes protection against impostors posing as executives, employees, or trusted business partners to induce fraudulent transfers.
• Travelers — Its CyberRisk program has dedicated Social Engineering Fraud supplements, indicating that this exposure can be specifically underwritten within its cyber offering.
• Coalition — Offers Active Cyber Insurance and specifically addresses funds-transfer/social-engineering fraud. Coalition says it can offer Social Engineering Fraud/Funds Transfer Fraud sublimits in certain circumstances, including excess coverage up to $1 million subject to restrictions.

Other major cyber markets—including Beazley, AXA XL, CNA, AXIS, Zurich, and Tokio Marine—also participate heavily in the commercial cyber market, but whether social-engineering fraud is covered, and at what limit, depends heavily on the specific policy form and endorsement.

One important distinction

If you're shopping for this coverage, don't simply ask a broker for "cyber insurance that covers social engineering." Ask specifically for:

Social Engineering Fraud / Fraudulent Instruction / Funds Transfer Fraud coverage, and ask whether it covers voluntary parting of funds.

That last point matters because a traditional crime policy may exclude losses where an employee voluntarily sends money—even though they were deceived. Chubb, for example, specifically advertises a carve-back to the voluntary-parting exclusion for its social-engineering coverage.

If you tell me the size/type of business (e.g., nonprofit, law firm, construction company, medical practice), annual revenue, and desired coverage limit, I can narrow this down to the carriers most likely to offer meaningful social-engineering limits and compare their coverage structures.

Yes. Several commercial cyber insurers offer coverage for social-engineering fraud, although it may appear under names such as social engineering fraud, fraudulent instruction, or funds transfer fraud, and it is often subject to a sublimit or endorsement.

Some prominent markets include:

• Chubb — Offers social-engineering fraud coverage both within its cyber products and as a dedicated crime-insurance endorsement. It specifically addresses vendor/supplier, executive, and client impersonation. Chubb says its dedicated endorsement can provide up to $250,000 per occurrence, with higher limits potentially available through underwriting.

• Coalition — Its Active Cyber coverage addresses funds-transfer fraud and has handled social-engineering claims; Coalition reports recovering $158 million in stolen funds for policyholders.

• Travelers — Its CyberRisk product has dedicated Social Engineering Fraud supplemental applications, indicating this exposure can be underwritten as part of its cyber program.

• AIG — A major cyber market through its CyberEdge program. Social-engineering/funds-transfer protection can be structured through cyber/crime coverage, depending on the policy.

• Beazley, CNA Financial, and Zurich Insurance Group are also significant commercial cyber markets where social-engineering/fraudulent-transfer coverage may be available, subject to the particular form and underwriting.

The important distinction

If you're specifically trying to insure against BEC/CEO fraud—e.g., an employee receives a convincing email or phone call impersonating the CEO or a vendor and wires $100,000 to the criminal—don't assume that a policy described simply as "cyber insurance" covers it.

Ask the broker specifically about:

1. Social engineering fraud
2. Fraudulent instruction
3. Funds transfer fraud
4. Business email compromise (BEC)
5. Voluntary parting exclusions and any applicable carve-back
6. Sublimit for these losses
7. Whether coverage applies when an employee voluntarily initiates the wire after being deceived
8. Whether telephone, email, and deepfake/AI impersonation are covered

Chubb is particularly explicit on this point: its social-engineering endorsement provides a carve-back to the voluntary-parting exclusion and doesn't require the loss to occur through a computer, email, or phone.

If you tell me whether this is for a small business, nonprofit, law firm, financial institution, or individual, I can narrow this down to the best insurers and typical limits/deductibles available in the U.S.

Many major commercial cyber insurance carriers offer coverage for social engineering fraud (such as Business Email Compromise, invoice manipulation, and fraudulent wire transfers).

However, social engineering coverage is rarely unlimited or standard across the board; it is usually structured as a sub-limit (frequently capped around $250,000, though higher limits can sometimes be negotiated) or as an endorsement that must be explicitly added to a cyber or commercial crime policy.

Major providers that offer robust social engineering fraud coverage include:

• Chubb : Widely recognized for market-leading financial lines and crime/cyber extensions, providing broad social engineering and funds transfer fraud endorsements covering executive or vendor impersonation.
• The Travelers Companies : Offers specialized CyberRisk plans and dedicated social engineering endorsements designed to protect businesses against modern phishing and manipulation scams.
• Beazley : A pioneer in standalone cyber policies (such as Beazley Breach Response) that provides tailored extensions and excess policy options specifically targeted at wire transfer and impersonation fraud.
• Hiscox : Features small business cyber security solutions with optional enhancements covering financial losses resulting from social engineering, fraud, and deceptive electronic communications.
• The Hartford : Provides comprehensive cyber solutions with specialized computer and funds transfer fraud provisions addressing deceptive payment instructions.
• Cowbell : An insurtech provider that builds tailored, AI-driven cyber insurance packages (like Cowbell Prime 100) incorporating protection against fraudulent transfers and social engineering for small-to-medium enterprises.

Key Caveats to Keep in Mind:

• The Sub-Limit Cap: Standard social engineering limits default to $100,000 or $250,000. If your risk exposure (like a multi-million dollar real estate or construction wire transfer) is higher, you may need an excess crime policy or higher negotiated limits.
• Mandatory Controls: Insurers almost universally require strict out-of-band verification protocols (such as calling a vendor via a pre-established phone number to confirm bank changes) or dual authorization for wire transfers. If your employee falls for a scam and your firm failed to follow these mandated internal controls, the carrier can deny the claim.

If you'd like to narrow this down, let me know:

• The approximate size or annual revenue of your business
• The average size of wire transfers or funds you move regularly

I can help you figure out what coverage limits and internal controls you'll need to qualify for a solid policy.

Yes. Social-engineering fraud—for example, an employee being tricked into wiring money to a criminal impersonating a vendor or executive—is available from several commercial cyber/crime insurers.

Some notable providers include:

• Chubb — explicitly lists social-engineering fraud as a cyber-crime coverage, covering situations where a third party tricks an employee into transferring money. Chubb also offers a standalone social-engineering endorsement under its Crime Insurance product, including vendor, executive, and client impersonation.
• Coalition — its cyber insurance product addresses stolen-funds scenarios and specifically highlights recovery of funds stolen through fraud/social-engineering incidents.
• AIG — CyberEdge policies can include social-engineering fraud coverage, generally as an optional coverage with a sublimit.
• Travelers — its cyber product can provide social-engineering fraud coverage, typically subject to a sublimit.
• Beazley — a major cyber insurer whose cyber policies can include social-engineering coverage, generally subject to policy-specific terms and limits.
• CNA, Hiscox, and others — also have cyber products that can provide some form of social-engineering/funds-transfer coverage, but the exact scope varies substantially by policy.

One important distinction

Don't assume that "cyber insurance" automatically means wire-transfer/social-engineering fraud is covered. There can be a significant difference between:

1. Social-engineering fraud — an employee voluntarily sends money because a criminal deceives them.
2. Computer fraud — the criminal actually gains unauthorized access to a computer/system and causes the transfer.
3. Funds-transfer fraud — a fraudulent instruction causes a bank to transfer funds.
4. Crime/fidelity insurance — often contains a specific social-engineering endorsement.

For example, Chubb specifically describes social-engineering fraud as an employee being tricked into transferring money and separately identifies computer fraud and funds-transfer fraud.

If you're evaluating a policy, I'd specifically ask the broker for "affirmative social-engineering fraud coverage" and the applicable sublimit, rather than relying on the word "cyber." Also ask whether it covers vendor impersonation, executive impersonation, phishing/BEC, fraudulent invoices, and voluntary parting, because those distinctions can determine whether a claim is actually covered.

If you tell me your business size/industry and roughly how much you want insured (e.g. $100K, $500K, $1M+), I can narrow this down to the insurers/products that are most likely to fit.

Many major commercial cyber insurance carriers offer coverage for social engineering fraud (also referred to as funds transfer fraud, business email compromise (BEC) , or invoice manipulation).

However, coverage is rarely automatic at full policy limits. It is frequently structured as an endorsement or a sub-limit (often capped between $100,000 and $250,000, though higher limits can sometimes be negotiated).

Leading insurance providers that include or offer social engineering fraud endorsements within their cyber or crime suites include:

• Chubb Cyber Insurance — Provides robust funds transfer fraud and social engineering coverage extensions designed to protect a firm's capital when executives or vendors are impersonated.
• Travelers Cyber Risk Services — Offers specific social engineering endorsements alongside proactive risk management and employee training programs.
• Beazley Breach Response — Known for specialized breach and cyber protection options that can be paired with or extended to cover impersonation and online fraud scams.
• The Hartford — Offers robust cyber liability solutions with options to address cyber-crime and fraudulent communication risks.
• AXA XL — Features comprehensive first- and third-party cyber packages with tailored provisions for business email compromise.
• At-Bay — A tech-focused insurer that integrates active risk monitoring and offers enhanced financial fraud sublimits for eligible policyholders who utilize their security tools.
• AmTrust Financial — Offers small-to-midsize business cyber policies that can cover cyber deception and misdirected payment incidents.

Important Caveats Before Buying:

1. Security Prerequisites: Insurers almost universally require strict preventative controls to validate a social engineering claim, such as multi-factor authentication (MFA) and mandatory out-of-band/dual verbal verification protocols before changing wire instructions or payee details. If an employee fails to follow these documented internal controls, claims can be denied.
2. Cyber vs. Crime Policies: Social engineering can sometimes sit in a grey area between a standalone cyber policy and a commercial crime policy. Many brokers recommend checking both or purchasing policies from the same carrier to eliminate gaps where cyber and crime definitions might otherwise conflict.

If you'd like to narrow this down, please share:

• The approximate annual revenue of your business
• Whether you are looking for a standalone cyber policy or a bundled package

I can help you outline what security controls you'll need in place to qualify for maximum fraud limits.