An accounts payable clerk joins a scheduled video call with the CFO and two people from treasury. The faces are right, the voices are right. A banking-change request for a long-standing supplier gets approved on the call, wired that afternoon, and flagged by the real CFO the next morning. By then the money is gone, and the argument over which policy pays has already started.
That fact pattern is reshaping how corporate risk managers think about cyber and crime coverage. The social engineering fraud endorsement was written for a world of spoofed emails and phone calls. Live synthetic video wasn’t a risk anyone was pricing.
Now it is, and the two policies that were supposed to complement each other are pointing at one another.
Decide Which Policy You Are Actually Buying the Coverage On
The first decision is architectural, and most buyers get it backward. Social engineering coverage now shows up as an endorsement on both crime and cyber policies, and the two forms are not interchangeable. The crime form typically responds to theft of the insured’s own money through deception, while the cyber form is oriented toward network events and often carries lower sublimits for funds transfer fraud triggered by impersonation.
An independent broker who places both, like Hulett Insurance, can map the two forms side by side before renewal rather than after a loss.
Pick the wrong home for the coverage, and the sublimit fight is already lost. A modest social engineering sublimit tucked inside a cyber tower won’t stretch to cover a large vendor payment, no matter how sympathetic the facts.
Decide How Narrowly You Want ‘Fraudulent Instruction’ Defined
Endorsement language written five years ago tends to define the covered act as an instruction received by email, fax, or telephone. A live video call with a synthetic executive doesn’t fit any of those cleanly. Carriers have already denied claims on the ground that a video meeting isn’t one of the listed channels, and narrowly worded endorsements strand exactly these losses between the crime and cyber towers.
The decision for a buyer is whether to accept the standard wording or push for a manuscript endorsement that names the risk. Put two questions to the underwriter in writing:
- Does the definition of ‘fraudulent instruction’ expressly include instructions received by video conference or other synthetic-media channels, or is it limited to email, fax, and telephone?
- Will the endorsement respond when the impersonated party is a known vendor or executive whose voice or likeness has been digitally reproduced, rather than an anonymous outside actor?
Decide What Verification You Will Actually Enforce
Coverage now comes tied to conduct. Most social engineering endorsements condition payment on documented callback verification to a known number, not a number provided in the suspect communication. Write the process into policy, skip it in practice, and the carrier has a clean denial.
The FBI has been direct about this. Its IC3 advisory on business email compromise tells firms to verify account-change requests through a secondary channel and require multi-factor authentication on any workflow that moves money. Bake those controls into the payments procedure, train to them, and keep the evidence. The verification log is what turns a coverage dispute into a paid claim.
Notify Both Carriers, in Writing, on Day One
When a loss hits, the instinct is to tender to whichever policy feels closer to the facts. Resist it. Notify the crime carrier and the cyber carrier in parallel, in writing, and let the two insurers sort priority and ‘other insurance’ between themselves.
Choosing one and waiting on the other is how late-notice defenses get built, and how a covered loss becomes an uncovered one.
