A bookkeeper receives an email from the CEO asking for an urgent wire transfer. The message looks real, the tone sounds right and the request seems routine. The money goes out, and by the time anyone realizes it was fake, it’s gone.
This is business email compromise (BEC), and it’s one of the costliest forms of cybercrime for small businesses. Unlike ransomware, it doesn’t need advanced hacking. It relies on convincing someone to send money or information.
The tricky part is insurance. BEC losses often fall into a gray area between cyber, crime and other policies, and many cyber policies cover them only up to a low limit. This guide explains how BEC coverage works, what to look for in the wording and how to avoid claim problems. If you’re new to the topic, start with what cyber insurance is and what it covers.
What Is Business Email Compromise?
Business email compromise is a scam in which an attacker uses email (often a hijacked or spoofed account) to trick an employee, vendor or customer into sending money, changing payment details or sharing sensitive data.
Common versions include:
- CEO or executive fraud: an email that appears to come from a senior leader asking for an urgent payment or gift cards.
- Vendor invoice fraud: a fake or altered invoice, or a message saying a supplier’s bank details have changed.
- Payroll diversion: an email that appears to come from an employee asking to change their direct deposit.
- Account takeover: attackers gain access to a real mailbox and monitor conversations, striking at the right moment.
- Real estate and legal fraud: fake wire instructions sent to buyers, sellers or clients at closing.
- Data theft: requests for tax forms, employee records or client files.
Does Cyber Insurance Cover Business Email Compromise?
Often yes, but with limits. BEC losses can fall under different parts of a cyber policy:
- Social engineering fraud: covers money you voluntarily send because someone impersonated a trusted person or vendor.
- Funds transfer fraud: covers losses from fraudulent instructions sent to your bank, usually without your knowledge.
- Incident response: pays for forensic investigators who find out how the mailbox was compromised.
- Data breach response: covers notification and credit monitoring if personal data was exposed.
- Privacy liability: helps if clients or partners claim you failed to protect their information.
The most important line to find in your policy is the social engineering sublimit. Many policies cap it at a small fraction of the main limit, such as $25,000, $100,000 or $250,000, even when the overall policy is $1 million.
Where BEC Coverage Can Fall Short
Low Sublimits
BEC losses can run from a few thousand dollars to hundreds of thousands. A $50,000 sublimit won’t help if a fraudulent wire is $200,000.
Verification Requirements
Some insurers require you to prove that you followed a payment verification process, such as calling the vendor at a known phone number before changing bank details. Skipping a required callback can reduce or deny a claim.
Voluntary Transfers
Some older or simpler policies cover only losses where a hacker moved the money without your involvement. If an employee sent funds because of a convincing email, coverage depends on whether the policy includes social engineering.
Exclusions and Conditions
Watch for exclusions for losses from insiders, for money that can’t be shown to have been lost because of fraud and for security standards you failed to meet. See What Does Cyber Insurance Not Cover? 12 Common Exclusions.
Overlap With Crime Insurance
Commercial crime policies can cover some fraud, but they often exclude or heavily limit email-induced transfers unless a social engineering endorsement is added. Check each policy so the pieces fit together without gaps.
What to Look for in a Policy
Use this checklist when you compare quotes.
- Is social engineering coverage included? Make sure it’s in the policy, not just mentioned in marketing.
- What is the sublimit? Compare it to the largest payment your business could realistically send in one transaction.
- Does it cover both funds transfer fraud and social engineering? They’re different, and you want both.
- Are there verification conditions? Ask whether you must confirm payment changes by phone or another method.
- Is there a retention or co-insurance? Some policies make you pay a higher deductible or a percentage of BEC losses.
- Does it cover invoice manipulation and vendor fraud, not only impersonation of executives?
- Is payroll diversion included?
- Does it cover the costs of investigating the compromise and notifying affected people?
- Are claims tied to security controls? For example, requiring MFA on email.
- What’s the definition of “loss”? Check whether recovered funds, bank fees and legal costs are treated differently.
Ask your broker to get these answers in writing before you sign. For general guidance on comparing offers, see Best Cyber Insurance for Small Business: 10 Providers Compared.
A Realistic Example
A small construction company works with a regular materials supplier. An attacker breaks into the supplier’s email account and sends the company an updated invoice with new bank details. The company’s accountant pays $87,000 to the fraudulent account.
- With a cyber policy that includes a $100,000 social engineering sublimit: the loss may be covered, subject to the retention and any verification conditions.
- With a policy that has a $25,000 sublimit: the company absorbs most of the loss.
- With no social engineering coverage: the insurer may deny the claim entirely.
The company’s own policy may also help with forensics and notifications, even though the compromised account belonged to the vendor. For the industry, see Cyber Insurance for Construction Companies.
How to Reduce BEC Risk (and Improve Your Claim Position)
Insurers look at how well you protect your email and payment processes. These steps lower your risk and your premium.
- Enable multi-factor authentication (MFA) on all email accounts. It’s one of the most effective protections. See Cyber Insurance MFA Requirements: What Insurers Expect in 2026.
- Use a callback procedure. Verify any change in bank details or a large payment request by calling a known number, not one in the email.
- Require dual approval for wire transfers and payments above a set amount.
- Train your team to spot spoofed domains, urgent requests and unusual payment instructions.
- Tighten email settings: enable SPF, DKIM and DMARC, flag external senders and disable auto-forwarding rules. See Email Security Settings That Cut Phishing Risk (and Premiums).
- Monitor for suspicious mailbox rules and unusual login locations.
- Limit who can change vendor payment details and log every change.
- Slow down on urgent requests. Pressure is the scammer’s main tool.
What to Do If You Think You’ve Been Targeted
Speed matters. If you suspect a fraudulent payment:
- Contact your bank immediately and ask them to recall or freeze the transfer. The first hours are the best chance to recover money.
- Notify your cyber insurer as soon as possible, using the claims hotline.
- Report it to law enforcement, such as the FBI’s Internet Crime Complaint Center (IC3) in the United States.
- Secure the compromised email account: reset passwords, enable MFA and remove suspicious rules.
- Preserve evidence: save the emails, headers, payment records and a timeline.
- Alert affected vendors and clients so they can check their own accounts.
For the full process, see How to File a Cyber Insurance Claim: Step-by-Step Guide.
What Does BEC Coverage Cost?
BEC and social engineering coverage is usually part of the policy, and higher sublimits can raise your premium. Pricing also depends on your industry, revenue and security controls. Businesses that use MFA, payment verification and email protections often get better terms. For ranges, read How Much Does Cyber Insurance Cost for Small Businesses in 2026?
Frequently Asked Questions
Is business email compromise covered by cyber insurance?
Often, but usually with a sublimit. Look for social engineering and funds transfer fraud coverage in the policy and check the limit.
Will my insurer pay if an employee sent the money willingly?
Only if the policy includes social engineering fraud coverage. Standard funds transfer fraud coverage may apply only to unauthorized transfers.
Does general liability or property insurance cover BEC?
Typically no. These policies are designed for physical risks. See Does General Liability Insurance Cover Cyber Attacks?
Can I recover the money after a fraudulent transfer?
Sometimes. Quick action with your bank increases the chance. Recovery becomes less likely as time passes and the funds move on.
Do insurers require a callback procedure?
Some do, especially for higher social engineering limits. Ask whether verification conditions apply to your policy.
Does BEC coverage apply if the vendor’s email was hacked, not mine?
It can, depending on the wording. The coverage typically responds to fraud that leads you to send funds, but check how the policy defines the trigger.
The Bottom Line
Business email compromise is often a bigger practical risk than ransomware for small businesses, yet it’s where policies have the lowest limits. Don’t assume you’re covered: find the social engineering sublimit, read the conditions and compare it to the largest payment you make.
Pair solid coverage with simple controls such as MFA, callbacks and dual approval, and you’ll reduce both the likelihood of a loss and the chance of a denied claim.
Disclaimer: This article is for general information only and is not insurance, legal or financial advice. Policy terms vary by insurer and state. Review the actual policy wording and consult a licensed insurance professional before making a decision.