Skip to main content

Plain-language guide

Does Cyber Insurance Cover Scams and Stolen Money?

The short answer

Some policies cover scams. Others do not. A thief may take money from an account. Or a worker may be tricked into sending it. These can be treated in different ways. Ask about the exact scam. Check the limit and the rules.

Written by Joseph Boyd, MBA, Founder and Principal Advisor at Infosec Check

Published

Editorial note: this guide uses primary references and is checked when policy or legal guidance changes.

Two events that look alike can be treated differently

A thief sends the money: Someone gets into an account and makes an unauthorized transfer.

A worker sends the money: A fake email tricks a worker into making a transfer they believe is valid.

The second event is often called social engineering. In plain words, a scammer tricks a person into helping them.

Ask about the exact scam

  • A fake invoice from a supplier.
  • A changed bank account on a real invoice.
  • An email that pretends to come from the owner.
  • An account taken over by a thief.
  • A customer tricked into sending a payment to the wrong place.

Ask whether cyber coverage, crime coverage, an added form, or another policy addresses each case. Also ask which policy responds first when coverage overlaps.

What about AI voice and video scams?

Treat a voice or video as something to verify. It may look or sound like a person you know.

Ask the insurer how the policy treats fake voices, fake video, and automated messages. A policy’s name does not tell you the answer.

For your own work, set a clear rule for checking payment changes. Use a phone number you already trust. Do not rely on a number inside the new payment request. Decide who must approve a payment and record that approval.

Does this cover mistakes made by an AI tool?

Do not assume so. A bad answer, a private file sent to the wrong place, and a thief’s attack are different events. Tell your insurance professional how your business uses AI and ask where each risk fits.

NIST’s AI Risk Management Framework is a voluntary guide for managing AI risks. It is not an insurance policy. A business can use it to support decisions about who may use AI, which information may be shared, and who checks the output.

Four coverage questions

  1. Is the type of scam covered?
  2. What is the most this part will pay?
  3. What payment checks must we follow?
  4. How quickly must we report the event?

If money was just sent

Contact your bank at once. Ask it to try to stop or recall the payment. Report the event to the FBI’s Internet Crime Complaint Center (opens in a new tab). Also contact your insurer or agent using the policy’s reporting instructions. A recall is not guaranteed.

Do not wait for an insurance answer before calling the bank.

Read what to do if your business is hacked or return to the cyber coverage guide.

Scope

This guide gives general information. It does not decide a claim or change a policy. Coverage depends on the policy, its added forms, the facts, and the law. Ask a licensed insurance professional about your coverage and a lawyer about legal questions.

Sources

Back to the cyber insurance basics hub: What Is Cyber Liability Insurance Coverage?