BEC & Social-Engineering Coverage Checker
Business email compromise — a spoofed email that tricks finance into wiring money — is the most common cyber loss, and the one most often not covered. It needs a specific social-engineering / funds-transfer-fraud endorsement, usually sublimited far below your policy limit, often with control conditions. Check where you stand. Educational, not insurance advice.
Social-engineering fraud is almost never part of base cover; it is a specific endorsement. Check your schedule for "social engineering", "fraudulent instruction" or "funds transfer fraud" and its sublimit before you assume you are covered.
- No out-of-band callback verification for payment / bank-detail changes.
- No dual authorization for wires above a threshold.
- No verifying vendor bank-detail changes via a known contact.
What this checker does
- Business email compromise (a fraudulent wire triggered by a spoofed email) is the most common cyber loss — and the most commonly uncovered one.
- It needs a specific social-engineering / funds-transfer-fraud endorsement, usually sublimited far below your policy limit, often with control conditions.
- Answer a few questions and see whether you are covered, your likely gap on a real wire, and which controls (out-of-band callback, dual authorization, vendor verification) you are missing.
- Educational, not insurance advice. Everything runs in your browser.
Why this matters
Ask a finance team what their cyber policy is for and they will picture ransomware — but the loss they are far more likely to suffer is a fraudulent wire. BEC is high-frequency, often six or seven figures, and sits in exactly the coverage gap most buyers do not know they have: not a system breach, so not core cyber; a "voluntary" transfer, so often excluded from crime cover; only picked up by an endorsement that is sublimited and conditioned.
This checker shows you whether that endorsement exists, how far it would actually go on your largest wire, and which verification controls — the ones that stop BEC in the first place — you are missing. Educational, not insurance advice; confirm the specifics with your broker.
Frequently asked questions
Does cyber insurance cover business email compromise (BEC)?
Not by default. A fraudulent wire that your own staff sent — because a spoofed or compromised email told them to — is a social-engineering / funds-transfer-fraud loss. Base cyber cover is built around a security breach of your systems, and a BEC where no system was breached often falls outside it; traditional crime policies may also exclude "voluntary" transfers induced by deception. Cover for it is a specific endorsement you have to ask for, and it is typically sublimited well below the policy limit (often $100k–$250k) and conditioned on verification controls. Given BEC is the most frequent and one of the costliest cyber losses, confirming you have the endorsement — and how much it pays — is one of the highest-value checks you can do.
What is the difference between funds-transfer fraud and social-engineering fraud?
They are related endorsements that are easy to confuse. Funds-transfer fraud generally covers money moved by an attacker who fraudulently instructs your bank directly (e.g. using stolen credentials). Social-engineering fraud covers money your own employee transfers because they were deceived by a fraudulent communication (the classic CEO-impersonation or fake-vendor-invoice wire). Many BEC losses are the social-engineering kind, and some policies cover one but not the other, or sublimit them differently. Read which one(s) your endorsement grants and at what limit.
What controls do insurers require for social-engineering cover?
Commonly: out-of-band callback verification (confirming any payment or bank-detail change by calling a known number, not replying to the email), dual authorization for wires above a threshold, and verifying vendor bank-detail changes through a previously known contact. Some endorsements make these conditions of cover, so a loss where the control was skipped can be denied. They are also simply the controls that stop most BEC before any claim — prevention first, cover second.
Is this insurance advice?
No. It is an educational checker that models the common structure of social-engineering/funds-transfer cover to help you see whether you have it, your likely gap, and your control posture. Endorsement wordings, definitions and conditions vary by carrier. Confirm your actual cover and conditions with your broker, and treat the control recommendations as good practice regardless of what your policy says.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.