# Does Cyber Insurance Cover Wire Fraud & BEC Losses? | RankShield Financial > Cyber insurance often covers BEC and wire fraud only as a sub-limited endorsement, and denies claims when controls weren’t followed. Here is what’s covered. > > Source: https://rankshieldfinancial.com/resources/does-cyber-insurance-cover-wire-fraud-bec/ · RankShield Financial (verifiable pre-settlement payment security) RankShield Network · Financial · Payment Fraud # Does Cyber Insurance Cover Wire Fraud and BEC? What Is Covered, What Is Sub-Limited, and What Gets Denied The honest answer is: sometimes, partially, and often for far less than the loss. BEC and wire fraud are usually covered only as a sub-limited endorsement, under specific conditions, and claims get denied when a business did not follow its own controls. Here is how the coverage actually works, and why a documented verification step is both prevention and an insurance lever. By Jamie Kloncz Founder, RankShield Financial August 18, 2026 · 12 min read Key takeaways - BEC and wire fraud are usually covered under a specific social-engineering-fraud or funds-transfer-fraud endorsement, most often on a crime policy or as a cyber component, not automatically under a base cyber policy. - The sub-limit is where the loss hides: social engineering coverage inside a cyber policy is commonly capped in the $100,000 to $500,000 range, often around $250,000, far below a six or seven-figure wire. - Social engineering fraud and funds transfer fraud are two distinct coverage lines, and not every policy includes both. BEC, where an employee is tricked into paying, usually falls under the sub-limited social-engineering line. - Claims get denied when the business did not follow its own stated controls, misrepresented its controls on the application, or filed under the wrong coverage line. Documented verification is what makes a claim defensible. - Underwriters now reward controls: documented callback verification, dual approval, and email authentication typically earn better terms. Insurance is a backstop; verifying the payee before settlement is the actual control. Whether cyber insurance covers wire fraud and business email compromise is the question every finance leader asks after a scare or at renewal, and the honest answer is: sometimes, partially, and often for far less than the loss. It is rarely a simple yes. BEC and wire fraud are usually covered only through a specific endorsement, frequently sub-limited well below the size of a real wire, and subject to conditions that let a carrier deny the claim. With the FBI putting business email compromise at $3.046 billion in 2025 3 , insurers have tightened exactly the terms that matter here. This guide explains which policy actually covers this fraud, why the sub-limit is where the loss hides, why claims get denied, what underwriters now require, and why a documented verification control is both the prevention and the thing that improves your coverage. It is informational, not insurance or legal advice; confirm the specifics with your broker and read your own policy language. ## Which policy actually covers it: crime versus cyber, and the endorsement you need The first surprise for most businesses is that BEC losses often are not covered by the base cyber policy at all. Losses from a fraudulent payment your team was tricked into sending are typically covered under a crime policy, either as a standard insuring agreement or an endorsement 1 , rather than under a technology errors-and-omissions or base cyber policy. Increasingly, social engineering coverage is also available as a specific component or endorsement on a cyber policy. Either way, the operative word is endorsement: the coverage is usually something you have to add and pay for, not a default. It also splits into two distinct lines that are easy to confuse and that pay differently. Funds transfer fraud generally covers a fraudster directly instructing your bank to move money without your involvement. Social engineering fraud covers the case where your own employee is deceived into authorizing the payment, which is what BEC actually is. Not every policy includes both, and BEC almost always lands in the social-engineering line, which tends to carry the lower limit. When a business assumes its cyber policy has it covered and discovers at claim time that BEC sits in a sub-limited social-engineering endorsement it never added, that gap is the whole problem. ## The sub-limit is where the loss hides Even when the coverage exists, the amount is usually the catch. When social engineering coverage sits inside a cyber policy, sub-limits are commonly in the $100,000 to $500,000 range, often around $250,000 1 , which is a fraction of a typical fraudulent wire. A business can carry a multimillion-dollar cyber policy and still find that its social-engineering sub-limit covers a quarter of a single BEC loss. The headline limit on the declarations page is not the number that pays this claim; the sub-limit buried in the endorsement is. Crime policies often provide a higher primary layer, and the two can stack, so a business might have a cyber sub-limit covering the first tranche and a crime policy covering more above it. The only way to know your real exposure is to read the endorsement, not the headline limit: find the social-engineering and funds-transfer sub-limits specifically, confirm which policy is primary, and compare the total to the size of the largest payment your business actually sends. If your typical wire is larger than your sub-limit, insurance is not going to make you whole, and that is the common case rather than the exception. ## Why claims get denied Coverage existing on paper is not the same as a claim being paid, and social-engineering claims are denied often enough that a law firm can write a guide titled why your insurer may deny the claim 2 . The denials cluster around a few causes, and the recurring one is the most avoidable: the business did not follow the verification procedure it told the insurer it had. If your application says you confirm banking changes by callback and the loss happened because someone skipped the callback, the carrier has a reason to deny. The other common denials are structural. Misrepresenting your controls on the application can void coverage entirely. Filing under the wrong coverage line, claiming a computer-fraud or funds-transfer agreement when the loss was social engineering, gets the claim denied on definitional grounds, a distinction courts have taken seriously. And exclusions or conditions specific to authorized payments can apply precisely because you authorized the transfer. The through-line is that the carrier will examine whether you did what you said you do, which is why a documented, provable verification step is not just prevention; it is the evidence that keeps a claim from being denied. ## What underwriters now require, and how it lowers your cost The 2026 market has turned controls into pricing. Underwriters increasingly ask specifically about BEC controls when they quote, and organizations that can document a callback-verification policy, dual-approval thresholds, and email authentication 1 such as DMARC typically see better terms and fewer restrictions on their social-engineering limits. The same control that prevents the loss also improves the coverage and the price, which is a rare alignment of security and finance incentives. This reframes verification from a cost into a lever with two payoffs. First, it stops the fraud that the sub-limit would only partly cover. Second, it is the documented control that earns better renewal terms and, if a loss does occur, the evidence that the procedure was followed, which is what keeps the claim from being denied. A verification step that produces a record, showing the payee was checked and a named person approved the payment before release, is exactly what an underwriter wants to see and what an adjuster will ask for. Treating verification as an insurance requirement, not only a security nicety, is how a finance team gets both a lower premium and a defensible claim. ## Insurance is a backstop, not a control Put the pieces together and the conclusion is clear: insurance for BEC and wire fraud is real but partial, conditional, and often sub-limited below the loss, so it is a backstop rather than a defense. The dependable protection is not sending the money to the fraudster in the first place, which is also, conveniently, what earns the better coverage. This is the same reason [recovery after the fact is the exception](https://rankshieldfinancial.com/resources/wire-fraud-recovery-first-72-hours/): the leverage is before the payment settles, not after. This is where RankShield Financial fits, and honestly framed. It is a verification and attestation layer in the authorization path, not an insurer, a broker, or a custodian of funds; it does not pay claims or replace your policy. What it does is verify the payee and a named approval before a payment is released, hold anything that does not match, and seal a signed, verifiable record of the decision, which is both the control that prevents the loss and the documented evidence an underwriter rewards and an adjuster requires. It is a design-partner-stage product and claims no network it has not built. For the deeper how-to on choosing this kind of control, the [buyer’s guide](https://rankshieldfinancial.com/resources/wire-fraud-prevention-software/) covers it; if you want the control itself in front of your payments, you can [see how it works](https://rankshieldfinancial.com/how-it-works/) or [request access](https://rankshieldfinancial.com/contact/). ## What to do before your next renewal Two concrete steps before you renew. First, read your actual endorsements, not the headline limit: find your social-engineering-fraud and funds-transfer-fraud sub-limits, confirm which policy is primary, and compare the total to the largest payment your business sends. If the sub-limit is smaller than your typical wire, you are effectively self-insured for the gap. Second, put a documented verification control in place and describe it accurately on your application, because it lowers your premium, widens your limits, and, if the worst happens, is the evidence that gets the claim paid instead of denied. Insurance will remain a backstop worth having, but it pays a fraction and only under conditions, so the money is made or lost before the payment settles, not in the claim. This article is informational and not insurance or legal advice; confirm coverage specifics with your broker and read your policy. Operate it ## Verify a payment before it settles Compose a payment and the conditions around it, then run the same check the product runs on a live rail. The verdict comes back before the money would move. Pay to Amount (USD) Conditions around this payment Bank details changed by email First-time payee Amount over approval policy Approver signature verifies PRE-SETTLEMENT VERDICT RANKSHIELD NETWORK Compose a payment on the left and run the check. The verdict is returned before the money moves, the way the product returns it on a live rail. Sandbox demo · reproduces the product’s verdict logic and signing metadata · not a live network call Downloadable · SVG A BEC or wire-fraud loss is not paid from your headline cyber policy limit. It is paid from a social-engineering-fraud endorsement whose sub-limit is commonly in the $100,000 to $500,000 range, often smaller than a single fraudulent wire. The difference between that sub-limit and the size of the payment you actually send is the part you are self-insuring. Read the endorsement, find the social-engineering and funds-transfer sub-limits, and compare them to your largest payment, not the headline figure on the declarations page. FAQ ## Frequently asked questions Every question buyers ask before they trust a payment-security platform, answered directly. JAMIE KLONCZ · RANKSHIELD FINANCIAL ONLINE Pick a question on the left, or search above. You will get the direct answer, the way an answer engine would give it. REQUEST ACCESS → Self-check ## How exposed are your payments? Five controls decide whether an authorized-payment scam gets through on a fast rail. Answer them honestly to see where you stand. - 01 Do you send payments on instant or same-day rails (RTP, FedNow, same-day ACH)? - 02 Can one person both change a vendor’s bank details and approve the payment? - 03 Do you always confirm a bank-detail change on a number from your own files, not the request? - 04 Is the first payment to a new or changed payee held for verification before it goes out? - 05 Do you keep a signed record of exactly who approved each payment? Answer all five to see where you stand · 0/5 References - [Insurance Journal, cyber-enabled fraud and insurance coverage (crime vs cyber; social-engineering sub-limits $100K-$500K, often ~$250K; underwriters require callback/dual-approval/DMARC), June 2026](https://www.insurancejournal.com/magazines/mag-features/2026/06/22/874411.htm) - [Ward and Smith, P.A., Social Engineering Fraud and Your Crime Policy: why your insurer may deny the claim](https://www.wardandsmith.com/article/social-engineering-fraud-and-your-crime-policy-why-your-insurer-may-deny-the-claim-and-what-you-can-do-about-it) - [FBI IC3, 2025 Internet Crime Report (BEC $3.046B)](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) About the author ## [Jamie Kloncz](https://rankshieldfinancial.com/about/) Founder, RankShield Financial Jamie founded RankShield Financial to verify a payment’s intent and authority before it settles on instant and tokenized rails. These guides are written from building that product and reading the primary sources directly: every statistic here links to its original filing or report, never a secondhand summary. - Primary sources only: each figure links to the original filing - Honest boundaries: what verification can and cannot do is stated plainly - Last verified August 18, 2026 How RankShield Financial verifies → Request access → Verify, then settle ## See your payments verified before they settle. RankShield Financial is rolling out with design partners on instant and tokenized rails. Request access and we’ll map it to your settlement flow. Request access How it works ## Frequently asked questions ### Does cyber insurance cover wire fraud and BEC? Sometimes, partially, and often for less than the loss. BEC and wire fraud are usually covered through a specific endorsement, most often on a crime policy or as a component of a cyber policy, rather than automatically under a base cyber policy. The coverage typically splits into two distinct lines: funds transfer fraud, where a fraudster directly instructs your bank, and social engineering fraud, where your own employee is tricked into paying, which is what BEC is. BEC almost always lands in the social-engineering line, which tends to carry a lower sub-limit. So the accurate answer is that coverage may exist but is conditional and frequently capped well below a real wire. Read your endorsements and confirm specifics with your broker; this is not insurance advice. ### What is the difference between social engineering fraud and funds transfer fraud coverage? They cover different mechanisms and often pay differently. Funds transfer fraud generally applies when a fraudster instructs your bank to move money without your involvement, for example by compromising the bank channel directly. Social engineering fraud applies when your own employee is deceived into authorizing the payment, which is the mechanism behind business email compromise and most vendor-impersonation wire fraud. The distinction matters because not every policy includes both lines, and BEC almost always falls under social engineering, which typically carries the lower sub-limit. Filing a BEC loss under a funds-transfer or computer-fraud agreement, when it was really social engineering, is a common reason claims are denied on definitional grounds. Confirm which lines your policy includes and their separate limits. ### How much does cyber insurance pay for a BEC loss? Usually a fraction of a large loss, because of sub-limits. When social engineering coverage sits inside a cyber policy, sub-limits are commonly in the $100,000 to $500,000 range and often around $250,000, regardless of a much higher headline policy limit. A crime policy may provide a higher primary layer, and cyber and crime coverage can stack, so your real number is the combination of the relevant sub-limits, not the figure on the declarations page. To know your exposure, read the endorsements, identify the social-engineering and funds-transfer sub-limits, confirm which policy is primary, and compare the total to the largest payment your business sends. If your typical wire exceeds your sub-limit, insurance will not make you whole, which is the common situation rather than the exception. ### Why do insurers deny BEC and social engineering claims? The most common and most avoidable reason is that the business did not follow the verification procedure it told the insurer it had. If your application states that you confirm banking changes by callback and the loss occurred because someone skipped that step, the carrier has grounds to deny. Other frequent causes are structural: misrepresenting your controls on the application can void coverage, and filing under the wrong coverage line, claiming computer fraud or funds transfer fraud when the loss was social engineering, gets denied on definitional grounds. Exclusions specific to authorized payments can also apply because you authorized the transfer. The pattern is that carriers check whether you did what you said, so a documented, provable verification step is what keeps a valid claim from being denied. ### Does having payment verification controls lower cyber insurance costs? Generally yes, and it is becoming expected. In the 2026 market, underwriters ask specifically about BEC controls, and organizations that can document a callback-verification policy, dual-approval thresholds, and email authentication such as DMARC typically see better terms and fewer restrictions on their social-engineering limits. The same control has two payoffs: it prevents the loss that the sub-limit would only partly cover, and it is the documented evidence that earns better pricing and, after an incident, keeps the claim from being denied for a skipped procedure. A verification step that produces a record, the payee checked and a named person approving before release, is exactly what an underwriter rewards and an adjuster later requires. Treat verification as an insurance lever, not just a security control.