Nobody broke in. Somebody was asked, and they said yes.

Social engineering fraud

Money paid away because an employee was deceived into authorizing it.

Without it — The transfer was authorized by your own staff, which is the exact reason a crime policy without this wording declines it.

Funds transfer fraud

Money moved out by an instruction to your bank that you did not give.

Without it — Commercial accounts carry none of the consumer protections, so recovery depends entirely on speed and goodwill.

Invoice manipulation

Payments your customers send to a criminal after your systems or email were used to redirect them.

Without it — The customer paid what looked like your invoice, and the argument about who absorbs it is with your own client.

Computer fraud

Direct theft of money, securities or property through unauthorized access to your systems.

Without it — The loss is a straight cash shortfall with no policy behind it.

Cyber extortion

Ransom demands, the specialists who negotiate them, and payment where it is lawful.

Without it — A business decides whether to pay a ransom with its own cash, at speed, without anyone who has done it before.

Data restoration and business interruption

Rebuilding what was encrypted or destroyed, and income lost while systems are down.

Without it — Recovery is funded from cash flow during the weeks the business is least able to generate it.

Our crime policy covers employee theft. Is that the same thing?

No, and the gap between them is where most of these losses land. A traditional crime policy answers for dishonesty by your own employees and for theft of property, and it generally excludes a payment your employee was tricked into making voluntarily. Social engineering wording exists precisely because the older forms treated a deceived but genuine authorization as outside the cover they were written for.

The bank moved the money. Will they give it back?

Sometimes, if you catch it within hours. Consumer accounts carry protections that commercial accounts do not, so a business transfer is largely a question of whether the receiving bank still holds the funds. Speed changes the outcome more than argument does, which is why the coverage is written alongside a response team rather than as a reimbursement promise.

Is this not already in our cyber policy?

Parts of it usually are, at limits far below the rest of the policy. Extortion and restoration are normally present, while the coverages that pay for stolen money are frequently sublimited to a fraction of the policy limit or left off entirely unless asked for. Reading the schedule rather than the policy name is the only way to know which applies to you.

Why the fast-paying coverages carry the smallest limits

Does paying a ransom create a legal problem?

It can, which is one of the practical reasons the coverage comes with people attached. Payments to sanctioned entities are prohibited, so a legitimate response involves checking who is being paid before anything moves. A negotiator and counsel who handle these regularly are doing that check as part of the work.