Does business insurance cover a deepfake or AI voice scam?
Sometimes, and not under the policy most owners expect. A wire sent because an employee was fooled by a fake voice, video or email is usually not covered by general liability or by the basic part of a cyber policy. It is covered, if at all, by a crime policy or a social engineering fraud endorsement, which often has a much lower limit and can be defeated by a voluntary parting exclusion when an authorized employee sent the money. Ask for the coverage by name and read the conditions about verification.
Tell us the situation.
One licensed human replies the same business day — not five agents, not an auto-responder. If the policy you have is already the right one, we will tell you.
We use this to quote and service your insurance, and we do not sell it or pass it to lead networks. Privacy policy.
Send us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
What the Arup case shows
In early 2024 a finance employee at the engineering firm Arup in Hong Kong received a message that appeared to come from the company’s chief financial officer asking for a confidential payment. He suspected phishing, then joined a video call where the CFO and several colleagues appeared and spoke. All of them were deepfakes. He sent 15 transfers totaling about US$25.6 million to five accounts and found out about a week later when he checked with headquarters.
The lesson for a small business is not the size. It is that no system was hacked. A person with authority sent the money, believing the instruction was real. That one fact decides most of the insurance answer.
Why this is the hard case for insurance
Insurance is built around the difference between theft and a voluntary payment. If a thief breaks in, or a hacker takes the money directly from your account, a crime or cyber policy can respond. If your own employee, using their own authority, sends the money because they were tricked, many forms treat it as a voluntary transfer.
The reported example is Midlothian Enterprises v. Owners Insurance, where a fraudster posing as the company’s president emailed an employee to wire money. The court held the crime policy’s voluntary parting exclusion barred coverage, because the employee was authorized to send the funds and did, and the fact that someone else pretended to approve it did not change that. A voice clone or a deepfake video is the same fact pattern with a better disguise.
Insurance companies responded by offering social engineering fraud coverage, usually as an endorsement on a crime or cyber policy, which gives back some coverage for exactly this situation. It tends to carry its own limit, smaller than the policy’s main limit, and conditions, for example that you confirmed the request by calling back on a number you already had.
What to check in the wording
Four phrases tell you most of it: “social engineering,” “funds transfer fraud,” “voluntary parting” and “verification.” The first two tell you whether a tricked payment has a grant at all. The third is the exclusion that can take it back. The fourth is the condition that can void it.
Then look at the definitions. Does social engineering include a request by voice, text or video as well as email? Does it cover a vendor’s changed bank details as well as an executive’s request? Is the limit separate from, or inside, the cyber limit? We cannot give you a typical limit, because the figures we found came from commentary and not from policy forms.
A deepfake scam, policy by policy
General liability
- Likely result
- No
- Why
- No bodily injury, property damage or advertising injury; money lost to fraud is not what it covers
Cyber liability, core grants
- Likely result
- Often no
- Why
- No system was breached; the loss is a payment, not a data or network event
Cyber with social engineering endorsement
- Likely result
- Maybe, up to a smaller limit
- Why
- Depends on the definition (voice and video included?) and any verification condition
Crime policy
- Likely result
- Maybe
- Why
- Voluntary parting exclusion can defeat it when an authorized employee sent the money; some forms have a social engineering extension
Your bank
- Likely result
- Sometimes recovers funds if told at once
- Why
- Recovery depends on speed; it is not insurance
Typical, not guaranteed. Always check against your forms.
The detail
In the Arup case reported in May 2024, a finance employee in Hong Kong joined a video call in which the company’s chief financial officer and colleagues were all deepfakes, and made 15 transfers totaling about HK$200 million (about US$25.6 million) to five bank accounts; the employee had first suspected a phishing email and was reassured by the call.
In Midlothian Enterprises v. Owners Insurance (E.D. Va., reported 2020) a court held a crime policy’s voluntary parting exclusion barred coverage when an employee wired money after a fraudster posing as the company president emailed the request, because the employee was authorized to make transfers and sent it voluntarily.
FinCEN issued an alert (FIN-2024-Alert004) in November 2024 to help financial institutions spot fraud schemes that use generative-AI deepfake media, after seeing a rise in suspicious activity reports describing suspected deepfake use since 2023.
Arup said after the incident that its financial stability and business operations were not affected and that none of its internal systems were compromised, which is the pattern that makes these losses a crime-policy question rather than a data-breach one.
What this means for you
- Ask for social engineering fraud coverage by name. Do not assume it is inside cyber or crime. Ask the limit, whether voice and video are included and what verification it requires.
- Adopt a callback rule and write it down. Any request to move money or change bank details gets confirmed by calling a number already on file, never the number in the message. Many forms make this a condition.
- Require two people above a set amount. The Arup employee was alone with the instruction. A second approver breaks the scam.
- Agree a family or team safe word for emergencies. Voice clones need only a few seconds of audio, so a recorded greeting or a social post is enough to copy.
- Act within hours. Call the bank to recall the wire, tell your insurance agent and report the loss. Speed helps recovery and your policy likely has a notice condition.
Related questions
- Does cyber insurance cover a deepfake scam?
The core of a cyber policy covers data and network events, and a deepfake scam usually has neither. Coverage, when it exists, comes from a social engineering fraud extension, which often has a lower limit and verification conditions. Ask for it by name.
- Tech E&O against cyber
- What is a voluntary parting exclusion?
A clause in a crime policy that removes coverage when someone with authority knowingly sends the money or property, even if they were tricked into doing it. A court applied it in the Midlothian case to a spoofed email from a company president.
- What is social engineering fraud coverage?
Coverage, usually an endorsement on a crime or cyber policy, for a loss where an employee is deceived into sending money or changing payment details. It usually has its own limit and conditions, and it is the coverage most relevant to a voice clone or deepfake.
- Can my bank get the money back?
Sometimes, if you call right away. Recovery drops quickly with time. It is not a substitute for coverage, and you should not rely on a percentage you may have seen without checking the source.
- Can AI voice scams target an individual owner as well as a business?
Yes, for example a call that sounds like a relative in trouble. Those losses are personal, not business, and a business policy will not respond to them.
Need this handled?
Reading about it and having it handled are different jobs, and the second one is ours. We place the accounts other brokers decline — claims history, a cancellation, an unusual operation, a business nobody wants to underwrite twice — and we will tell you when the policy you already have is the right one. Tell us the situation and a licensed human replies the same business day.
Written by Kevin Kelsey, founder and principal agent, CA License #6011822, at Boring Insurance. Last updated 2026-10-25. See all guides.