Insurance covers the loss of money resulting from a bank transferring funds based on fraudulent instructions received from someone pretending to be the authorized user.

Things to watch for:

• Policies typically cover the loss if—
  • Instructions are initiated by phone, fax, email or online.
  • Applies to money and securities, not property or data.
  • May be contingent on the company following security protocols.
• Social Engineering Fraud is often not covered, but can be covered by a separate endorsement.
• Coverage may be a sub-limit of the policy limit.
• Funds transfer fraud may trigger other coverage under Data Breach or Network Security.
• Funds Transfer coverage can be found in a stand-alone Crime Policy or maybe a sub-limit as part of a BOP or Management Liability Policy.
• Some of the underwriting factors include: frequency of funds transfer activity, the dollar value of transfers, funds transfer controls, whether the company allows transfers per email instruction, how vendor changes are made, whether or not there is employee training and claims history. 

Insurance covers the payment demanded in order to stop attacks on the company’s website, network, or computer systems.

Things to watch for:

• Coverage is usually triggered when a threat is received—either an attack on the computer system or release of confidential information.
• Something—usually money—is demanded from the company.
• Actual intrusion isn’t necessary—it’s about the threat. 
• Ransomware coverage is found in cyber policies, but there's also coverage under kidnap ransom & extortion policies.
• Ransomware coverage may be coordinated with other parts of a cyber policy such as network security liability, data breach, data asset restoration or business interruption to address an actual data breach or system intrusion. 
• Companies often work with agents/insurers to determine the best course of action.
• Agreement by the insurer to pay the ransom is usually a policy requirement.  
• The insurer’s response team usually knows about the ransomware used.
• Coverage may be sub-limited.
• Demands are usually small so a low retention is helpful.  
• Some of the notable exclusions include: acts by an insured (crimes), threats to third-party systems (such as utilities), amounts paid prior to notifying the insurer, amounts needed to improve systems following an attack.
• Some of the underwriting factors include whether the company has security controls, disaster recovery plans, data encryption, intrusion detection software, and claims history.

Insurance covers the direct loss from the impersonation of an employee, vendor, or client. 

Things to watch for:

• Some policies require a verification procedure.
• Social Engineering endorsements can be found on some crime and cyber policies. It’s a newer coverage and not all carriers offer it at this time. 
• Without this endorsement, there will likely be no coverage found in any policy. Direct loss from errors is not generally covered.  
• Notable Coverage Features:
  • Covers direct loss; excludes indirect or consequential damages. (For example, late fees owed to a vendor who didn’t receive payment.)
  • Usually covers fraudulent instructions received by email, fax, phone, or in writing.
  • Form may have a verification procedure requirement such as a callback.
  • Coverage is usually sub-limited.  
    

• Underwriting Factors:
  • Frequency and amount of funds transfer activity
  • Funds transfer controls
  • Whether or not transfers per email instruction are permitted 
  • Verification of vendor changes
  • Employee training
  • Claims history 

Insurance covers the loss of income and costs in excess of normal operating expenses required to maintain the business and restore operations. It may also cover dependent business interruption.

Things to watch for:

• Traditional BI Coverage is not sufficient. Property policies do not extend coverage to loss or damage to electronic data. Data is not considered a physical object subject to loss or damage. 
• An incident usually triggers breach response coverage (forensics expenses, data restoration). 
• System failures due to employee error are probably not covered. 
• The BI sublimit caps the payout under the policy. Coverage will often include a separate BI deductible or BI waiting period, either in hours or days, before liability will arise under the policy.
• Key exclusions include system upgrades and utility failures.
• Some of the underwriting factors include the business size, industry control of the environment, the breach response plan, and claims history.
• Insurance typically pays for breach response and expertise.