A trusted employee can divert customer payments, create a false vendor, misuse a company card, or change payroll information. An outside criminal can impersonate an owner, vendor, or bank and convince staff to transfer money. These events may look similar after the money disappears, but commercial crime policies divide them into specific insuring agreements.

Business owners often assume general liability, property, a fidelity bond, or cyber insurance will cover any theft. That assumption can be expensive. Employee theft, forgery, computer fraud, funds transfer fraud, social engineering, money and securities, and client-property coverage may each have different limits, exclusions, and proof requirements.

Employee Theft Coverage

Employee theft coverage may protect the business from direct loss of money, securities, or other property caused by dishonest acts committed by an employee with intent to cause loss and obtain financial benefit, subject to the form. The definition of employee is crucial.

Owners, partners, leased workers, temporary employees, independent contractors, volunteers, and former employees may be treated differently. A company using outsourced bookkeeping or virtual assistants should confirm whether those people qualify or require special endorsement.

Forgery and Alteration

Forgery coverage addresses certain losses involving forged or altered checks, drafts, promissory notes, or similar instruments. Modern payment methods can fall outside older wording, so the company should map how it receives and sends money.

Positive pay, dual approval, check controls, bank alerts, and separation of duties reduce risk. The policy may also require prompt notice to the bank and insurer. Delayed discovery can make recovery more difficult.

Computer and Funds Transfer Fraud

Computer fraud and funds transfer fraud typically require particular methods of unauthorized access or instructions. A hacker who enters the system and sends an unauthorized transfer may be treated differently from an employee who voluntarily sends money after being deceived.

Review the definitions and causation wording carefully. Policies may dispute whether email manipulation, remote-access software, vendor portal changes, or credential theft satisfies the insuring agreement. Cyber and crime policies should be compared side by side.

Social Engineering Fraud

Social engineering involves deception that persuades an authorized person to transfer money or property. Common examples include fake executive requests, changed vendor banking instructions, fraudulent closing instructions, and urgent payment demands.

Coverage is often optional and may carry a lower sublimit, separate retention, callback requirement, or dual-verification condition. If staff do not follow the required procedure, the claim may be reduced or denied even when the fraud itself is convincing.

The Difference Between Crime and Cyber Insurance

Cyber insurance often focuses on data breaches, network security, privacy liability, incident response, cyber extortion, and system interruption. Crime insurance focuses on theft and fraudulent loss of money, securities, or property. Some forms overlap, but neither should be assumed to replace the other.

Coordinate limits and other-insurance provisions. A loss may implicate email compromise under the cyber policy and funds transfer under the crime policy. Prompt notice to both carriers may be appropriate when the correct coverage is uncertain.

Internal Controls That Reduce Loss

Use dual approval for new vendors and payment changes, verify requests through a known phone number, separate payment setup from approval, review bank activity daily, restrict administrator rights, and require vacations for employees in sensitive financial roles.

Train staff that urgency, secrecy, new bank information, unexpected attachments, and requests to bypass procedure are warning signs. Controls should apply to owners and executives too; fraud succeeds when status is used to override normal checks.

A Practical Claim Scenario

A bookkeeper receives an email that appears to come from the owner and is told to pay a confidential acquisition expense immediately. The bookkeeper sends $85,000 to the criminal’s account using valid bank credentials. Computer fraud coverage may not respond if no hacker directly entered the system, while a social engineering endorsement may apply only if callback procedures were followed.

The scenario does not predict how any particular carrier would respond. It shows why accurate applications, prompt reporting, complete records, and coordinated coverage matter. Small differences in ownership, timing, policy language, or the cause of loss can change the result.

How to Review This Exposure at Renewal

Begin with the operation rather than the current policy. Document what changed during the year, including locations, services, contracts, employees, payroll, revenue, vehicles, equipment, vendors, and customer requirements. A policy can renew without interruption and still become outdated if the information behind it no longer reflects the business.

Next, compare the exposure with the policy definitions, exclusions, endorsements, sublimits, deductibles or retentions, reporting requirements, and covered locations. Do not rely only on the coverage name shown in a proposal. Two policies with similar labels can respond differently because the forms and endorsements are different.

Documentation That Strengthens the Insurance Program

Written procedures help reduce claims and demonstrate that management takes the exposure seriously. Keep training records, inspection logs, incident reports, contracts, certificates, maintenance records, photographs, and corrective-action documentation in a consistent location. Records should show not only that a policy exists, but that supervisors enforce it.

When an incident occurs, preserve evidence and report it through the policy’s required channel promptly. Avoid promising that insurance will pay, admitting fault, altering records, or disposing of damaged property before receiving direction. Coverage decisions belong to the carrier and depend on the policy and facts.

Questions to Ask Your Insurance Advisor

Ask what must happen to trigger coverage, who qualifies as an insured, which limits and sublimits apply, whether defense costs reduce the limit, and what exclusions are most important for the operation. Also ask how this policy coordinates with general liability, professional liability, property, commercial auto, workers’ compensation, cyber, crime, and umbrella coverage.

Finally, ask what operational information the carrier expects to receive during the policy term. Acquisitions, new services, new states, transportation, major equipment, higher payroll, large contracts, or changes in ownership may require an endorsement or underwriting review before renewal.

Common Mistakes to Avoid

One common mistake is assuming that a prior year’s policy or another company’s certificate proves the current operation is protected. Coverage must be evaluated for the named insured, locations, services, people, vehicles, property, contracts, and policy period involved. Another mistake is waiting until a claim, audit, contract deadline, or renewal week to disclose a material change.

Businesses should also avoid comparing proposals on premium and limits alone. A lower price can come with a narrower definition, a restrictive endorsement, a higher retention, a smaller sublimit, or an exclusion that directly affects the operation. Request complete forms when available, document important carrier answers, and keep the final policy with the application and endorsements.

Schedule a midterm review when the business is growing or changing quickly. A short check halfway through the policy year can identify payroll drift, new equipment, added services, contract requirements, driver changes, or location issues while there is still time to address them deliberately.

Assign one person to own the insurance information and create a simple change log. The log should record the date, operational change, documents involved, person notified, carrier or broker response, and any endorsement issued. Central ownership reduces the chance that an important email remains with a manager who assumes someone else handled it. It also creates a clear record for renewal, audit, certificate requests, and claim reporting.

Keep proof of every requested policy change and verify the revised declarations or endorsement after it is issued. A request sent to an agent is not the same as confirmation that the carrier accepted and completed the change. Review names, dates, locations, limits, and wording for accuracy.

Prepare for a Claim Before One Happens

Create a claim-response sheet that identifies the first internal contact, broker, carrier reporting channel, emergency vendors, legal contact, technology provider, and person responsible for preserving records. Keep a copy outside the normal business systems. During a serious event, employees should not lose time searching email for a policy number or deciding who has authority to act.

Managers should understand the difference between helping an injured or affected person and making an insurance promise. Provide appropriate emergency assistance, cooperate with authorities, and communicate respectfully, but do not admit legal responsibility, estimate a settlement, or guarantee coverage. Facts can be documented without speculation. The insurer should receive timely notice and an opportunity to investigate under the policy.

After the immediate response, conduct a documented review focused on prevention rather than blame. Identify the condition, decision, training, maintenance, communication, vendor, or process that contributed to the event. Assign corrective actions with owners and due dates, then verify completion. Trend similar incidents and near misses across locations so the business can address patterns instead of treating every loss as unrelated.

Leadership and Accountability

Insurance performs best when responsibility is clear. Owners should assign leadership for safety, contracts, driver approval, certificates, property values, incident reporting, and renewal information. Supervisors should be measured on whether procedures are followed, not only on speed or revenue. When management routinely overlooks exceptions, the written policy loses value and the business becomes harder to defend and insure.

The PNA Approach

Prosperity North Advisors helps businesses separate cyber, crime, employee theft, and funds transfer exposures. We review who handles money, how payments are approved, whether client funds are held, which workers have access, and what verification controls the carrier requires.

The objective is to match the insuring agreements to realistic loss scenarios. A large overall crime limit can still leave a major gap if social engineering carries only a small sublimit or if outsourced personnel do not meet the policy’s definition of employee.

Frequently Asked Questions

Does general liability cover employee theft?

-Usually not. Commercial crime or employee theft coverage is designed for dishonest acts involving money, securities, or property, subject to the policy.

Is social engineering the same as computer fraud?

-Not necessarily. Social engineering usually involves an authorized person being deceived, while computer fraud may require unauthorized computer use. Policy definitions matter.

Are independent contractors covered as employees?

-Not automatically. The crime policy’s definition of employee should be reviewed, and contractors or outsourced workers may require an endorsement.

What should a business do immediately after discovering fraud?

-Secure accounts, contact the bank, preserve records, follow legal guidance, and notify the insurer through the required channel promptly.

PNA Pro Tip: Require verbal verification through a previously known phone number for every new vendor and every request to change payment instructions, regardless of who appears to send the email.

Call to Action

Prosperity North Advisors can compare your commercial crime and cyber policies, review important sublimits, and help identify payment-control requirements before a fraud loss occurs.

Schedule a commercial insurance consultation with Prosperity North Advisors or call (480) 730-2430.

Internal Link Suggestions

Primary service page: commercial insurance solutions

Pest control specialty: pest control business insurance

Assisted living specialty: assisted living facility insurance

Authoritative Sources

FTC – Cybersecurity for Small Business

CISA – Secure Your Business

Publishing Disclaimer

This article is for general educational purposes only and is not legal advice or a guarantee of coverage. Insurance coverage depends on the policy language, endorsements, exclusions, facts of the loss, and the carrier’s claim determination. Business owners should review their specific policies and contracts with a licensed insurance professional.