FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Crime and fraud
Crime insurance mainly covers your own money lost to theft, fraud and deception, while cyber insurance mainly covers the costs and liabilities of a security incident. Payment fraud sits between the two, so many businesses find gaps only after a loss.
Part of: Commercial crime insurance
In short
When money leaves your account because of fraud, the policy that responds depends on how it happened. If staff were deceived into paying, look for a social engineering extension, usually on a crime policy and sometimes on a cyber policy. If a hacker moved the money directly, computer or funds transfer fraud cover is the usual answer. If your compromised email caused a customer to lose money, that is a liability question for cyber or professional indemnity cover. Sub-limits, voluntary parting exclusions and verification conditions decide many claims. Cover is subject to the insurer's acceptance and the policy terms.
Insurers built crime and cyber cover for different problems. Commercial crime insurance has its roots in fidelity cover for employee theft and now commonly extends to outside fraud. Cyber insurance developed largely around data breach response: forensic investigators, notification costs, business interruption and liability to people whose data was exposed.
Payment fraud usually involves both a security weakness and a theft of money. A hacked mailbox is a cyber event, but the lost £50,000 is a crime loss. Each policy tends to cover its own half and exclude the other, so the order in which events happened can decide who pays.
Illustrative: a lettings agency's office manager has her mailbox compromised. The fraudster watches for a landlord payment run, then emails a request to change the landlord's bank details. The agency pays £31,000 to the fraudster. The cyber policy pays for the forensic investigation but has no social engineering section. The crime policy excludes voluntary parting. The money itself is uninsured.
Crime insurance commonly includes employee dishonesty, theft of money and securities, computer fraud, funds transfer fraud, counterfeit currency and forgery. Social engineering, where staff are deceived into paying, is usually an optional extension with its own sub-limit, explained in social engineering and fund transfer fraud.
Cyber insurance commonly includes incident response, data restoration, business interruption from a network outage, extortion, regulatory investigation costs where insurable, and liability for data and network security failures. Some cyber wordings add a cyber crime or social engineering section, typically with a lower limit than a crime policy would offer. See our cyber insurance guide.
| What happened | Crime policy | Cyber policy |
|---|---|---|
| Staff pay a fake supplier account after a spoofed email | Social engineering extension, often sub-limited | Only if a social engineering or cyber crime section is included |
| Director impersonated by deepfake voice or video | Social engineering extension, depending on how an instruction is defined | Possibly, under a cyber crime section |
| Hacker uses stolen credentials to send payments from your bank account | Computer or funds transfer fraud, commonly | Often under cyber crime; incident costs usually covered |
| Employee diverts payments to their own account | Employee dishonesty, commonly | Not usually |
| Your hacked mailbox leads a customer to pay a fraudster | Not usually, as crime covers your own loss | May respond under liability, subject to terms |
| Forensic investigation of how the email was compromised | Rarely | Commonly, under incident response |
| Client money you hold is redirected | Possibly, if property held for others is included | Possibly; professional indemnity may also be relevant |
The table is a general guide. Every outcome depends on the wording, the limits bought and the facts.
Some businesses assume their bank will refund a fraudulent payment. In Philipp v Barclays [2023] UKSC 25 the Supreme Court held that where a customer clearly authorises a payment, the bank's duty is to execute it. The PSR reimbursement requirement that started on 7 October 2024 covers only individuals, micro-enterprises and charities with income under £1 million, up to £85,000, and excludes international payments. That leaves most businesses relying on their own insurance. See APP fraud reimbursement for businesses.
Related reading: invoice redirection fraud: who pays, CEO fraud and deepfakes, employee theft and fraud insurance and the wider wire fraud and crime cover overlap.
Apex arranges commercial crime and fraud cover, including social engineering, invoice fraud and employee fidelity. A broker reads each enquiry and comes back with options, with no fee for a quote, and cover is subject to the insurer's acceptance and the policy terms. We need your business activities, turnover, location and claims history, plus your current crime and cyber wordings if you have them, payment controls and the limits you want.
Sometimes. Many cyber policies cover the cost of investigating a hacked mailbox and the liability that follows, but not the money your staff were tricked into sending, unless a social engineering or cyber crime section is included. Where it is, the limit is often lower than a crime policy would offer. Check the wording.
Many businesses benefit from both, because they cover different things. Crime protects your own money against theft, fraud and deception, including by employees. Cyber covers incident response, data and network liability and business interruption. Payment fraud often involves both, so the question is where social engineering cover sits and at what limit.
It is a common crime and computer fraud exclusion for losses where someone with authority knowingly handed over money or goods, even if they were deceived. It is the main reason invoice and CEO fraud claims fail under standard wordings. A social engineering extension is usually needed to cover these deceived payments.
Usually not your crime policy, which covers your own losses. The customer's claim against you is a liability question, which may fall under a cyber policy's network security or privacy liability section, or professional indemnity cover for advisory firms. Whether it responds depends on the wording and the facts.
Computer fraud cover usually responds when a criminal enters or manipulates your systems to move money without authority. Social engineering cover responds when your own authorised staff send the money after being deceived. Many losses involve deception rather than intrusion, so computer fraud cover alone often leaves a gap.
There is no single right answer. A crime policy often allows higher social engineering limits and pairs it with employee dishonesty cover, while a cyber section can be convenient for smaller firms. What matters is that one policy clearly covers deceived payments at a limit that reflects your largest regular payments.
Tell us what your business does, your turnover and any claims. A broker reads every enquiry and comes back with options. No fee for a quote. Or call 0117 325 0027.
Start a commercial enquiry Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
