Social Engineering Raises Cyber Claims and Coverage Questions for Businesses

Businesses can invest heavily in digital security and still lose money because an employee trusts a convincing request. Social engineering turns routine business communication into a route around technical defenses: a message, call or video meeting can prompt staff to send funds or disclose sensitive information. That makes prevention, claims planning and close review of cyber coverage central to managing the risk.

The scale of reported losses is substantial. The FBI received 24,768 complaints related to business email compromise in 2025, with reported losses exceeding $3 billion. In these schemes, criminals impersonate executives or suppliers to redirect payments or obtain information. Verizon found that some form of human involvement appeared in 62% of breaches examined for its latest Data Breach Investigations Report.

Trust and ordinary workflows are the opening

These attacks exploit familiar business routines. A finance worker may receive what appears to be an urgent instruction from a senior executive. A supplier may seem to request a change to payment details. An employee may be asked to adjust payroll information or act on an invoice that has been altered. The request can look credible because the sender’s identity, timing and business context seem to fit.

Common methods include business email compromise, executive impersonation, false supplier payment requests, invoice manipulation, payroll diversion, phishing and spear-phishing. Some attempts now use AI-generated voice or video to make an impersonated executive seem present on a call. The technology raises the apparent credibility of the request; it does not change the underlying tactic of persuading a person to take an action.

Criminals can often assemble details for a tailored approach from information businesses publish themselves. Company websites and professional social networks may reveal staff roles, reporting relationships, supplier connections and the names of key personnel. Those details help an attacker make a request sound like part of an existing relationship.

Hybrid work can add friction to verification. Conversations that once happened in person may now take place over email, messaging apps or video. A request that would have been easy to check across an office can arrive through a digital channel, where the recipient has fewer cues about who is actually asking. When the message conveys urgency or appears to come from a trusted colleague, normal payment steps can be bypassed.

Cyber coverage may not match the loss

Cyber insurance can help absorb the financial impact when security controls fail, but the existence of a policy does not establish that every social engineering loss is covered. Some cyber policies exclude these losses. Others provide coverage subject to a sublimit, which caps the amount available for a particular type of claim. Businesses need to understand the wording and limits that apply to their own policy before an incident occurs.

The potential mismatch between loss size and available coverage is visible in claims data. NetDiligence’s 2025 Cyber Claims Study reported an average business email compromise loss of $334,000 for large companies. Its average loss for wire-transfer fraud was $644,000. Those figures describe averages in the study; an individual company’s loss and the amount its policy may pay depend on the circumstances and policy terms.

That distinction matters when a business sets its recovery expectations. A covered cyber event may involve several costs and disruptions, while a social engineering transfer could fall under a separate exclusion or restricted limit. Reviewing the policy’s treatment of fraudulent transfers, impersonation and related expenses can clarify where a business may have a financial gap.

Verification procedures can interrupt a fraudulent request

Insurance can support recovery, but it cannot prevent a payment from leaving an account or undo the disruption and stress that follow. Businesses need controls built around how employees handle money and sensitive information. Separating payment approval duties, for example, makes it harder for one person to initiate and complete a transfer without another review.

Call-back verification can add a direct check when a request asks for a payment or a change to supplier account details. The employee should use a known contact method already on file, rather than relying on contact details supplied in the new message. Companies can also set a specific process for confirming supplier account changes and establish fraud prevention steps for requests that appear to come from executives.

Multifactor authentication, employee awareness training and regular phishing simulations can strengthen digital and human defenses. Incident response planning gives staff a clearer path for reporting a suspicious message or suspected transfer. The source of a request, how it arrived and whether it changes normal procedures are all useful details for employees to check before acting.

For businesses, the practical task is to connect these measures. Technology can flag suspicious activity, clear procedures can slow an unusual payment, trained employees can recognize pressure tactics, and insurance can provide financial protection within the policy’s terms. Reviewing both payment controls and cyber coverage gives teams a more realistic picture of how they would respond if a convincing request reached the right person.