Social engineering fraud
Also called Business email compromise, BEC, impersonation fraud or invoice fraud
Definition
Social engineering fraud is a scam where criminals pose as someone you trust, such as a supplier or coworker, to trick you into sending money or sensitive information.
Social engineering fraud targets people, not computers. Instead of breaking into your systems, the criminal convinces someone on your team to do the work, usually by changing payment details or approving a transfer that looks routine.
The best-known version is business email compromise (BEC). The FBI’s Internet Crime Complaint Center (IC3) describes BEC as a sophisticated scam that targets businesses and individuals who make legitimate transfers of funds. It’s often carried out by taking over real email accounts through social engineering or computer intrusion.
How it usually happens
- A “supplier” emails to say its bank details have changed and the next invoice should go to a new account.
- A message that looks like it’s from the owner asks a bookkeeper to send money urgently.
- A criminal who has taken over an email account jumps into a real conversation with a client and redirects a payment.
IC3 recommends using a secondary channel to verify any request to change account information, checking the sender’s email address carefully, and, if money has gone out, contacting your bank right away to request a recall and filing a complaint at ic3.gov. In practice, verifying means calling the vendor at a number you already have, not one in the email.
How insurance may respond
This is where gaps show up. Because an employee authorized the payment, coverage that requires hacking or theft in the usual sense may not apply. Property and general liability policies typically don’t cover it either. Some cyber insurance policies offer social engineering coverage, often by endorsement, usually with a sublimit smaller than the main limit, and sometimes with conditions such as call-back verification. Crime insurance, a separate type of policy, may also offer it. Coverage depends on the policy’s terms, limits and exclusions.