{
  "id": "clause-social-engineering",
  "type": "clause",
  "languages": {
    "en": {
      "id": "clause-social-engineering",
      "lang": "en",
      "type": "clause",
      "title": "Social Engineering Clause",
      "shortDefinition": "The social engineering clause extends crime or cyber cover to financial loss arising when an employee is deceived (for example by spoofed emails or calls) into making a good-faith but fraudulently induced transfer of funds or property.",
      "synonyms": [
        "Social Engineering Fraud",
        "Fraudulent Instruction Coverage"
      ],
      "linesOfBusiness": [
        "Cyber insurance",
        "Crime insurance"
      ],
      "jurisdictions": [
        "Global"
      ],
      "tags": [
        "Cyber",
        "Fraud",
        "Crime"
      ],
      "relations": {
        "relatedTerms": [],
        "partOf": [],
        "appliesTo": [
          "cov-cyber",
          "cov-vertrauensschadenversicherung"
        ],
        "regulatedBy": [],
        "relevantFor": [],
        "insurableVia": [],
        "mitigatedBy": [],
        "comprises": [],
        "alternativeTo": [],
        "complementedBy": []
      },
      "attribute": null,
      "profile": null,
      "coverageProfile": null,
      "clause": {
        "kind": "extension",
        "origin": "international-programme",
        "favours": "insured",
        "negotiability": "negotiable",
        "standardWordings": []
      },
      "legalBasis": [],
      "standards": [],
      "reviewStatus": "expert-reviewed",
      "reviewedBy": "Guido Hesse, Hesse Group Holding AG",
      "lastReviewed": "2026-09-04",
      "version": "0.1.0",
      "updated": "2026-09-03",
      "generated": {
        "by": "cursor-agent/claude-sonnet-5",
        "at": "2026-09-03T00:00:00.000Z"
      },
      "verified": [
        {
          "by": "human:ghesse",
          "at": "2026-09-04T00:00:00.000Z",
          "method": null
        }
      ],
      "staleAfter": null,
      "url": "https://hgh.ch/lexikon/en/knowledge/clause/social-engineering-clause/",
      "alternateUrl": "https://hgh.ch/lexikon/de/wissen/klausel/social-engineering-klausel/",
      "body": "## Purpose\n\nTraditional computer-fraud and funds-transfer-fraud insuring agreements in crime and cyber policies generally require an unauthorised system intrusion by the perpetrator. In social engineering losses (for example CEO fraud or fake supplier invoices), by contrast, a deceived but formally authorised employee initiates the payment itself (\"voluntary parting\"). Without a dedicated clause such losses often fall outside the scope of cover; the social engineering clause is designed specifically to close this gap.\n\n## Effect and limits\n\nThe clause almost always carries its own, materially lower sub-limit (typically USD 25,000–250,000, sometimes higher), reflecting the growing frequency and severity of such losses. Cover is usually subject to strict conditions precedent, such as call-back verification via an independently known number or dual authorisation for payment releases; failure to follow these controls can allow the insurer to decline the claim regardless of the loss amount. The clause can appear in either crime or cyber policies, and sometimes both, in which case an order-of-payment or excess clause governs how the two respond.\n\n## Negotiation and practice\n\nPolicyholders should check whether social engineering cover already exists under an existing crime or cyber contract, whether the sub-limit is realistic relative to typical payment volumes, and which control obligations (call-back verification, release processes) form a condition of cover. Where both crime and cyber policies are in place, the excess/primary ordering between the two should be clarified to avoid either duplicate or missing cover."
    },
    "de": {
      "id": "clause-social-engineering",
      "lang": "de",
      "type": "clause",
      "title": "Social-Engineering-Klausel",
      "shortDefinition": "Die Social-Engineering-Klausel erweitert Crime- oder Cyber-Deckungen um Vermögensschäden, die entstehen, wenn ein Mitarbeitender durch Täuschung (z.B. gefälschte E-Mails oder Anrufe) zu einer gutgläubigen, aber betrügerisch veranlassten Vermögensverfügung bewegt wird.",
      "synonyms": [
        "Social Engineering Fraud",
        "Fraudulent Instruction Coverage"
      ],
      "linesOfBusiness": [
        "Cyberversicherung",
        "Vertrauensschadenversicherung"
      ],
      "jurisdictions": [
        "Global"
      ],
      "tags": [
        "Cyber",
        "Betrug",
        "Vertrauensschaden"
      ],
      "relations": {
        "relatedTerms": [],
        "partOf": [],
        "appliesTo": [
          "cov-cyber",
          "cov-vertrauensschadenversicherung"
        ],
        "regulatedBy": [],
        "relevantFor": [],
        "insurableVia": [],
        "mitigatedBy": [],
        "comprises": [],
        "alternativeTo": [],
        "complementedBy": []
      },
      "attribute": null,
      "profile": null,
      "coverageProfile": null,
      "clause": {
        "kind": "extension",
        "origin": "international-programme",
        "favours": "insured",
        "negotiability": "negotiable",
        "standardWordings": []
      },
      "legalBasis": [],
      "standards": [],
      "reviewStatus": "expert-reviewed",
      "reviewedBy": "Guido Hesse, Hesse Group Holding AG",
      "lastReviewed": "2026-09-04",
      "version": "0.1.0",
      "updated": "2026-09-03",
      "generated": {
        "by": "cursor-agent/claude-sonnet-5",
        "at": "2026-09-03T00:00:00.000Z"
      },
      "verified": [
        {
          "by": "human:ghesse",
          "at": "2026-09-04T00:00:00.000Z",
          "method": null
        }
      ],
      "staleAfter": null,
      "url": "https://hgh.ch/lexikon/de/wissen/klausel/social-engineering-klausel/",
      "alternateUrl": "https://hgh.ch/lexikon/en/knowledge/clause/social-engineering-clause/",
      "body": "## Zweck\n\nKlassische Computer- und Überweisungsbetrugsdeckungen in Vertrauensschaden- («Crime») und Cyber-Policen verlangen meist eine unautorisierte Systemzugriffshandlung des Täters. Bei Social Engineering (z.B. CEO-Fraud, gefälschte Lieferantenrechnungen) veranlasst dagegen ein getäuschter, aber formal autorisierter Mitarbeitender die Zahlung selbst («voluntary parting»). Ohne eigenständige Klausel fällt dieser Schaden häufig aus dem Deckungsumfang heraus; die Social-Engineering-Klausel schliesst diese Lücke gezielt.\n\n## Wirkung und Grenzen\n\nDie Klausel ist praktisch immer mit einem eigenen, deutlich niedrigeren Sublimit versehen (marktüblich USD 25'000–250'000, teils darüber), da Häufigkeit und Schadenhöhe seit Jahren steigen. Deckung setzt meist strikte Voraussetzungen («conditions precedent») voraus, etwa eine telefonische Rückverifikation über eine unabhängig bekannte Nummer oder ein Vier-Augen-Prinzip bei Zahlungsfreigaben; werden diese Kontrollen nicht eingehalten, kann der Versicherer die Deckung unabhängig von der Schadenhöhe verweigern. Die Klausel kann sowohl in Crime- als auch in Cyber-Policen vorkommen, teils in beiden mit Subsidiaritätsregeln zwischen den Verträgen.\n\n## Verhandlung und Praxis\n\nVersicherungsnehmer sollten prüfen, ob Social-Engineering-Deckung bereits in bestehenden Crime- oder Cyber-Verträgen enthalten ist, welches Sublimit im Verhältnis zum typischen Zahlungsvolumen realistisch ist, und welche Kontrollpflichten (Rückverifikation, Freigabeprozesse) als Bedingung für den Versicherungsschutz gelten. Bei parallelem Crime- und Cyber-Vertrag ist die Subsidiaritätsklausel zwischen beiden Policen zu klären, um Doppel- oder Nichtdeckung zu vermeiden."
    }
  }
}