Social Engineering Clause
The social engineering clause extends crime or cyber cover to financial loss arising when an employee is deceived (for example by spoofed emails or calls) into making a good-faith but fraudulently induced transfer of funds or property.
- Clause type
- Extension
- Origin/Market
- International programme
- Favours
- Insured
- Negotiability
- Negotiable
Purpose
Traditional computer-fraud and funds-transfer-fraud insuring agreements in crime and cyber policies generally require an unauthorised system intrusion by the perpetrator. In social engineering losses (for example CEO fraud or fake supplier invoices), by contrast, a deceived but formally authorised employee initiates the payment itself (“voluntary parting”). Without a dedicated clause such losses often fall outside the scope of cover; the social engineering clause is designed specifically to close this gap.
Effect and limits
The clause almost always carries its own, materially lower sub-limit (typically USD 25,000–250,000, sometimes higher), reflecting the growing frequency and severity of such losses. Cover is usually subject to strict conditions precedent, such as call-back verification via an independently known number or dual authorisation for payment releases; failure to follow these controls can allow the insurer to decline the claim regardless of the loss amount. The clause can appear in either crime or cyber policies, and sometimes both, in which case an order-of-payment or excess clause governs how the two respond.
Negotiation and practice
Policyholders should check whether social engineering cover already exists under an existing crime or cyber contract, whether the sub-limit is realistic relative to typical payment volumes, and which control obligations (call-back verification, release processes) form a condition of cover. Where both crime and cyber policies are in place, the excess/primary ordering between the two should be clarified to avoid either duplicate or missing cover.