I'm reading more-and-more about Cyber fraud in the news and Insurance Trade Journals. Earlier this week, my favorite security-blogger, Brian Krebs published a report of a dispute between a Texas manufacturing firm and Chubb Insurance Group where the TX firm is suing Chubb to recover $480,000 that was scammed from them by criminals that pretended to be the CEO of the firm. You can read the whole blog here if you want the details, but the short version is that the employee that made the wire transfer relied on an email and telephone call and a pledge of secrecy and the firm was bilked out of $480,000 by wire transfer. The employee got suspicious when the thieves requested an additional $18 Million to complete the deal, otherwise the loss would have been much greater.
If you think this is an unlikely event, consider the FBI Statistics found here that estimate that 7,066 U S Victims lost $747,659,840 between October 2013 and August of 2015! The scheme is variously called 'Business Email Compromise' or sometimes 'CEO fraud' and often involves getting access to company email accounts through viruses or worms and sometimes involves the thieves buying domains that may look a LOT like the company domain (imagine for a minute a thief buying a domain that substituted the letter 'l' for the '1' in our domain www.Since1849.com - ther result wouldn't look much different, now would it.).
The insurance problem stems from the policy definitions of things like 'forgery' and 'wire transfer' where most policies clearly were never written to respond to every trick and device of these complex techniques used by large-scale criminal operations. Another blogger named Stacy Collett recently reported here that a privacy survey by The Betterley Report concluded that only eight of 31 leading cyber insurance policies cover fraudulent wire transfer and a lot of those have further restrictive language if the insured is the one that initiates the wire transfer, as is the case of the TX manufacturer.
This is a complex subject and you need to take the Risk Assessment, the Prevention, and the Cyber and Crime insurance aspects most seriously. At Mitchell Insurance, we take these matters seriously, both as a technology-driven employer and as a member of your Risk Management team... please reach out to us and allow us to help you steer your way through this complex and potentially financially devastating topic. Here are a few resources that you might find helpful: a Travelers video that explains some of the Cyber exposures
along with a PDF resource that has some real-life examples of claims .