When Your Cyber Insurer Sends You In Circles: A Hacked CFO Email, A Stolen Vendor Payment, And The Coverage Maze That Can Follow

You bought cyber insurance because you knew a serious cyber theft could threaten the business you have spent years building.

Your company paid premiums year after year, maintained payment controls, and worked to protect its systems and financial information. No CEO expects perfect security or expects every loss to be covered by insurance. But a company that buys coverage for computer fraud, funds-transfer fraud, and social engineering reasonably expects the policy to matter when criminals compromise company communications and divert a seven-figure payment.

Insurance is supposed to be the company’s financial backstop when prevention fails. The company did not buy an insurance policy to debate technical definitions after a loss. It bought the policy to keep a sophisticated theft from becoming an uninsured loss, an unpaid vendor obligation, and another crisis for management.

This is how quickly a routine vendor payment can become a cyber crisis.

The Payment That Never Reached the Vendor

The problem becomes clear when your vendor asks why the company has not paid an invoice that accounts payable said it sent days earlier.

The finance team is surprised. The invoice was legitimate. The company owed the money. The payment appeared routine. The vendor had supposedly changed its bank account according to the email that came from the CFO’s actual email account. A trusted employee appeared in the email chain and confirmed the change. Accounts payable followed the company’s ordinary approval process, updated the payment information, and sent the wire.

The company’s investigation revealed that criminals had taken control of the CFO’s mailbox. They read genuine payment communications, learned how the company approved wires, and waited for a legitimate payment the company was ready to make. They then used the CFO’s real email account to announce the supposed banking change, inserted a nearly identical email address for the trusted employee, and created mailbox rules that moved their messages and the responses into an RSS subscriptions folder, where the real CFO had no reason to look.

The criminals did not invent a debt; they redirected a payment the company actually owed to a criminal-controlled account. The vendor received nothing, and the company may be out the diverted payment while still being responsible for paying the vendor.

What looked like a routine payment was a carefully staged cyber theft.

The Policy Sends You to Three Locked Doors

You turn to the cyber policy expecting it to address a cyberattack that diverted company money. Instead, the insurer points to different provisions and says none applies.

One part of the policy may cover a criminal who gains unauthorized access to the company’s system, changes electronic payment information, and causes company money to go to the wrong account. The policy may call the first protection Computer Fraud or Funds Transfer Fraud coverage. Another provision—often called Social Engineering coverage—may address losses caused when an employee transfers money in reliance upon an instruction received by email purporting to be from an employee or other natural person under a contract with the company.

The insurer says the company cannot recover under either provision. It says the loss is not Computer Fraud or Funds Transfer Fraud because accounts payable sent the wire after receiving fraudulent emails. That, the insurer says, makes the event social engineering. It then says Social Engineering coverage does not apply because the loss involved a computer crime or cyber incident and money was transferred. Finally, the insurer invokes an exclusion because employees acted on an instruction to pay money that proved to be fraudulent.

The insurer has built a three-door coverage maze. Computer Fraud? No—too much like social engineering. Social Engineering? No—too much like computer fraud. Either way, the insurer says, employee reliance on a fraudulent instruction locks the last door.

Policies differ, but the recurring coverage dispute remains the same: the insurer assigns conflicting labels to one integrated cyberattack until no coverage remains. No reasonable business owner would understand a policy sold to address computer fraud, funds-transfer fraud, and social engineering to provide no path to recovery when criminals take over the CFO’s real mailbox and redirect an intended payment.

The Hack Changed the Payment Process

The insurer’s analysis misses the central fact: criminals did not merely send a spoofed email. They took control of the company’s payment communications.

This was not a simple impersonation email from an outside address. The criminals commandeered the CFO’s genuine mailbox, used the company’s own payment communications to make the false banking change appear credible, concealed warning signs, and substituted a criminal-controlled account for the vendor’s account.

Where the policy covers unauthorized system access and manipulation of electronic payment information, the carrier must explain why the presence of social-engineering features eliminates that coverage. The company did not lose money because an employee chose to pay criminals. It lost money because criminals compromised the CFO’s mailbox and changed the electronic information used to direct an intended payment.

The Payment Clerk Did Not Create the Theft

The payment clerk’s final “click” to send the payment did not create the theft. It completed a payment process that criminals had already infiltrated and manipulated.

Businesses pay invoices through employees and financial institutions. An employee opens the email, reviews the invoice, updates payment information, obtains approvals, and directs the bank to send the wire. That is how ordinary businesses operate. A policy should not silently require an employee-free payment process after a loss unless the policy clearly states that is what the company purchased.

The relevant question is not whether an employee physically sent the wire. The question is whether criminals’ unauthorized access to the CFO’s mailbox and fraudulent alteration of payment information caused the company to send money to the wrong account.

Courts have rejected the idea that a fraud becomes “authorized” merely because an employee unknowingly carries it out. In Ernst and Haas Management Company, Inc. v. Hiscox, Inc., an accounts-payable clerk wired money after receiving emails that appeared to come from her superior. The insurer argued that the employee’s action meant the loss did not result directly from fraud. The Ninth Circuit rejected that circular reasoning: “That reasoning—that this fraud became ‘authorized’ precisely when it succeeded—cannot be the correct reading of the contract.” 23 F.4th 1195, 1201 (9th Cir. 2022).

The Sixth Circuit reached a similar conclusion in American Tooling Center, Inc. v. Travelers Casualty & Surety Company of America. A Michigan manufacturer followed its ordinary multi-step process and wired more than $800,000 to an impersonator after receiving fraudulent vendor emails changing bank information. The court held that the internal steps did not sever the connection between the fraud and the loss; the company lost its money when the transfer went to the impersonator. 895 F.3d 455, 462-63 (6th Cir. 2018).

Those cases do not decide every business email compromise claim, and the policy language and governing law still control. But they illustrate the central point here: the payment clerk’s good-faith action does not erase the fraud that caused the payment to go to the wrong account.

The Policy Must Give the Company a Real Path to Coverage

A company that pays a legitimate invoice to a criminal account has not necessarily made a fraudulent payment. The company owed the vendor, the invoice was real, and the payment was authorized. The fraud lay in the account number, routing number, beneficiary, payee, or other electronic information that criminals substituted after taking over the company’s payment communications.

The insurer may call the altered banking information a fraudulent instruction. But that label does not answer whether the fraudulent-instruction exclusion clearly overrides coverage for a criminal’s unauthorized access to the company’s email account and manipulation of the data used to direct a legitimate payment.

Social engineering may be one feature of the attack because criminals deceived employees. It does not erase the separate computer compromise, use of the CFO’s genuine mailbox, manipulation of payment data, and resulting funds transfer. If the policy provides coverage for those acts, the insurer should identify language that clearly removes it when the fraud also includes deception.

A Focused Coverage Review: Six Questions

After a business-email-compromise loss, the most useful coverage analysis starts with the attack record and the particular policy—not with the insurer’s first label for the event. The following questions can help focus the review:

1. Did the attacker obtain unauthorized access to an insured system, mailbox, endpoint, cloud environment, or account?
2. Did the attacker alter, substitute, or manipulate the electronic payment information used to send the funds?
3. Under the policy’s actual wording, what was the direct or immediate cause of the transfer and the resulting loss?
4. What do the Computer Fraud, Funds Transfer Fraud, Social Engineering, and any other potentially responsive insuring agreements cover?
5. Does a social-engineering endorsement, fraudulent-instruction exclusion, voluntary-parting exclusion, or cyber-incident carveout clearly reach this integrated attack?
6. Are there separate cyber, crime, fidelity, vendor-recovery, bank-recall, or other insurance avenues that require prompt notice?

Preserve the Evidence That Tells the Full Story

The company’s recovery may depend on whether it preserves the evidence that shows the full cyberattack rather than only the final wire transfer.

The company should preserve records that establish four points: the criminals entered a real company account; they manipulated electronic information; the company intended to pay a legitimate obligation; and employees acted within a normal process the criminals exploited.

First, preserve evidence that criminals compromised a real company account. The relevant records may include login history, mailbox-audit logs, multifactor-authentication records, IP-address information, access alerts, and forensic findings identifying the compromised CFO or executive mailbox.

Second, preserve evidence that criminals manipulated Electronic Data inside the payment process. That includes mailbox rules, forwarding and deletion rules, the complete email chain, full message headers and metadata, look-alike email addresses, original and substituted bank instructions, and altered email threads.

Third, preserve evidence that the company intended to make a legitimate payment. The invoice, contract, purchase order, prior vendor communications, historical banking information, and payment history can show that the company did not choose to send money to a stranger. It attempted to pay a real vendor obligation.

Fourth, preserve evidence showing how the company ordinarily approved payments. The payment-approval workflow, written verification procedures, internal communications, and records of safeguards used or defeated may help explain that the employee acted within a normal process that criminals had manipulated.

The company should also preserve the complete cyber and crime policies, endorsements, applications, security attestations, broker communications, insurer correspondence, wire-transfer records, bank communications, forensic reports, and recovery efforts.

What to Do Next

The practical plan is straightforward:

1. Preserve the forensic, payment, approval, and policy records before mailbox or cloud-retention settings eliminate them.
2. Give timely notice under every potentially responsive cyber and crime policy and comply with any consent, proof-of-loss, or cooperation requirements.
3. Pursue immediate bank-recall and law enforcement options while documenting every recovery effort.
4. Before responding to a reservation-of-rights or denial letter, consider a focused coverage review comparing the attack record, payment process, policy language, endorsements, exclusions, and the insurer’s rationale.

The Insurer’s First Answer Is Not the Last Answer

Whether the loss is covered depends on the policy, the forensic record, the legitimate payment obligation, and the actual payment process. But the company does not have to accept the insurer’s first label—or its first denial—as the final answer.

A focused coverage review can help the company turn a confusing coverage maze into a clear claim position: what the criminals did, which policy provisions may respond, what evidence supports coverage, and why the insurer’s exclusions may not end the analysis. That clarity allows management to decide whether the insurer is honoring the protection the company purchased and what steps to take next.

If your company receives a reservation-of-rights or denial letter after a business email compromise loss, consider involving policyholder coverage counsel before responding. Counsel can help management and the general counsel’s office evaluate the policy, the attack record, the payment process, and the insurer’s stated rationale before the company decides how to proceed.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.