A Fraudulent Payment Instruction: Which Insurance Cover Responds?
Business email compromise requires a close examination of the deception, the payment process and the policy wording. The involvement of email does not settle the coverage question.
Reconstruct the payment, not just the email
A familiar supplier appears to request a change of bank details. An employee follows the instruction and a payment reaches an account controlled by a fraudster. The immediate description may be a cyber incident, but the coverage analysis requires a more precise account of the mechanism and the loss.
The FBI’s Internet Crime Complaint Center describes business email compromise as a fraud targeting transfers of funds, often involving social engineering or intrusion into legitimate email accounts. Its guidance emphasises independent verification of changed payment instructions and prompt contact with the originating bank when fraud is discovered. These are useful operational reference points, not statements of Israeli insurance law.
Identify what actually happened
Distinguish a compromised mailbox from an impersonation using a similar address. Establish who issued the instruction, which account received it, who approved the transfer and what checks were performed. Preserve the original messages, relevant headers, payment records and available access logs before routine deletion or account changes remove them.
The payment chronology matters. Record when the bank instruction became effective, when the deception was discovered and when recall or freezing requests were made. A screenshot can illustrate a message, but the underlying electronic record may provide information that is absent from the screenshot. Technical specialists should guide collection where integrity or completeness is in question.
Read the relevant grants of cover separately
Cyber, crime and other specialist policies may address different parts of an incident. Identify each potentially relevant insuring clause and endorsement, then examine its defined terms, exclusions, limits, sublimits and conditions. Do not assume that a product name establishes cover for the amount transferred.
A social engineering extension may frame the insured event differently from a computer fraud or funds transfer provision. The review should therefore ask how the instruction was generated, what role the employee’s approval played and how the claimed loss connects to the specified trigger. These are questions for the actual wording and applicable law; they cannot be resolved by a universal rule about authorised payments.
Separate the different financial consequences
The transferred funds, forensic investigation costs, system restoration expenditure and a third-party demand should be recorded separately. They may raise different coverage and causation questions. If a supplier remains unpaid, its contractual demand also needs independent analysis rather than automatic inclusion in the amount lost to the fraudster.
As a hypothetical example, an intrusion into one company’s mailbox may lead another company to make a payment. The policyholder, owner of the funds and operator of the compromised system may be different entities. A clear party-and-payment map prevents the analysis from attributing every consequence to the same insured interest.
Coordinate response and assessment
The operational response should address containment, possible recovery and notification to the relevant insurer or insurers. Check requirements concerning response providers and consent while dealing promptly with urgent protective steps. Keep a record of decisions, expenditure and communications so that later assessments can distinguish emergency action from subsequent investigation.
For counsel, the most useful early product is a concise chronology accompanied by the relevant wording and a structured list of unresolved questions. It allows technical evidence and coverage advice to develop together, and helps prevent a familiar label such as cyber fraud from replacing the analysis the claim requires.