View source for Definition:Email fraud (insurance)

📧 '''Email fraud (insurance)''' refers to schemes in which bad actors use deceptive electronic communications — most commonly [[Definition:Phishing | phishing]], [[Definition:Business email compromise (BEC) | business email compromise]], and spoofed sender identities — to manipulate individuals or organizations into transferring funds, divulging sensitive data, or authorizing fraudulent transactions, all viewed through the lens of how insurers underwrite, detect, and indemnify such losses. Within the insurance sector, email fraud sits at the intersection of [[Definition:Cyber insurance | cyber insurance]], [[Definition:Crime insurance | crime insurance]], and [[Definition:Social engineering fraud coverage | social engineering fraud coverage]], and its classification matters enormously because the applicable policy form determines whether a claim is covered, excluded, or subject to a sub-limit.

⚙️ Coverage for email-fraud losses is rarely housed under a single policy type. A traditional [[Definition:Commercial crime insurance | commercial crime policy]] may cover theft resulting from computer fraud, yet many insurers have successfully argued that voluntary transfers induced by a deceptive email do not constitute "direct" computer fraud — a distinction litigated repeatedly in U.S. courts and addressed differently under policy wordings in the London and European markets. To close this gap, underwriters introduced explicit [[Definition:Social engineering fraud coverage | social engineering endorsements]] and standalone [[Definition:Cyber insurance | cyber policies]] with funds-transfer-fraud modules. During the [[Definition:Underwriting | underwriting]] process, carriers typically evaluate an applicant's email-authentication protocols — such as DMARC, SPF, and DKIM — employee training programs, dual-authorization procedures for payments, and [[Definition:Incident response plan | incident response]] readiness. [[Definition:Premium | Premiums]] and [[Definition:Retention | retentions]] are calibrated to the maturity of these controls, and some insurers mandate baseline security standards before binding coverage.

🔑 The rapid escalation of email-fraud losses — often running into millions of dollars per incident — has reshaped how carriers think about [[Definition:Aggregation risk | aggregation risk]] and policy language precision. Ambiguous wording can leave both policyholders and insurers exposed: policyholders may discover a gap only after a loss, while insurers face adverse court rulings that stretch coverage beyond original intent. Regulators in markets such as the United States, the United Kingdom, and Singapore have encouraged clearer disclosure of what is and is not covered, pushing the industry toward more transparent [[Definition:Policy wording | policy wordings]]. For [[Definition:Insurance broker | brokers]] advising clients, understanding the interplay between crime, cyber, and professional-liability towers is essential to constructing a program that leaves no unintended gap when an employee wires funds to a fraudster posing as the CEO.

'''Related concepts:'''
{{Div col|colwidth=20em}}
* [[Definition:Business email compromise (BEC)]]
* [[Definition:Cyber insurance]]
* [[Definition:Social engineering fraud coverage]]
* [[Definition:Crime insurance]]
* [[Definition:Phishing]]
* [[Definition:Funds transfer fraud]]
{{Div col end}}