PlumBot: Bot: Creating new article from JSON

2026-03-10T12:49:01Z

Bot: Creating new article from JSON

New page

📧 '''Business email compromise''' is a form of targeted [[Definition:Cyber risk | cyber fraud]] in which an attacker impersonates a trusted party — typically a senior executive, vendor, or business partner — through manipulated or spoofed email to trick an insurance organization or its [[Definition:Policyholder | policyholders]] into transferring funds or divulging sensitive information. Within the insurance sector, this threat operates on two levels: carriers must defend their own operations against it, and they also [[Definition:Underwriting | underwrite]] the financial consequences of business email compromise through [[Definition:Cyber insurance | cyber insurance]] and [[Definition:Crime insurance | crime insurance]] products.

🕵️ The attack typically unfolds when a fraudster gains access to or convincingly mimics a legitimate email account, then sends instructions that appear routine — a request to redirect a [[Definition:Premium | premium]] payment to a new bank account, a fake invoice from a [[Definition:Third-party administrator (TPA) | third-party vendor]], or an instruction to wire [[Definition:Claim | claim]] settlement funds to a changed address. Because these messages exploit human trust rather than technical vulnerabilities, even organizations with strong network defenses remain susceptible. Insurers writing [[Definition:Cyber insurance | cyber]] or [[Definition:Crime insurance | crime]] policies evaluate controls such as multi-factor authentication, dual-authorization payment procedures, and employee awareness training when assessing a prospective insured's exposure to business email compromise.

💰 The financial impact can be substantial — the FBI's Internet Crime Complaint Center regularly ranks business email compromise among the costliest categories of cybercrime, with losses running into billions of dollars annually across all industries. For insurers, the [[Definition:Claim | claims]] implications are complex: coverage may sit across [[Definition:Cyber insurance | cyber]], [[Definition:Crime insurance | crime]], and [[Definition:Directors and officers liability insurance (D&O) | directors and officers]] policies, and disputes often arise over which policy responds and whether social-engineering losses fall within policy definitions. As attack volumes continue to climb, carriers are tightening [[Definition:Underwriting | underwriting]] guidelines, requiring minimum security controls, and adjusting [[Definition:Sublimit | sublimits]] specifically for social-engineering fraud, making business email compromise a defining risk in the evolving [[Definition:Cyber insurance | cyber insurance]] marketplace.

'''Related concepts'''
{{Div col|colwidth=20em}}
* [[Definition:Cyber insurance]]
* [[Definition:Cyber risk]]
* [[Definition:Crime insurance]]
* [[Definition:Social engineering fraud]]
* [[Definition:Ransomware]]
* [[Definition:First-party coverage]]
{{Div col end}}

Definition:Business email compromise - Revision history

PlumBot: Bot: Creating new article from JSON