Insights & Articles

Ask most business owners about cyber risk, and they’ll describe a hacker breaching a firewall, deploying ransomware, or stealing customer data. That threat is real, but it’s no longer the most common way businesses lose money to fraud. Increasingly, the biggest financial losses come from something much simpler: an employee being convincingly deceived into authorizing a payment that should never have been made.

This is social engineering fraud, and it sits in an uncomfortable gap between traditional crime insurance and cyber insurance, one that many businesses discover only after they’ve already suffered a loss.

What Social Engineering Fraud Actually Looks Like

The scenarios are mundane precisely because they’re designed to be:

• A finance team member receives an email that appears to be from the CEO, urgently requesting a wire transfer to close a “confidential acquisition.”
• A supplier’s invoicing email is intercepted, and a fraudster sends “updated bank details.” The next legitimate-looking invoice is paid straight into the fraudster’s account.
• An HR employee receives a call from someone impersonating a senior executive, requesting payroll changes or employee data urgently, “before I lose signal.”

No malware is involved. No system is breached. The fraud succeeds because a human being, acting in good faith and under time pressure, makes a decision that turns out to be wrong.

According to the Singapore Police Force’s mid-year scam and cybercrime report, business email compromise losses jumped 193.1 percent to S$57.3 million in the first half of 2026, while reported cases rose 67.9 percent to 262. Such scams involve perpetrators using spoofed or compromised email accounts and digital manipulation to impersonate businesses, suppliers, clients, or people within organizations, and divert payments to fraudulent accounts, exactly the pattern behind the scenarios above.

Why This Falls Through the Cracks

Many businesses assume this type of loss is covered by one of two policies they already hold, and are wrong on both counts:

Cyber insurance typically covers losses arising from a breach of your systems: data theft, ransomware, business interruption from an IT outage. If no system was actually hacked, because the fraud relied purely on deception rather than intrusion, many cyber policies won’t respond, or will respond only under a narrow, specifically-purchased extension.

Crime insurance (theft, employee dishonesty) is designed to cover losses from dishonest acts by your own employees or third-party theft of property. Social engineering fraud often involves an honest employee being deceived into authorizing a payment themselves, which many traditional crime policies were not originally designed to address, though most modern crime policies now offer specific social engineering or funds transfer fraud extensions.

The result is a real, painful financial loss that falls between two policies, neither of which was built with this exact scenario in mind, unless the right extensions were specifically purchased.

What to Check in Your Program

1. Do you have a specific social engineering or funds transfer fraud extension, either under your crime policy or as a cyber policy add-on? This is rarely included automatically.
2. What’s the sub-limit? Social engineering coverage is often capped well below the main policy limit, sometimes a fraction of it. Confirm the sub-limit reflects your actual payment authorization exposure.
3. What verification conditions apply? Insurers commonly require evidence of a callback verification process or dual-authorization controls for payment changes as a condition of cover. If your business doesn’t have this process documented and followed, a claim could be declined on a technicality, even with the right policy in place.
4. Does cover extend to fraudulent instructions from vendors or suppliers, not just impersonation of internal executives? Vendor email compromise is now one of the most common variants.

The Real Fix Is Both Insurance and Process

No policy is a substitute for basic controls. The single most effective defense against social engineering fraud remains simple: any request to change payment details or make an unusual payment should be verified by phone, using a previously known number, never a number or contact provided in the suspicious email or message itself.

Insurance should sit behind that control, not instead of it. Insurers increasingly expect to see evidence of these controls before they’ll pay a claim.

The Bottom Line

Social engineering fraud has become one of the most common sources of financial crime loss for businesses in Singapore and the region, and one of the most avoidable with the right controls in place. It doesn’t require a sophisticated hacker; it requires only a convincing story and a moment of urgency. Reviewing your crime and cyber programs together, rather than in isolation, is the only way to close the gap between them.

Speak to our Financial Lines team about reviewing your crime and cyber coverage for social engineering exposure.