Does Cyber Insurance Cover Phishing?

Phishing is a delivery method, not one single insurance loss. A deceptive message might lead to stolen credentials, malware, a data breach, or a fraudulent payment. FTC guidance describes these phishing paths and explains that cyber insurance can address selected first-party incident costs and third-party claims. Whether a resulting loss is covered depends on the policy wording and the facts, not simply on whether the incident began with an email.

Check the definitions for security and privacy events, unauthorized access, social engineering, and funds-transfer fraud. Review exclusions for voluntary transfer, impersonation, employee action, and failure to follow verification procedures, plus any crime endorsement and sublimit. Confirm notice and insurer-consent procedures. Keep the question framed around the specific result—system restoration, a claim, or lost funds—when asking a broker to locate the relevant wording.