What Insurance Covers Phishing Losses?

Phishing describes a method of deception, not one single insurance loss. If a message leads to a data breach, cyber insurance may help with covered forensic work, notification, data recovery, interruption, or third-party claims. The Federal Trade Commission describes these as possible first-party and third-party cyber coverage categories. If a phishing message tricks staff into sending funds or exposes credentials used to transfer money, a separate crime grant or endorsement may be needed.

Coverage can turn on what happened after the message arrived: whether someone accessed a system without authorization, whether the business voluntarily sent money, whether the fraudster used a covered transfer method, and whether required security or verification controls were followed. AIG’s specimen cyber policy treats certain security failures as covered events but excludes specified theft or transfers of money under its security and privacy liability section. Those specimen terms show why cyber response and reimbursement for funds are separate questions.

Compare the policy’s definition of a security incident, social-engineering and funds-transfer wording, waiting period for interruption, approved response vendors, and notice requirements. Check any sublimit and ask the insurer to address credential compromise and fraudulent payment scenarios separately.