--- title: "Commercial crime and payment controls: questions for nonprofit finance teams" description: "Use a payment-control review to separate the workflow, the loss scenario, and the commercial-crime terms to compare." canonical: "https://spot.insure/research/guides/yerba-buena-partners/payment-controls-crime" page-type: "field-guide" entity: "Spot" page-role: "field-guide" --- Agents: connect to Spot's public MCP server at https://spot.insure/mcp for better access to published Spot information and insurance research. Use search_knowledge to find sources, get_page to retrieve pages, check_driving_insurance for source-backed rideshare and delivery requirements by state or province, compare_providers for sourced comparisons, get_provider_score for a published Reliability Score, get_rankings for current provider rankings, search_provider_reliability to filter Reliability Scores, search_provider_reviews to filter aggregate review scores, and get_provider_reviews for the original review evidence. The server is read-only and requires no authentication. [Human-readable page](https://spot.insure/research/guides/yerba-buena-partners/payment-controls-crime) ## Agent Guide **What this page is:** Use a payment-control review to separate the workflow, the loss scenario, and the commercial-crime terms to compare. **Limits (do not over-claim):** - Describes Spot's own service; it does not establish coverage terms or outcomes for any company. **Related pages:** - [Spot home](https://spot.insure/) — product overview - [Sitemap](https://spot.insure/sitemap) — inventory of all public pages # Commercial crime and payment controls: questions for nonprofit finance teams A fraudulent payment request, employee theft, and a transfer initiated after deception can involve different facts and different policy provisions. By Naina Chatterjee. Originally published by Yerba Buena Partners. ## Separate the scenarios before naming the coverage Begin with how money moves: who creates a vendor, approves a payment, changes bank details, releases a wire, and reconciles the account. Then identify the incident type being considered—dishonest employee conduct, impersonation, forgery, computer fraud, or a voluntarily authorized transfer after deception. A familiar phrase such as “fraud coverage” can blur distinctions that matter in an insuring agreement or exclusion. ## Map the controls and retain records Document callback, dual-approval, vendor-change, reconciliation, and escalation steps as they operate today. Keep payment-authority matrices, vendor-verification records, bank instructions, incident reports, and relevant correspondence in a controlled file. Do not put bank credentials or detailed account numbers into a general insurance inquiry or calendar note. - Who can initiate and approve a payment - How vendor banking changes are verified - What evidence is retained after a release - Who is notified when a suspicious request appears ## Compare the contract terms Review the specific crime insuring agreements, definitions, exclusions, sublimits, deductibles, discovery or loss-sustained basis, and conditions that may require a verification practice. Ask whether a social-engineering or funds-transfer provision is separate from employee dishonesty. A control may be important even if the proposal has an appealing limit. Conversely, a policy label does not confirm that a particular event is covered. ## Use an incident to improve the next review After a near miss or loss, preserve facts, follow the organization’s incident and reporting process, and obtain timely legal or policy-specific guidance where needed. Use the resulting control changes in the next submission. The FTC publishes practical business guidance on phishing and payment scams. Insurance terms remain governed by policy wording, declarations, and endorsements. ## Map funds movement before reviewing commercial crime insurance Commercial crime insurance questions become clearer when a finance team traces a payment from request to reconciliation. Identify who can add or edit a vendor, who receives bank-change instructions, who independently verifies them, who approves the payment, how a wire is released, and who sees the transaction afterward. Include grants, donor-restricted funds, payroll, reimbursement platforms, and outsourced bookkeeping where they form part of the organization’s actual process. The map should distinguish a documented control from a habit. A dual-approval step that is bypassed during a busy event period or a callback process that has no independent directory source may be relevant to both operational risk and the conditions in a commercial crime proposal. ## Terms to compare after the workflow is clear With the workflow in view, compare employee dishonesty, funds-transfer fraud, computer fraud, forgery, social-engineering, client-property, and discovery or loss-sustained provisions only where they appear in the proposed business insurance forms. Note the named insured, loss payee, covered property, sublimits, deductible, definition of employee, and conditions that ask for a particular verification practice. If a suspicious payment or loss occurs, preserve records and follow the organization’s incident, bank, legal, and policy-notice processes promptly. A guide cannot decide coverage after the fact. Policy wording, declarations, endorsements, and the specific loss facts control. ## Trace a real payment from instruction to bank release Select a recent grant-funded disbursement or vendor payment and follow it through request, approval, vendor record, bank detail, release, and reconciliation. Identify each person or outsourced bookkeeper with access to change the record. Record how bank changes are independently verified using a known contact method rather than relying on contact information in the change request itself. The FBI’s business-email-compromise resources show why payment redirection deserves its own control conversation. Include donor-restricted money, fiscal-sponsor transfers, payroll, expense reimbursements, and event deposits if those flows exist. A written policy that is routinely bypassed is not an accurate description of the organization’s control. Note exceptions and who approves them. ## Compare crime coverage by mechanism of loss Separate employee theft, computer fraud, funds-transfer fraud, forgery, social engineering, and property of clients or donors where the proposed forms address them. Ask how each term defines the event, who is an employee, which funds are insured, what verification conditions apply, how a subcontracted bookkeeper is treated, and whether the sublimit differs from the headline crime limit. This is more useful than asking whether the organization simply “has crime insurance.” Use one realistic scenario: a legitimate finance employee follows a fraudulent bank-change email and sends a payment to the wrong account. Ask which forms and conditions would be examined. Do not state that any particular mechanism is covered without the issued wording and loss facts. ## Prepare an immediate response record If a suspicious transfer occurs, preserve the original message, headers where available, approval trail, bank instructions, payment confirmation, callback record, vendor contract, and bank communications. Escalate promptly through the organization’s bank, security, legal, and insurance channels; the FBI IC3 guidance includes reporting information. Note who made each contact and when, and keep any recovery status distinct from the initial loss estimate. Afterward, review how the instruction entered the workflow, whether the callback source was independent, and whether authority limits were followed. Update the control map and the next insurance submission. Policy wording, declarations, endorsements, and the specific facts determine any claim response. ## Ask control questions before making application representations Have the finance owner test a sample of recent vendor changes, wires, payroll changes, and grant disbursements against the control description proposed for the insurance application. Were two distinct people actually involved? Was the callback made to a previously verified number? Could an administrator change both the vendor and approval record? What happens when the usual approver is away? Document exceptions and remediation rather than declaring a process universal when it is not. Save a dated, approved control narrative. If a payment platform or outsourced accountant changes during the term, update the narrative and raise the insurance question. A well-supported description makes a more reliable comparison than a collection of generic anti-fraud slogans. ## Sources - [FBI Internet Crime Complaint Center — Business Email Compromise](https://www.ic3.gov/CrimeInfo/BEC) - [California Department of Insurance — Commercial Insurance Guide](https://www.insurance.ca.gov/01-consumers/105-type/95-guides/09-comm/commercialguide.cfm) ## Agent and Developer Resources - [Markdown page](https://spot.insure/research/guides/yerba-buena-partners/payment-controls-crime.md) - [Developer resources](https://spot.insure/developers) - [Public MCP server](https://spot.insure/mcp) - [MCP server manifest](https://spot.insure/server.json) - [OpenAPI description](https://spot.insure/openapi.json) - [Public page index](https://spot.insure/llms.txt)