Employee Theft, Payment Fraud, and Cyber Insurance: A California Business Checklist

Four distinct money-loss questions

When a business loses money, the coverage question depends on how the loss happened. An employee who steals, a transfer sent without authority, an employee who authorizes a payment after being tricked, and the cost of responding to a privacy or network-security event are different losses, and a different form may respond to each. This guide separates the four so you can read your policy and ask the right questions — it does not promise that any particular loss is covered. Whether coverage applies depends on the policy wording, the insuring agreements, exclusions, limits, and underwriting. The crime or cyber label alone does not guarantee that a loss is covered; the actual form controls.

Employee theft and dishonesty

Employee dishonesty — an employee stealing money, securities, or property — is the core of a crime or fidelity form. Crime coverage specifically addresses dishonest acts by employees, so do not assume that an 'intentional acts' exclusion in another policy means there is no coverage for employee theft anywhere in your program; that is a separate question for the crime form. Ask how the policy defines 'employee' and 'dishonest act,' what property and money are covered, and what limits and deductibles apply. Some forms cover employee theft only up to a sublimit, and aggregation — whether multiple acts count as one occurrence or several — can change what is available.

A transfer without authority vs. a payment authorized under false pretenses

Two fraud scenarios look similar but raise different wording questions. A transfer sent without authority — someone impersonates your business to move funds — is a question of whether a computer-fraud or funds-transfer insuring agreement responds. A payment your employee honestly authorized after being deceived — a fake invoice, a changed vendor bank detail, a request that looked like it came from an executive — is a social-engineering question, and voluntary transfers may be excluded, subject to a separate endorsement, or limited by a sublimit, depending on the actual form. Ask how each form treats voluntary transfer under deception, whether a social-engineering endorsement is included or available, and what verification requirements the form imposes. The distinction turns on the actual policy wording, not on a label. The actual definitions and exclusions control.

Computer use alone does not establish computer fraud

A loss that involved a computer is not automatically a 'computer fraud' loss. Does the agreement require fraudulent entry into or use of a computer system, and how does it treat an employee-authorized transfer? Ask what your form requires to trigger computer-fraud coverage and how it treats social-engineering and voluntary-transfer losses. Do not assume that because a computer was involved, computer fraud coverage applies.

Incident-response costs and stolen funds are separate

The cost of responding to a privacy or network-security event — forensic investigation, notification, credit monitoring, and legal defense — is a separate question from whether stolen funds are reimbursed. A cyber form may include first-party response and third-party liability and, in some cases, a fraud endorsement, but fraud coverage is not always included in a standard cyber form and is not always excluded; it depends on the form and any endorsements. Ask whether your cyber form includes any fraud or social-engineering coverage, at what sublimits, and how it coordinates with a crime form. For a broader checklist on professional liability, technology E&O, and cyber response, see our related guide.

Professional liability, Tech E&O, and cyber: a California business checklist →

Who counts as an employee or authorized person?

Crime and cyber forms define who is an 'employee' or 'authorized person,' and the definition can include or exclude owners, partners, officers, temporary staff, contractors, and volunteers depending on the form. A loss caused by an owner may be excluded under one form and covered under another; a contractor's act may fall outside the employee definition entirely. Ask how each form defines the people whose acts are covered and excluded, and match the definition to your actual workforce — owners, contractors, seasonal staff, and volunteers may be treated differently.

Money and property you own vs. property you hold for others

Ask whether the form covers money and property you own, money and property you hold for others (such as client funds in transit or escrow), or both. A loss of client funds held in your care may raise a different insuring agreement and different limits than a loss of your own money. Confirm what the form covers and at what limits for each category.

A practical review worksheet

Before you talk to your insurer, list how money moves through your business and what each form covers. A clear worksheet makes the conversation faster and the gaps easier to see. If you are comparing proposals after a quote, see our guide to comparing California business insurance quotes beyond price.

• Named insured and ownership — does the named insured match the entity, and who owns or holds the money and property at risk?
• Employee and authorized-person definitions — how does each form define the people whose acts are covered or excluded, including owners, contractors, and volunteers?
• Each insuring agreement — which agreements respond to employee theft, computer fraud, funds-transfer fraud, and social-engineering losses, and at what limits?
• Social-engineering endorsements and sublimits — is voluntary transfer under deception covered, excluded, or sublimited, and what verification does the form require?
• Retentions and aggregation — what deductible or retention applies, and do multiple acts aggregate as one occurrence or several?
• Verification controls — what controls does the form expect you to have in place (written and accurately described), without inventing compliance you do not have?
• Reporting, discovery, and prior-loss conditions — what does the form require for notice of a loss or discovery, and what prior-loss or knowledge conditions apply? Confirm the actual terms rather than assuming a universal deadline.
• Other-insurance coordination — how do the crime and cyber forms coordinate, and which other-insurance or contribution provisions apply? Do not assume duplicate reimbursement of the same loss.

How to compare California business insurance quotes beyond price →

An illustrative vendor bank-detail scenario

Suppose a business receives an email that appears to be from a long-standing vendor, asking the business to send the next payment to a new bank account. An employee, believing the request is genuine, authorizes and sends the payment, which is later found to have gone to a fraudster. Several questions arise, and a different form may respond to each — this example does not promise that any loss is covered. Questions: Does the loss fall under a computer-fraud insuring agreement, or does the employee's voluntary authorization move it to a social-engineering question that may be excluded or sublimited? Is a social-engineering endorsement attached, and what verification does it require? If the fraudster also accessed the business's systems, does a cyber form's response coverage apply, and is fraud coverage included or excluded under that form? Does the crime form's employee definition cover the people involved, and what retention and aggregation apply? Each question turns on the actual policy terms, exclusions, sublimits, and limits.

Prevention and verification are operational, not a coverage guarantee

Strong verification practices — confirming vendor bank-detail changes through a known, trusted contact rather than the contact details in the request, and using a second approval for large or unusual transfers — can reduce the chance of a loss. These are operational controls, not a guarantee of coverage; a form may still require specific verification procedures before it responds. Ask your insurer what verification the form expects, and describe your actual controls accurately rather than overstating them. If a loss is underway or has already occurred, contact your bank and insurer promptly using trusted channels — do not wait for a quote — and know that this guide is not a complete incident-response plan.

Do not submit sensitive details through a public quote form

Do not send personal bank details, passwords, payment screenshots, or other sensitive records through a public quote form. A quote request needs business-level information — your operations, the kinds of money and property at risk, and your current policies — not the details of a specific fraud. If a loss has occurred, report it to your bank and insurer through a trusted, secure channel and follow their instructions.

Sources reviewed

• Travelers — Fidelity and Crime Insurance
• The Hartford — Cyber Crime Insurance