It’s Tuesday morning at a 12-person office in Moore. Your bookkeeper opens an email that looks like it came from your regular supplier: new bank details, please update before Friday’s payment. She updates them. Friday, $38,000 goes out the door to an account in another state. Or maybe the email was a fake login page, and by noon your files are locked with a ransom note on the screen. Either way, the next hour matters more than the click. And whether insurance helps usually depends on whether the business carries cyber liability coverage, and which parts of it.
What should we do in the first hour?
Speed limits the damage. A short list to keep by the front desk:
- Disconnect the affected computer from the network and Wi-Fi. Don’t wipe it or turn it off; it may hold evidence.
- Reset passwords for the email account and anything that shares that password, and turn on two-factor sign-in if it isn’t already.
- If money moved, call your bank right away and ask for a recall of the wire. The FBI’s Internet Crime Complaint Center also takes reports at ic3.gov.
- Call your insurer or agent before hiring outside help. Many cyber policies have a breach hotline and preferred vendors, and some only pay fully for vendors they approve.
- Write down what happened while it’s fresh: times, emails, who clicked what.
How common is this, really?
Very. In the FBI’s 2024 Internet Crime Report, phishing and spoofing was the most reported crime type, with 193,407 complaints. Business email compromise, the fake-invoice and spoofed-boss scheme, accounted for about $2.77 billion in reported losses from 21,442 complaints. Total reported losses passed $16 billion, up 33% from the year before. Small businesses are a regular target because they often have fewer controls between an email and a payment. Our archive piece on cyber risks for small businesses in Oklahoma covers the common schemes.
What does cyber liability insurance typically pay for?
Policies vary a lot, but most are built in two parts.
First-party coverage pays your own business’s costs, such as:
- Forensic experts to find out what happened and what was taken
- Restoring data and systems
- Lost income while systems are down
- Notifying customers whose information was exposed, and credit monitoring for them
- Ransomware response, in many forms
Third-party coverage responds when others make claims against you, such as customers whose data was exposed, or regulators.
Is a wire sent to a scammer covered?
Not always, and this is where people get caught. A payment your own employee sent, after being tricked, is often handled by a specific coverage called social engineering or funds transfer fraud. Some cyber policies include it, some offer it as an add-on, and many cap it at a lower limit than the rest of the policy. Some crime policies can respond too. A general liability policy is usually not built for this kind of loss at all.
Here’s an illustration, not a quote
Say a fake invoice leads to a $38,000 wire. If the business has a cyber policy with a $1 million overall limit but a $25,000 social engineering sublimit and a $2,500 retention, the most that coverage would pay is $25,000. The other $13,000 stays with the business unless the bank recovers some of it. The overall limit doesn’t help if the loss falls under the smaller sublimit.
What controls make the biggest difference?
Insurers often ask about these on an application, and they also prevent losses:
- Two-factor sign-in on email and banking
- A callback rule: any change to payment details is confirmed by phone, using a number already on file, never one from the email
- Regular backups kept separate from the main network
- Short, regular phishing training for everyone who handles email
Let’s look at what a click would cost your business
If you don’t carry cyber coverage, or you aren’t sure whether yours includes social engineering, take a look at our cyber liability insurance options or start a commercial quote. You can also call (405) 701-5368, and we’ll walk through the limits and sublimits with you.
This article is general information about how coverage typically works, not advice about your specific situation. No two insurance contracts are the same, and your policy is the only thing that says what you have. If you’d like someone to read it with you, that’s what we’re here for.
