Deepfake Wire Fraud: What Your Social Engineering Coverage Actually Pays

The scam used to be a clumsy email from a "CEO" asking for gift cards. Now it's a phone call in your boss's actual voice, or a video call with a face that looks exactly right, directing an urgent wire transfer. AI deepfakes have made business wire fraud far more convincing — and far more expensive.

The good news is that insurance can respond. The catch is that whether it pays, and how much, comes down to fine print most business owners have never read: a sublimit, a retention, and a condition about how you verified the request. This guide walks through what social engineering coverage actually pays, and what to check before you need it.

For the full picture of how AI touches your policies, see does your business insurance cover AI. This post is the deep dive on deepfake fraud.

How the Scam Works Now

Deepfake fraud follows a simple pattern with a powerful new twist. An attacker impersonates someone you trust — a CEO, a vendor, a title company — and sends payment instructions that look and sound legitimate. What's changed is the realism. AI can now clone a voice from a few seconds of audio and generate a live video likeness, so the "confirmation call" that used to reassure your team now helps the scam succeed.

The target is almost always the same: a wire transfer or a change to a vendor's payment details. By the time anyone notices, the money is gone and hard to recover.

The Coverage That Responds — and Its Fine Print

The coverage built for this is usually called social engineering or fraudulent instruction coverage, and it typically lives inside a cyber or crime policy. It responds when your business is tricked into voluntarily sending money based on a fraudulent instruction. That's the key distinction: the money went out because someone was deceived, not because a system was hacked.

Here's where owners get surprised. This coverage is often sublimited — capped well below your policy's main limit. A cyber policy with a large overall limit might cap social engineering losses at a far smaller figure, sometimes in the range of a few hundred thousand dollars, with a meaningful retention (deductible) you pay first. The best news in 2026 is that some carriers now name deepfakes and AI-generated instructions explicitly, which removes any argument about whether the scam "counts."

The Conditions That Can Void It

A sublimit tells you the most you can collect. A condition can take you to zero. The one to watch:

• Callback / out-of-band verification. Many social engineering endorsements only pay if you verified the request through a second, independent channel before sending — calling a known number on file, not the number in the email. Skip that step, and the carrier can deny the claim even though the coverage technically exists.
• Dual authorization. Some policies require a second person to approve transfers over a set amount.

These aren't fine-print traps so much as the behavior the coverage is designed to reward. The verification call that satisfies your policy is also the single most effective way to stop the fraud in the first place.

What to Check

• 1. Find your social engineering sublimit. Ask what the cap is, separate from your main limit. It's often much smaller than owners expect.
• 2. Confirm the retention. Know what you pay before coverage kicks in.
• 3. Ask whether a callback condition applies. If it does, build that verification step into your payment process now, in writing, so a claim isn't denied on a technicality.
• 4. Check whether deepfakes and AI instructions are named. Explicit language is stronger than silence.
• 5. Know social engineering vs computer fraud. They're different coverages. Social engineering covers deception; computer fraud covers a hacker moving money directly. You want both.

A short review sorts all of this out before it matters. We'll read your coverage and your process together. Start a review here.

Frequently Asked Questions

Does insurance cover deepfake wire fraud?

Often yes, through social engineering or fraudulent instruction coverage inside a cyber or crime policy. But it's usually sublimited — capped below your main limit — and may carry conditions, like verifying the request through a second channel before sending. Some carriers now name deepfakes and AI-generated instructions explicitly, which strengthens the coverage.

What is a social engineering sublimit?

It's a separate, lower cap that applies specifically to losses from being deceived into sending money. Your policy might have a large overall limit while capping social engineering claims at a much smaller amount, with a retention you pay first. Knowing that number is essential, because it's the real ceiling on this kind of loss.

Why would a wire-fraud claim get denied?

The most common reason is a missed verification step. Many social engineering endorsements only pay if you confirmed the payment instruction through a separate, known channel before sending. If that callback didn't happen, the carrier can deny the claim even when the coverage exists. Building verification into your payment process protects both your money and your claim.

What's the difference between social engineering and computer fraud coverage?

Social engineering covers losses where your team was tricked into voluntarily sending money. Computer fraud covers losses where a hacker moved money directly through your systems. They're separate coverages with separate limits, and a complete program includes both.

Related Reading

• Does Your Business Insurance Cover AI? — which policy responds to which AI risk
• Your Employees Are Using AI. Does Your Cyber Policy Cover It? — the broader cyber and shadow-AI exposure
• Cyber Liability Coverage — where social engineering coverage usually lives