Social engineering refers to sophisticated cyberattacks that deceive small businesses into disclosing sensitive information or sending money to scammers. While social engineering attacks are sometimes covered by cyber insurance policies, a special endorsement is often required.
Unlike traditional cyberattacks, where hackers exploit technological weaknesses, social engineering scammers exploit human vulnerabilities. By impersonating someone you trust, such as a co-worker, delivery person, or government agency, these manipulative cybercriminals use emails, phone calls, and text messages to trick you into handing over intellectual property or large sums of money.
For many small business owners, these deceptive cyberattacks can cause significant financial damage, legal costs, and bodily injury. Having cyber liability coverage is a vital part of a policyholder’s efforts to thwart cybercrime.
Did a supplier email ask for immediate payment? Is your financial institution calling for your account information? Social engineering scammers use all sorts of platforms to fool you, and their messages are often urgent or threatening, hoping you’ll act quickly without authenticating the source.
You may have heard about some of these social engineering tactics, such as phishing. However, there are many plays in the cyber scammer’s playbook:
Phishing
- A type of fraud using credible-looking emails designed to coerce you into disclosing confidential information or clicking malicious links.
- This could include a fake invoice with a Pay Now link that installs ransomware on your company computer, or cyber threats from an email account impersonating the FBI.
Business email compromise (BEC)
- Emails that impersonate established businesses or individuals requesting funds or sensitive data.
- This could look like emails from a fake law firm accusing you of copyright infringement or defamation.
Vishing (voice phishing)
- Phone calls meant to trick targets into sharing sensitive information.
- You might get robocalls asking for Social Security numbers, or scammers calling for access to your computer to fix a made-up malware issue.
Smishing (SMS phishing)
- Text messages that try to manipulate individuals into clicking on malicious links or giving access to confidential information.
- Scammers might text urgent wire transfer requests or send package delivery notifications with fraudulent instructions on how to reschedule.
Pretexting
- Scammers use a fabricated story (pretext) to gain access to confidential information.
- For example, a fraudulent account on social media impersonating an organization might follow you to establish a connection, giving them easier access to sensitive data.
Although some cyber liability insurance or crime insurance policies include social engineering insurance coverage, most policyholders will need a special insurance endorsement added to their cyber insurance coverage.
This endorsement would protect against financial losses should you or an employee fall victim to funds transfer fraud schemes, cyber extortion, bricking attacks, and other types of phone, text, or computer fraud.
Without this endorsement, a policy may have social engineering coverage exclusions, including attorney fees and financial losses caused by voluntary—albeit manipulated—actions. Before purchasing a cyber liability insurance policy, ask an insurance broker or underwriter whether the policy covers social engineering attacks and what the waiting period is before coverage takes effect.
Do you need first-party or third-party cyber insurance coverage?
Cyber insurance, also known as data breach insurance, is classified into two types of coverage:
- First-party liability: Covers financial losses related to a social engineering attack on your business.
- Third-party liability: Pays legal fees when a client sues your company for failing to prevent (or causing) a data breach or cyberattack on their company.
Small businesses can implement risk management protocols to combat cyberattacks:
- Educate employees about common scams and red flags
- Never click on links or open attachments from strangers
- Be wary of information or account verification requests
- Use a second communication channel to verify all financial transactions
- Implement email filtering tools to flag suspicious messages
- Limit employee access to sensitive data
- Develop a personal device policy to address BYOD security risks
- Use multi-factor authentication (MFA) for company logins
Even when you provide employee training and implement security measures, social engineering attacks can still occur. The more sophisticated these attacks get, the more crucial social engineering insurance coverage will be for your business.
Unsure which cyber insurance product is right for you? We’re here to help. One of our licensed insurance agents would be happy to discuss all your business insurance needs.
If you’re ready to get started, simply fill out Insureon’s easy online application to get quotes from top-rated U.S. insurance companies. Once you find the right policies, you can start coverage and get your certificate of insurance (COI) in less than 24 hours.
What our customers are saying
Get cyber liability insurance quotes
Want free expert advice right in your inbox?
By entering your email address and subscribing, you agree to our Terms of Use and Privacy Policy
Social engineering insurance