Read This Before You Approve Your Next Urgent Payment
Cyber insurance in Canada was built for hacks, but one of the costliest scams today needs no hacking at all. Your controller gets a call from the CEO, who sounds rushed and wants a wire sent to close a deal before the end of the day. The voice is right, the tone is right, and the details match. The money goes out. The real CEO was on a plane the whole time.
The problem is that many businesses assume their cyber or crime policy will pay for this kind of loss. Often it pays only a small amount, or nothing at all, because an employee chose to send the money. The goal here is to help you read your coverage like an underwriter, not like a hopeful policyholder, so you know where the gaps are before a fake voice finds them.
This focuses on payment fraud against businesses, not consumer scams. Policy terms vary by insurer, and the wording in your own policy is what counts. This matters even more heading into year-end, when invoice volumes rise, staff take holidays, and urgent payment requests feel normal.
What Is Deepfake Fraud, and Why Is It Hitting Canadian Businesses?
Deepfake fraud uses AI to copy a real person’s voice, face, or writing style to trick someone into sending money or sharing information. Experts say a couple of minutes of recorded speech, such as a podcast, webinar, or social media clip, can be enough to clone a voice. Common versions include:
- A cloned voice of an owner or executive calling for an urgent wire
- A fake video call with a “supplier” asking to change banking details
- An AI-written email that perfectly matches a vendor’s tone and invoice format
Canadians reported more than $600 million in fraud losses in 2024, and the Canadian Anti-Fraud Centre estimates that only 5 to 10 percent of fraud is ever reported. Insurers usually call this kind of loss social engineering fraud: a criminal persuades an employee to voluntarily send company money.
How Cyber, Crime, and Fidelity Coverage Compare
Payment fraud can sit on more than one policy, which is part of why it confuses buyers. Here is how the common options compare:
- Cyber insurance: Built for data breaches, ransomware, and system attacks. Social engineering cover is usually an optional add-on with a lower sublimit, and it may only apply after any crime policy responds.
- Commercial crime insurance: Covers theft and fraud, including computer fraud and funds transfer fraud. Standard wording often excludes losses where an employee was tricked into sending money, unless a social engineering endorsement is added.
- Social engineering endorsement: Adds cover for a deceived employee sending funds, but often with a modest sublimit and a requirement to verify payment instructions.
- Fidelity bond: Protects against theft by your own employees. It is not designed for outside criminals who trick a trusted employee.
These can work together. Many businesses pair a cyber policy with a crime policy, then add a social engineering limit that matches the size of their typical payments.
Red Flags Hidden in Policy Definitions
The trickiest parts of cyber and crime coverage often sit in the definitions, not the headline limit. Watch for how your policy defines:
- “Voluntary parting”
- “Computer fraud”
- “Funds transfer fraud”
- “Social engineering fraud”
If your crime policy has a voluntary parting exclusion, a loss where an employee chose to send money may not be covered under computer fraud or funds transfer fraud, even if those limits are large. If social engineering is defined narrowly, a fake voice call may fall outside it.
Common conditions that catch businesses off guard are:
- A verification requirement, such as a call-back to a known number before changing payee details
- A sublimit far below the size of a typical wire
- Cover limited to money and securities, not goods shipped to a fraudster
- Rules about which policy pays first when more than one could respond
Timing is another quiet trap. Banks can sometimes recall a wire if they are told within hours, so slow reporting can turn a recoverable loss into a total one.
How Do Social Engineering Claims Work?
The gap between a large policy limit and a small sublimit has already played out in a Canadian court. In a 2020 Quebec Superior Court decision, a company lost about US2.7milliontoavendorimpersonationscam.Itarguedforcoverageunderitscrimepolicy’scomputerfraudandfundstransferfraudsections,whichhadmuchlargerlimits.Thecourtheldthatthelossfellonlyunderthesocialengineeringendorsement,sorecoverywaslimitedtothatendorsement’sUS50,000.
Here is how the numbers can work. The figures are illustrative, and every policy calculates claims a little differently:
- An employee wires $180,000 after a convincing call from a cloned executive voice
- The crime policy excludes voluntary parting, so the main limits do not respond
- The social engineering endorsement has a $10,000 deductible and a $100,000 sublimit
- After the deductible, the covered loss is $170,000, but the sublimit caps the payment at $100,000
- The business absorbs the remaining $80,000
Without the endorsement, the full $180,000 would come out of the business. With it, the loss is cut by more than half, and the gap shows why the sublimit should match the size of your real payments.
Smart Ways to Protect Your Business Before Year-End
Payment fraud is easiest to stop before the money moves, not after. Before the holiday rush, you can:
- Require a call-back to a known number before any new payee or banking change
- Use a code word or second approver for urgent requests from senior leaders
- Remind finance staff that a familiar voice or face is no longer proof of identity
If a suspicious payment has already gone out, your first hour should include:
- Calling your bank to request a recall
- Reporting to police and the Canadian Anti-Fraud Centre
- Notifying your broker and insurer as your policy requires
Good questions for your broker include:
- Which of my policies would respond to a deceived employee sending money?
- Is my social engineering sublimit large enough for my typical payments?
- What verification steps does my policy require before it pays?
You may want to take extra care if you send large wires, work with overseas suppliers, have executives with a public voice or video presence, or rely on a small finance team.
Ai Insurance Organization Inc. works with businesses across Canada and sees how fast a single fake call can turn into a real loss, especially during busy year-end payment cycles. They can help you compare cyber and crime options, check your social engineering limits, and close gaps before they are tested.
Close the Gap Before a Fake Voice Finds It
If you are ready to feel more confident about the payments your team approves, we can help you get started with cyber insurance and crime coverage that fit the way your business pays. At Ai Insurance Organization Inc., we take the time to understand your payment processes, your team, and your risks so one convincing call does not put your business at risk. Reach out to our team with your questions or to request a quote, or contact us to schedule a conversation.
