Cyber and social engineering - When trusted instructions lead to diverted payments, transferred assets or exposed investor data
Social engineering fraud is the deliberate manipulation of a person into taking an action that benefits a criminal. Rather than breaking into a system through a purely technical exploit, the attacker exploits trust, urgency, authority or familiarity – persuading an employee, finance team member, fund administrator, investor or service provider to disclose credentials, amend bank details, approve a payment or release assets. This includes compromising company mailboxes to impersonate senior executives or trusted counterparties. This is known as business email compromise (BEC).
The relationship between BEC, social engineering and funds transfer fraud is direct:
As a result of the above, human error remains a material contributor to financial loss and data exposure. Criminals increasingly use genuine email threads, stolen credentials, publicly available transaction information and AI-enabled impersonation to make fraudulent instructions difficult to distinguish from legitimate business activity, bypassing traditional controls designed to detect unauthorised actions. [ukfinance.org]
A further consequence
A social engineering incident can become a wider liability claim where a client, investor, counterparty or regulator alleges that the firm failed to maintain reasonable controls, protect confidential information, authenticate instructions, supervise outsourced providers or respond appropriately once fraud was discovered.
A direct loss of money may therefore be only the first part of the claim. The broader event can trigger separate costs and liabilities arising from the resulting security incident, privacy breach, interruption or alleged failure of professional duty.
Insurance and other protections
There is no single policy that automatically resolves every element of a BEC or social engineering loss. A robust insurance programme should be designed around both the direct loss of money or assets and the wider cyber, privacy and liability consequences.
The dividing line is often as follows:
crime policy
is generally designed to address the insured’s direct financial loss from employee dishonesty, theft, fraud, computer crime, funds transfer fraud and other criminal acts.
cyber policy, which may include cyber crime (funds transfer fraud) cover,
is generally designed to address the consequences of a cyber event: forensic investigation, data breach response, privacy liability, interruption, data restoration, extortion and certain third-party claims.
crime policy does not automatically resolve the cyber consequences
of the same event, such as data breach response, regulatory investigation, IT remediation, network interruption or privacy claims. Social engineering can be covered under either policy depending on the coverage being offered.
The key coverage question is not simply, “Was there a cyberattack?” It is: What caused each element of loss, and under which insuring clause does that loss fall? Cyber, crime and financial institution policies should therefore be viewed together and not in isolation.
For example, a compromised mailbox may constitute a security incident; the fraudulent transfer may require a social engineering or funds transfer fraud insuring clause; and the disclosure of investor data may create breach response and third-party liability exposure.
Practical priorities
For investment and financial services firms, the most effective response combines controls, contractual clarity and insurance design:
Independently verify every new or amended payment, redemption, settlement or asset transfer instruction using contact information held on record.
Apply dual approval, monetary thresholds and segregation of duties for high value or non-routine instructions.
Apply enhanced verification for changed bank details, urgent transactions, overseas payments and instructions involving senior executives or confidential deals.
Enforce multifactor authentication for email, payment systems, investor portals and remote access; monitor for mailbox rule changes and suspicious login activity.
Map the maximum credible loss across capital calls, distributions, redemptions, deal proceeds, client money, assets and investor data.
Enforce cybersecurity awareness training for all employees on social engineering and funds transfer fraud.
For this risk, the critical question is not whether people will make mistakes. It is whether the organisation’s controls, incident response and insurance programme are designed to prevent a credible social engineering attempt from becoming an uninsured financial and liability event.
The scale of fraud
Coalition’s UK claims analysis found that funds transfer fraud made up 27% of cyber claims and had average severity of approximately £106,136. More than half (52%) of funds transfer fraud claims originated from BEC.
UK Finance recorded £576.4 million of authorised push payment (APP) fraud losses across 248,070 cases in 2025. APP fraud occurs where a victim is deceived into authorising a payment to a fraudster. [ukfinance.org]
66% of APP fraud cases began online and a further 17% began through telecommunications. [ukfinance.org]
Experian reported that more than one third of UK businesses knowingly encountered generative AI related fraud in early 2025, including deepfakes, identity theft, voice cloning and synthetic identities
