If an employee was tricked into paying a fraudster, for example by a fake CEO on WhatsApp, a deepfake video call or a spoofed supplier email, your business insurance pays only if the policy specifically covers that kind of deception. Standard property policies do not. Many crime and cyber policies exclude losses where your own staff voluntarily sent the money, unless a social engineering fraud extension was added, usually with a much lower sub-limit and conditions about verifying payment requests. Whether you are covered depends on the exact wording you bought before the loss.
Why is a scam payment hard to insure?
Most traditional cover was designed for theft: someone takes money without permission. In a social engineering scam, nobody breaks in. An authorised employee, acting in good faith, logs into the company’s banking platform and approves the transfer. To the bank, and often to the insurer, that is an authorised payment.
This creates three problems:
- Employee dishonesty cover does not fit. Fidelity or employee theft cover responds when an employee is dishonest. A deceived employee is not dishonest.
- Computer fraud cover may not fit. Many computer fraud clauses require unauthorised entry into or alteration of your computer system. A convincing email or video call may involve no hacking at all.
- Voluntary parting exclusions. Many crime policies exclude loss where someone with authority voluntarily parted with money, even if induced by fraud, unless the social engineering extension applies.
Banks generally treat these as authorised payments. In Singapore, MAS’s E-Payments User Protection Guidelines protect accounts held by individuals and sole proprietors, and MAS and IMDA have said the Shared Responsibility Framework for phishing losses does not apply to corporate customers. A company that authorised a transfer to a fraudster should not expect a bank refund as of right, although speed can sometimes help recover funds, as one Singapore case below shows.
Which policy might respond?
| Type of cover | What it is built for | Will it pay for a deceived staff payment? |
|---|---|---|
| Commercial crime or fidelity: employee dishonesty | Theft or fraud by your own employees | Usually not, because the employee was deceived, not dishonest |
| Commercial crime: computer fraud or funds transfer fraud | Fraudulent entry into your systems, or fraudulent instructions to your bank without your knowledge | Sometimes, depending on the wording and the facts. Courts have reached different results on similar scams |
| Social engineering fraud extension (crime or cyber) | Staff tricked into transferring funds by someone impersonating an executive, supplier or client | Designed for this, but often with a low sub-limit, a deductible and verification conditions |
| Cyber policy: incident response and liability | Hacking, data breaches, ransomware, privacy claims | Forensics may be covered if your email was hacked, but the stolen funds themselves usually need a specific funds transfer or social engineering section |
| Directors’ and officers’ liability (D&O) | Claims against directors for wrongful acts | Not the company’s lost money; may defend a director later accused of poor oversight |
| Professional indemnity | Claims by clients for your negligent services | May respond if a client sues you because your compromised email led it to pay a fraudster |
Insurers use different names, such as “impersonation fraud”, “fraudulent instruction” or “deception fraud”. Read the definitions, not the headings. Our sibling article on cyber insurance for Singapore SMEs explains the other cyber sections.
What conditions in a social engineering extension catch companies out?
Even where the extension exists, claims often turn on these terms:
- Sub-limit. The social engineering limit is often a small fraction of the main crime or cyber limit. A company with a large headline limit may find this section capped at a modest figure.
- Verification condition. Many extensions pay only if the employee followed a stated verification procedure before paying, typically a call-back to a number held on file for a new or changed payee. If your procedure existed on paper but was skipped, the insurer may decline. Our guide to invoice fraud when a supplier’s bank details change covers the practical controls; the point here is that your written controls must match what the policy says.
- Deductible. Social engineering cover often carries a higher deductible than the rest of the policy.
- Discovery and notice. Crime policies commonly cover loss discovered during the policy period and require notice within a set time, followed by a detailed proof of loss. Late notice can defeat a claim.
- Police report and cooperation. Insurers usually expect a police report and your cooperation with recovery efforts. Any amount the bank or police recover reduces the claim.
- Who was impersonated. Some extensions cover impersonation of executives and vendors but not of clients, or exclude losses involving your own client money held on trust.
What happened in real cases?
Arup’s deepfake video call (Hong Kong, 2024)
In February 2024, Hong Kong police said an employee of a multinational company had been tricked into transferring about HK$200 million after a video conference in which the other participants, including a person appearing to be the chief financial officer, were deepfake recreations. As reported by CNN and the South China Morning Post, the British engineering firm Arup confirmed in May 2024 that it was the company involved. The money was sent in 15 transfers to five bank accounts. The case shows that an employee who sees and hears apparently familiar senior colleagues can be persuaded to act, which is exactly the scenario social engineering wordings are drafted around.
A Singapore finance director and the US$499,000 transfer (2025)
In March 2025, the Singapore Police Force, the Monetary Authority of Singapore and the Cyber Security Agency of Singapore issued a joint advisory on scams in which fraudsters use digitally manipulated video to impersonate senior executives of the victim’s own company on video calls. In April 2025, the Singapore Police Force reported that a finance director of a multinational company had been contacted on WhatsApp by someone posing as the company’s chief financial officer, then joined a Zoom call in which the chief executive and others were impersonated using deepfake technology. He transferred over US$499,000 (around S$670,000) from the company’s account. When the fraudsters asked for a further US$1.4 million, he alerted the bank, and the police’s Anti-Scam Centre, working with Hong Kong’s Anti-Deception Coordination Centre, traced and withheld the funds. Recovery on this scale is not typical, but it shows why insurers expect you to report quickly and why recovered sums reduce an insurance claim.
Medidata and the spoofed email (United States, 2018)
Medidata Solutions, a US software company, lost about US$4.8 million after an employee received spoofed emails appearing to come from the company’s president and wired money to a fraudster. Its insurer declined the claim under a commercial crime policy. In 2018, the US Court of Appeals for the Second Circuit held that the loss fell within the policy’s computer fraud provision, as reported by Insurance Journal and other outlets. Other US courts, applying differently worded policies, have refused cover for similar scams. The lesson is that disputes over these claims are common and turn on exact words, so it is better to buy clear social engineering cover than rely on arguing a computer fraud clause later.
Can the company recover the loss from the employee?
Legally, an employer may in principle claim against an employee who was negligent in breach of the employment contract. In practice, this is rarely worthwhile or fair where the employee was deceived by a sophisticated scheme and followed instructions that appeared to come from management. Points to consider:
- Salary deductions are restricted by the Employment Act, so you cannot simply deduct the loss from pay.
- Disciplinary action should follow a fair process and be based on what the employee knew and the procedures actually in place.
- If the insurer pays, it may have subrogation rights, but many policies restrict claims against employees who acted in good faith.
- If the employee was in fact dishonest or colluded with the fraudsters, the position changes completely: it becomes a criminal matter and an employee dishonesty claim. See our guide to employee criminal breach of trust in Singapore.
Are the directors exposed?
Directors must exercise reasonable diligence under section 157 of the Companies Act 1967, explained in our article on directors’ duties under section 157. A single scam loss does not by itself mean directors breached their duties. But where a company had no payment approval process despite public advisories, and a large uninsured loss pushes it towards insolvency, shareholders or a liquidator may later ask whether the board acted reasonably. Board minutes showing that the directors considered the risk, approved controls and decided whether to buy social engineering cover are useful evidence. Our sibling article on directors’ personal exposure for cyber risk covers this further.
Example: two companies, the same scam
Example: Two Singapore trading companies each lose S$180,000 when an accounts executive pays a fake “urgent acquisition deposit” after a WhatsApp message and a short video call from someone who looks and sounds like the managing director.
- Company A has a crime policy with employee dishonesty and computer fraud cover only. The insurer declines: the employee was honest, and no one hacked the company’s systems. The company bears the full loss.
- Company B bought a social engineering extension with a S$100,000 sub-limit and a call-back condition for payments above S$20,000 to new payees. The executive called the managing director’s mobile number from the staff directory, but the fraudster had sent a “new number” in the WhatsApp chat and the executive used that. The insurer argues the verification condition was not met. Company B’s broker and lawyer review whether the condition was breached, and whether the procedure was clearly communicated to staff.
Even for Company B, the most it could recover is the sub-limit less the deductible. The rest is uninsured.
Questions to put to your broker before renewal
- Does our crime or cyber policy cover payments made by an authorised employee who was deceived?
- Is the cover limited to impersonation of executives and suppliers, or does it include clients and deepfake calls?
- What is the sub-limit and deductible for this section?
- What verification procedure must we follow, and is it written into the policy as a condition?
- How soon must we notify, and what proof of loss is needed?
- Does the policy cover client money we hold, and losses where our own email was compromised and a client paid a fraudster?
Our sibling business insurance checklist for Singapore SMEs places this cover alongside the others.
Frequently asked questions
Is a deepfake call scam covered under cyber insurance?
Only if the policy has a section covering fraudulent transfer instructions or social engineering that includes this method. Standard cyber cover focuses on hacking, data breaches and extortion, not on staff voluntarily sending money.
Can we buy social engineering cover after the scam?
No. Insurance covers future uncertain losses. A known loss, or circumstances you were already aware of, will be excluded under a new policy.
The insurer rejected our claim. What can we do?
Ask for the reasons in writing with the exact clauses relied on, and have the wording reviewed. Our guide to disputing a rejected insurance claim explains the options, including mediation and the courts.
A client paid a fraudster because our email was hacked. Are we liable?
Possibly. The client may claim that your company failed to secure its systems or warn it. Notify your cyber and professional indemnity insurers promptly and do not admit liability before taking advice.
Should we report even if the insurer will not pay?
Yes. A prompt police report and a call to your bank give the best chance of funds being traced and withheld, as the Singapore case above shows.
Official sources: SPF, MAS and CSA joint advisory on scams involving digital manipulation (12 March 2025); Singapore Police Force news release, 7 April 2025; MAS E-Payments User Protection Guidelines; ScamShield; Companies Act 1967.
Crime, cyber and social engineering cover itself should be arranged through a licensed insurer or insurance broker, who can explain how a particular wording applies to your business.
Need help after a scam payment?
If your company, or you as a director or shareholder, is dealing with a payment lost to an impersonation or social engineering scam, contact the Raffles Corporate Services team at [email protected] or on WhatsApp at +65 8501 7133 or +65 9018 0072. We will help you understand the documents and deadlines. Where your matter needs a lawyer, for example if your insurer declines the claim, a client makes a claim against your company or you are sued, we will refer you to a firm on our panel of Singapore law firms that regularly handles fraud, insurance and commercial disputes. Raffles Corporate Services is a corporate services provider, not a law firm or insurer, and this article is general information, not legal or insurance advice.
The Raffles Corporate Services Editorial Team, Raffles Corporate Services