Don't Give Your Money Away

But Chubb’s new social engineering fraud endorsement, launched at the end of July, does cover such losses. Coverage is available up to $250,000 per occurrence with no annual aggregate, according to the company. Higher limits may be available to qualified customers. It’s not available on all policies—and sorry, advisors, but Bangs pointed out that most of your coverage is “written in the Financial Institutions unit at Chubb, which does not offer this endorsement.” However, insureds under Chubb commercial crime policies are eligible.

The scams reach the next level with imitations of clients or of company executives. In either case, the fraudster has done his or her research so that they can convincingly present themselves as a client or as a high-level executive of the very company being punked.

For example, a scammer will choose a key executive of his target company, then bone up on personal and professional information from social media. He will often go so far as to study recordings of the executive’s speeches so that he can imitate the person’s cadence and intonation.

Then, said Bangs, “they’ll call someone, generally in the wire transfer area, and say, ‘I’m the CEO of our Asian subsidiary. We have an urgent need to get $2 million to China.’” If an employee has the good sense and backbone to challenge them, they’ll resort to intimidation with an indignant “Do you know who I am?” speech. Bangs said it’s amazing how effective that is; an employee will usually abandon efforts to verify what the fraudster has told him and just send the money. Most of the time it’s a lot of money—considerably more than the vendor or client imitation scams will net.

Even if a company has procedures in place to verify information, Bangs said, people by nature try to be helpful and want to please, so they often bypass the very steps that would uncover the fraud.

“Make sure you have certain controls in place,” he said. “If you allow employees to change banking information, make sure they verify it by going back to earlier information on record, not from the information on the scam email or provided by the fraudster. Use real contact information.”

Of course, insurance is no substitute for shoring up weak links. Covered or not, any company can make its position stronger by impressing on employees the need to follow proper procedures.