Contractor Payment Fraud: Does Cyber Insurance Pay?

If an Arizona contractor wires or ACHs money to a fraudster after a spoofed email or a “new bank details” request, a standard cyber policy often does not pay it back, and a crime policy may exclude it too. Coverage usually turns on a funds transfer fraud or social engineering endorsement, its sublimit and its conditions, so you need to read those pages before a loss, not after.

This guide is for contractors, subcontractors and home service owners who pay vendors, suppliers and subs by wire, ACH or check, or who get paid that way. It is general education, not legal advice or a coverage opinion.

Four terms drive everything below:

• Business email compromise (BEC) is the FBI’s term for a scam aimed at businesses that regularly make wire transfers, using compromised email accounts or other communications to trigger an unauthorized transfer of funds.
• Funds transfer fraud is a crime-policy insuring agreement for fraudulent instructions sent to your bank without your knowledge or consent. It is different from your own employee being tricked into sending the payment.
• Social engineering (fraudulent impersonation) coverage is an endorsement that can cover money you voluntarily send because someone impersonated a vendor, executive or customer. It is commonly sublimited and may carry verification conditions.
• Voluntary parting exclusion is wording that bars loss from you or anyone on your authority being induced by a dishonest act to voluntarily part with money or property.

How common is payment-redirect fraud?

The FBI’s 2025 Internet Crime Report counts 24,768 business email compromise complaints and $3,046,598,558 in reported BEC losses for the year. Arizona ranked sixth by reported losses across all crime types, at $630,700,609. These are complaints filed with the FBI, not every loss, and the report’s Arizona figure is not limited to contractors or to BEC.

The FBI’s public service announcement on BEC advises verifying account changes through a secondary channel and, if a transfer is fraudulent, immediately contacting your financial institution to request a recall. Contractors have a built-in exposure: progress payments, supplier invoices and sub pay applications are large, recurring and often emailed.

Which policy might pay when a fake invoice is paid?

The voluntary parting issue is real in court. In Midlothian Enterprises v. Owners Insurance (E.D. Va., February 2020), an employee wired $42,302 after an email that appeared to come from the company’s president. The court held the policy’s voluntary parting exclusion applied. That is one federal ruling under Virginia law, not an Arizona rule. Policy wording and state law differ, so treat it as a reason to ask questions, not as a prediction.

Hypothetical: a changed bank account on a progress payment

This example is hypothetical and simplified. The accounts payable clerk at a Phoenix-area mechanical contractor receives an email that looks like it came from a long-time supplier. It says the supplier’s bank has changed and asks that the next $48,000 invoice be paid to a new account. The clerk updates the vendor record and sends the ACH. A week later the real supplier asks where its payment is.

• The loss is the company’s own money sent on its own authority, so a funds transfer fraud grant that requires a fraudulent instruction to the bank may not fit.
• A crime policy’s voluntary parting exclusion may apply unless an impersonation endorsement carves it back.
• If the policy has social engineering coverage, the limit may be far below $48,000 and may require proof the bank change was verified by phone.
• If the compromised mailbox held personal information, A.R.S. § 18-552 notification duties may be a separate issue from the lost payment.
• The result depends on the actual policies, the facts and the law.

What should you do in the first hours after a fraudulent payment?

The FBI’s report says time is of the essence. Its Recovery Asset Team handled 3,900 Financial Fraud Kill Chain incidents in 2025, covering $1,163,919,846 in attempted theft, and reports freezing $679,013,183, a 58% success rate. Those figures cover all fraud types, not just BEC, and a freeze is not a guaranteed recovery. The FBI’s guidance in that report:

1. Contact your financial institution right away and request a recall of the funds, along with any indemnification documents it needs.
2. File a complaint at ic3.gov with the full transaction details, regardless of the amount.
3. Preserve the emails, headers, invoices and bank confirmations.
4. Read the notice and proof-of-loss conditions in your cyber and crime policies, and tell your agent promptly.

What should you check on your policies before renewal?

1. Is there any social engineering, fraudulent impersonation or funds transfer fraud coverage, on the cyber policy, the crime policy or both?
2. What is the sublimit, and is it the same for wires, ACH and checks?
3. Does the grant cover impersonation of vendors and customers, or only your own executives?
4. Is a call-back verification step a condition of coverage, and who must perform it?
5. Does the crime form carry a voluntary parting exclusion, and is there a carve-back?
6. What are the retention, notice deadline and proof requirements?
7. Do the cyber and crime policies coordinate, or could each point to the other?
8. Do your own controls match what you tell underwriters: dual approval, bank-change verification by phone to a known number, and email authentication?

Frequently asked questions

Does cyber insurance cover a fake invoice or changed bank details?

Not automatically. A standard cyber policy is built around breach response and data events. Payment-redirect losses usually depend on a funds transfer fraud or social engineering endorsement, often with its own sublimit and conditions. Read the endorsement and its limit before you assume it applies.

Does a commercial crime policy cover business email compromise?

Sometimes, but not by default. Crime policies often have a voluntary parting exclusion for money your own staff send after being tricked. In Midlothian Enterprises v. Owners Insurance (E.D. Va. 2020), a court applied that exclusion to a spoofed-email wire. Coverage usually needs a specific impersonation or social engineering endorsement.

Does general liability cover money lost to payment fraud?

Generally no. General liability responds to third-party bodily injury, property damage and personal and advertising injury, not to your own money sent to a fraudster. Your bank, a crime policy or a cyber policy endorsement is where this question belongs.

What should a contractor do first after sending money to a fake account?

Call your bank immediately and ask for a recall of the funds, then file a complaint at ic3.gov with the full transaction details, as the FBI advises. Then read your policies’ notice conditions and tell your agent promptly so late notice does not become a second problem.

Who can I contact about cyber and crime coverage for an Arizona contractor?

Contact PrimeRisk Insurance Solutions in Queen Creek, Arizona, or book a conversation with Kody Houk, Founder & Principal. Start with the review form above, then share your cyber and crime declarations and endorsements. A coverage review is not a claim decision or a guarantee of coverage.

Related reading: what cyber insurance does and does not cover for accounting firms, cyber and Tech E&O for marketing and lead-generation companies and contractor insurance for subcontractor risk.

Request a cyber and crime coverage review with your contact details and choice of a call or email.

Coverage descriptions are general education. Actual coverage depends on policy wording, endorsements, facts and applicable law. This article is not legal advice. Statistics are from the FBI’s 2025 Internet Crime Report as published, and Arizona statutes are summarized as of October 13, 2026.