FOR Energy finance teams, controllers, executives and procurement managers
Describe how money actually moves
Energy businesses may pay large equipment deposits, change orders, freight charges and recurring contractor invoices. Map who creates vendors, approves bank changes, releases funds and reconciles transactions. Separate payment authority from technical access to the accounting system. A fraudulent instruction may exploit a legitimate approval process without compromising the company’s network.
The FBI’s Internet Crime Complaint Center describes business email compromise as a fraud involving social engineering or computer intrusion. For insurance review, identify the actual mechanism: employee theft, forged instructions, unauthorized bank transfer, impersonation or a payment voluntarily authorized after deception. Those distinctions can determine which insuring agreement or endorsement needs examination.
Compare crime and cyber provisions explicitly
A cyber policy may address certain security incidents without covering every fraudulent transfer. A crime policy may include computer or funds-transfer provisions while treating social engineering separately. Ask the broker to compare the definitions, direct-loss requirements, exclusions and any verification conditions against realistic payment workflows. Do not infer coverage from a product name.
Review sublimits, deductibles, insured entities and the definition of employee, including temporary staff where relevant. Identify whether client money, escrow funds or property of others is involved. If funds move through a third-party platform, clarify whose system and account are implicated. The existence of two policies does not guarantee that a disputed loss falls within either one.
Test a realistic supplier-payment scenario
Consider an illustrative equipment supplier email requesting that a deposit be sent to a new account. The message appears in an existing conversation, and an authorized employee releases payment. The company later discovers that the supplier never received the funds. Preserve the emails, approval records, bank details and timing rather than assuming that the event is automatically computer fraud.
The IC3 recommends independent verification of changed account instructions. Use established contact information rather than details supplied in the suspicious message. Dual approval and vendor-change controls should be practical during urgent shutdown work, when pressure to pay quickly can undermine normal procedures. Insurance can support risk financing but should not replace those controls.
Prepare reporting and recovery before an incident
Establish immediate escalation to the bank, internal security team, appropriate authorities and insurers when fraud is suspected. Rapid action may improve recovery opportunities, but recovery is not guaranteed. Review notice requirements across crime and cyber policies so one report does not leave another potentially relevant insurer unaware.
For underwriting, describe payment volumes, maximum transfers, segregation of duties, verification procedures and prior losses. Explain exceptions for emergency procurement and remote approvals. Retain evidence of controls actually used, because written procedures that are routinely bypassed may not support the intended risk presentation. Review coverage again when acquisitions, new payment systems or outsourcing materially change the movement of funds.
Operational exposures & coverage review
These review points are educational interpretation, not promises of insurance coverage.
| Exposure | Insurance review |
|---|---|
| Authorized deceptive transfer | Review social-engineering terms and sublimits. |
| Employee theft | Confirm employee and property definitions. |
| Vendor bank changes | Use independently verified contact channels. |
Questions for your next review
- Which insuring agreement addresses an authorized fraudulent payment?
- Do verification conditions match actual procedures?
- Who coordinates bank recovery and insurer notice immediately?
Related Montridge webinars
Cyber insurance context; crime/social engineering insuring agreements must be reviewed separately.
Cyber and operational technology
How Much Does Cyber Insurance Cost? Factors That Affect Pricing
Clicking Load video connects to YouTube. No player loads automatically.
Watch on YouTube ↗Connect this topic to your program
Bring the operational details above into a coordinated review of your contracts, loss history and actual policy wording. Explore Montridge cyber insurance services for the related brokerage service.
Source references
Primary-source background informs the technical discussion. Insurance review questions are educational interpretation; a source link does not establish coverage or certify compliance.
FBI IC3 describes business email compromise and recommends independent verification and prompt bank reporting.
Scope: United States federal guidance · Source reviewed 2026-11-01
Chubb identifies separate management-liability, employment-practices and crime coverage parts.
Scope: Insurer product illustration; jurisdiction and policy applicability require individual review · Source reviewed 2026-11-01
Prepared November 1, 2026. Confirm current requirements and their application to your work before relying on them. Specific insurance outcomes require review of the complete policy and endorsements.