11/17/2020
Rising Social Engineering Crimes Changing Cyber Coverage
Internet-based crime shows no sign of letting up. According to the FBI’s Internet Crime Complaint Center, 2019 saw both the highest number of cybercrime complaints and the biggest monetary losses reported since the center’s establishment in 2000. The FBI received an average of almost 1,300 complaints each day and documented more than $3.5 billion in losses for individual and business victims.
The greatest number of complaints focused on social engineering scams. Social engineering is a ruse that persuades people to let down their guard and inadvertently reveal or permit access to valuable information. Criminals have utilized social engineering tactics for centuries, but modern technology is enabling scammers to expand the victim pool. In our increasingly connected world, many cyber insurers are reporting a significant rise in social engineering claims — particularly from the real estate sector and financial service providers.
During the last several years, cybercrime has become a key exposure for small and medium-size businesses. NetDiligence’s Cyber Claims Study revealed that since 2014, approximately 96% of cyber claims reviewed have come from organizations with $2 billion or less in revenue. The report also found that social engineering, ransomware, hacking, and malware/viruses were the leading causes of loss in 2019. Another of the most visible trends in the data was the rising percentage of claims caused by criminal activity, which has increased from 72% in 2014 to 86% in 2017 and 2018.2 Only 14% of claims had non-criminal causes, such as employee error or system glitches.
COMMON SOCIAL ENGINEERING SCAMS
When it comes to cybercrime, the most common social engineering scams employed by criminals include:
PHISHING
A ubiquitous method of scamming victims through impersonal but official-looking email, recipients are invited to click a link or open an attachment that allows a cybercriminal to gain account information or launch malicious software. Phishing can open the door to a variety of cybercrimes, including ransomware attacks.
SPEAR-PHISHING
A more personalized form of phishing that uses specific information to defraud a targeted individual, a spear-phishing attack might include partial account numbers or the names of business associates to suggest that the sender is trustworthy.
BAITING
Similar to phishing attacks, this scam promises an item that malicious actors use to trick victims into providing login credentials.
TAILGATING
Also known as “piggybacking,” in these attacks, an individual without authorization follows an employee into a restricted area. For example, attackers may impersonate a delivery driver. When an employee opens the door, the attacker then asks the employee to hold the door and gains access to the building. This doesn’t generally work in large corporate settings that require the use of a keycard; however, with small or mid-size businesses, attackers can start conversations with employees and use that familiarity to navigate past the front desk.
BUSINESS EMAIL COMPROMISE
A costly and growing problem, the FBI’s Internet Crime Complaint Center reviewed 23,775 cases of Business Email Compromise (BEC) in 2019, resulting in losses of more than $1.7 billion.1 BEC scams are particularly known for targeting individuals responsible for handling wire transfers. For example, an employee may receive an email from an executive’s hacked email account, or an email that appears to be from that account, requesting wired funds for a business transaction. Other variations of BEC may involve personal email accounts, texts, or phone calls that appear to come from a person authorized to make such requests.
VENDOR/SUPPLIER IMPERSONATION
Another variation of BEC, this form of crime tricks the victim into diverting funds normally paid to an actual vendor or supplier to a fraudulent account. This tactic often succeeds when the victim fails to verify the account change by contacting the vendor using existing records. All too often, victims later call a number provided by the cybercriminal, which also turns out to be fraudulent.
CYBER COVERAGE CONSIDERATIONS
Coverage for social engineering losses originally debuted in cyber insurance policies around 2012. Sometimes known as fraudulent instruction or cyber deception, cyber insurers readily added coverage on a sub-limited basis. Typically, this coverage was conditioned on call-back procedures within insureds’ accounting departments, but competition in the marketplace has since softened this requirement. However, the increase in social engineering claims means that retail agents and insureds can expect marketplace changes. Some insurers have reduced cybercrime limits, raised premiums, required policyholders to employ clear risk mitigation plans, or withdrawn from the cyber marketplace completely.
Over the past few years, the industry has seen an increase in insurance coverage disputes involving General Liability and Commercial Crime policies regarding coverage for cyberattacks. When an insured claims coverage for cyberattack under a traditional business insurance policy, the carrier may claim that this was unforeseen coverage, resulting in a dispute or litigation. Insurance companies have taken notice of such litigation, and amplified the need for Stand-Alone Cyber Insurance policies that give businesses clear cyber coverage. The decision to obtain Stand-Alone Cyber Insurance helps businesses avoid claim disputes and saves valuable time and money when a cyber incident occurs.
When it comes to cybercrime, a stand-alone crime policy is another possible coverage option. Unlike most cyber policies, which impose an aggregate annual limit, standard crime policies are historically written on an each-and- every-claim basis and usually have no aggregate limit. With the increasing frequency of social engineering claims, an each-and-every-claim approach has significant benefits to any insured worried about multiple claims within a policy period. In addition, underwriters may be better equipped to evaluate crime exposures and recommend reasonable
risk management steps. Finally, crime underwriters may be more flexible in providing higher social engineering limits, especially for insureds that successfully implement risk management requirements. While some cyber insurers exclude funds held in escrow, crime insurers also generally include coverage for third-party funds held by an insured.
BOTTOM LINE
As criminals get more sophisticated, it gets harder and harder for victims to identify red flags. Depending on the risk,
it may be advantageous for retail agents to explore different coverage structures for cybercrime, such as using cyber coverage on an excess basis with underlying losses paid under a commercial crime policy. If such an approach is taken, some cyber carriers will amend the form to recognize deductible erosion by any payment made by the commercial crime carrier that is also covered under the cyber policy.
Ultimately, the marketplace dictates the availability and structure of cybercrime coverage, whether that be existing cyber policies or the creation of hybrid forms that cover traditional commercial crime and cybercrime exposures, along with first-party and third-party cyber risks. Agents and insureds should strive to fully understand cyber exposures and partner with experienced wholesale specialists to determine the most appropriate coverage option for each client
Need a quote? Call or email me anytime.
[email protected]
763-227-2973
