Separate the scenarios before naming the coverage
Begin with how money moves: who creates a vendor, approves a payment, changes bank details, releases a wire, and reconciles the account. Then identify the incident type being considered—dishonest employee conduct, impersonation, forgery, computer fraud, or a voluntarily authorized transfer after deception.
A familiar phrase such as “fraud coverage” can blur distinctions that matter in an insuring agreement or exclusion.
Map the controls and retain records
Document callback, dual-approval, vendor-change, reconciliation, and escalation steps as they operate today. Keep payment-authority matrices, vendor-verification records, bank instructions, incident reports, and relevant correspondence in a controlled file.
Do not put bank credentials or detailed account numbers into a general insurance inquiry or calendar note.
- Who can initiate and approve a payment
- How vendor banking changes are verified
- What evidence is retained after a release
- Who is notified when a suspicious request appears
Compare the contract terms
Review the specific crime insuring agreements, definitions, exclusions, sublimits, deductibles, discovery or loss-sustained basis, and conditions that may require a verification practice. Ask whether a social-engineering or funds-transfer provision is separate from employee dishonesty.
A control may be important even if the proposal has an appealing limit. Conversely, a policy label does not confirm that a particular event is covered.
Use an incident to improve the next review
After a near miss or loss, preserve facts, follow the organization’s incident and reporting process, and obtain timely legal or policy-specific guidance where needed. Use the resulting control changes in the next submission.
The FTC publishes practical business guidance on phishing and payment scams. Insurance terms remain governed by policy wording, declarations, and endorsements.
Map funds movement before reviewing commercial crime insurance
Commercial crime insurance questions become clearer when a finance team traces a payment from request to reconciliation. Identify who can add or edit a vendor, who receives bank-change instructions, who independently verifies them, who approves the payment, how a wire is released, and who sees the transaction afterward. Include grants, donor-restricted funds, payroll, reimbursement platforms, and outsourced bookkeeping where they form part of the organization’s actual process.
The map should distinguish a documented control from a habit. A dual-approval step that is bypassed during a busy event period or a callback process that has no independent directory source may be relevant to both operational risk and the conditions in a commercial crime proposal.
Terms to compare after the workflow is clear
With the workflow in view, compare employee dishonesty, funds-transfer fraud, computer fraud, forgery, social-engineering, client-property, and discovery or loss-sustained provisions only where they appear in the proposed business insurance forms. Note the named insured, loss payee, covered property, sublimits, deductible, definition of employee, and conditions that ask for a particular verification practice.
If a suspicious payment or loss occurs, preserve records and follow the organization’s incident, bank, legal, and policy-notice processes promptly. A guide cannot decide coverage after the fact. Policy wording, declarations, endorsements, and the specific loss facts control.
Trace a real payment from instruction to bank release
Select a recent grant-funded disbursement or vendor payment and follow it through request, approval, vendor record, bank detail, release, and reconciliation. Identify each person or outsourced bookkeeper with access to change the record. Record how bank changes are independently verified using a known contact method rather than relying on contact information in the change request itself. The FBI’s business-email-compromise resources show why payment redirection deserves its own control conversation.
Include donor-restricted money, fiscal-sponsor transfers, payroll, expense reimbursements, and event deposits if those flows exist. A written policy that is routinely bypassed is not an accurate description of the organization’s control. Note exceptions and who approves them.
Compare crime coverage by mechanism of loss
Separate employee theft, computer fraud, funds-transfer fraud, forgery, social engineering, and property of clients or donors where the proposed forms address them. Ask how each term defines the event, who is an employee, which funds are insured, what verification conditions apply, how a subcontracted bookkeeper is treated, and whether the sublimit differs from the headline crime limit. This is more useful than asking whether the organization simply “has crime insurance.”
Use one realistic scenario: a legitimate finance employee follows a fraudulent bank-change email and sends a payment to the wrong account. Ask which forms and conditions would be examined. Do not state that any particular mechanism is covered without the issued wording and loss facts.
Prepare an immediate response record
If a suspicious transfer occurs, preserve the original message, headers where available, approval trail, bank instructions, payment confirmation, callback record, vendor contract, and bank communications. Escalate promptly through the organization’s bank, security, legal, and insurance channels; the FBI IC3 guidance includes reporting information. Note who made each contact and when, and keep any recovery status distinct from the initial loss estimate.
Afterward, review how the instruction entered the workflow, whether the callback source was independent, and whether authority limits were followed. Update the control map and the next insurance submission. Policy wording, declarations, endorsements, and the specific facts determine any claim response.
Ask control questions before making application representations
Have the finance owner test a sample of recent vendor changes, wires, payroll changes, and grant disbursements against the control description proposed for the insurance application. Were two distinct people actually involved? Was the callback made to a previously verified number? Could an administrator change both the vendor and approval record? What happens when the usual approver is away? Document exceptions and remediation rather than declaring a process universal when it is not.
Save a dated, approved control narrative. If a payment platform or outsourced accountant changes during the term, update the narrative and raise the insurance question. A well-supported description makes a more reliable comparison than a collection of generic anti-fraud slogans.
Decision checklist for your coverage review
Use these questions with the current policy, relevant agreements, and the latest operating records. They help identify what needs a document-level answer before requesting or comparing terms.
- What changed in the organization, its programs, workforce, services, or agreements?
- Which current policy form, declaration, or endorsement should be read with that change in view?
- What definition, exclusion, condition, limit, retention, or policy date needs a documented answer?
- Which agreement, operating record, or final policy document belongs in the review file?
Bring the records into the conversation
Set the declarations, applicable endorsements, governing or service agreements, and the operational record beside this guide. Record the document reviewed, the question raised, the answer received, and anything that remains unresolved. That file helps a board, finance lead, or firm principal revisit the decision when circumstances change.
Yerba Buena Partners can help prepare a commercial insurance submission and compare available terms against the organization’s actual responsibilities. This guide is educational and does not decide a claim or promise coverage; policy wording, declarations, and endorsements control.