Short answer
In CEO fraud, criminals pose as an executive, lawyer or business partner and use authority, time pressure or secrecy to get employees to make a payment. Whether insurance covers the direct financial loss does not depend on the word “cyber” but on the insured event: IT forensics after an email account has been compromised may fall under cyber cover; the amount transferred often sits closer to crime, fidelity or an expressly agreed social engineering module.
A general promise of cover would be wrong. Cyber, crime and fidelity products are defined differently. Review the policy, terms, endorsements, sublimits and authentication requirements together.
Why CEO fraud is a business process risk
In January 2026 the NCSC reported that the CEO fraud cases reported to it had risen from 719 in 2024 to 971 in 2025. Fraudsters use not only fake emails but also WhatsApp, phone calls, imitated writing styles and deepfake voices.
Typical warning signs:
- unusual urgency or strict secrecy;
- a request to bypass the normal approval process “just this once”;
- a new bank account or foreign payment;
- a supposed lawyer or adviser as additional authority;
- a sender domain with small letter swaps;
- a request for the account balance, gift cards or immediate payment;
- a callback number or video link that appears only in the suspicious message.
The decisive protection is not a single spam filter. It is a payment process that not even management can override on request.
Money already transferred: act immediately
- Call the bank without delay. Use a known number, request a recall or payment stop and document the reference, beneficiary account and contact person.
- Block further payments. Inform payment approvers and secure the affected accounts without deleting evidence.
- Involve the police and the NCSC. Where there is financial loss, the NCSC recommends filing a criminal complaint with the local police; reporting to the NCSC supports its assessment of the threat situation.
- Preserve evidence. Keep original messages, headers, attachments, chat histories, phone numbers, approvals, payment records and timestamps.
- Check accounts. If email may be compromised, forensically examine sessions, forwarding rules, MFA, password changes and other affected mailboxes.
- Notify all potentially relevant insurers. Inform cyber, fidelity/crime and other affected policies through their notification channels; do not assume which one is responsible.
The general cyber emergency plan helps you document roles, timings and decisions consistently.
Cyber or crime/fidelity?
| Loss or service | Cyber insurance may be relevant | Crime/fidelity may be relevant | Key points to check |
|---|---|---|---|
| compromised email account | forensics, clean-up and recovery, if the event is insured | not the typical core | definition of the cyber event, providers and deductible |
| direct mistaken transfer after deception | only with an express cyber fraud/social engineering extension | often the closer area of cover, if external deception is included | type of deception, person acting, authentication and sublimit |
| manipulated supplier IBAN | depending on the optional fraud module | depending on the fraud/social engineering definition | callback and approval obligations, changes to master data |
| embezzlement by employees | not the typical cyber core | classic potential fidelity loss, if insured | insured persons of trust, discovery period and proof |
| leak of personal or business data | incident response, data protection, liability and communication, if insured | only with a suitable extension | cause, data affected, liability and exclusions |
| bank recovery, investigation and legal costs | depending on the assistance/legal module | depending on loss assessment and legal costs cover | cost approval, providers, sublimit |
“May be relevant” is not a promise. A product may include social engineering, exclude it or cover it only through an endorsement with its own limit. Some terms require defined control steps. If an agreed callback confirmation or joint signature was bypassed, this may affect the benefit.
The Swiss Insurance Association points out that cyber products are designed differently. A concrete Swiss market example is AXA’s separate fidelity insurance, which describes social engineering losses. This does not allow conclusions about other insurers or your own contract.
CFO control matrix against social engineering
The most effective controls are simple, provable and apply without exception. Adapt thresholds and roles to your company.
| Risk situation | Mandatory control | Responsible | Evidence |
|---|---|---|---|
| new or changed IBAN | callback confirmation via a number already on file; approve the change and the payment separately | master data + accounts payable | callback note and approval log |
| urgent or confidential payment | no special route; four-eyes approval and callback to the requester | CFO + second approver | two technical approvals |
| instruction from CEO/board | same limits and controls as for everyone else | CFO/board chair | documented policy with no exceptions |
| foreign payment or unusual beneficiary | defined escalation threshold and independent plausibility check | treasury/CFO | checklist and approval |
| invoice with new payment details | check against contract/order; contact the supplier through a known channel | procurement + accounts payable | verified master data record |
| instruction by email, chat, phone or video | verify identity through a second, known channel | recipient | callback/confirmation note |
| executive unavailable | use the designated deputy; never skip the control | line management | deputy approval |
| external email looks internal | tag external senders; check domain and reply-to | IT + recipient | mail gateway rule/check note |
| new member of the finance team | practise payment rules and a CEO fraud scenario during onboarding | CFO + HR | training record |
| suspicion or failed attempt | stop the payment, report internally, secure indicators and consider an NCSC report | everyone + security | incident number and log |
Three rules that belong in every row
- Second channel: never use the phone number, address or link from the suspicious message for confirmation.
- Four eyes: the second person checks the content and beneficiary independently; simply clicking through is not a control.
- No boss exception: urgency and hierarchy increase scrutiny; they do not override it.
This reflects the NCSC’s current recommendations on the four-eyes principle, separate verification, processes without exceptions and tagging of external emails.
What belongs in an insurance comparison
Do not settle for a confirmation of CEO fraud based only on the question “Is social engineering included?”. Describe specific scenarios and ask for a written allocation:
- fake CEO email without a hacked account;
- genuine, compromised Microsoft 365 or Google Workspace account;
- deepfake call or WhatsApp message;
- manipulated supplier invoice or new IBAN;
- internal embezzlement by an employee;
- transfer despite the four-eyes principle being followed;
- transfer in breach of an agreed control step;
- costs of bank recovery, forensics, legal advice and communication.
For each scenario, compare the event definition, insured persons, overall limit, sublimit, deductible, retroactive cover, discovery period, security requirements and cost approval. The policy comparison shows how to review several lines of insurance together.
Frequently asked questions
Is CEO fraud always a cyber attack?
No. A fraud can rely solely on deception and an intact payment process without any IT account being technically compromised. Conversely, business email compromise can involve a genuinely hacked account and therefore also a cyber incident.
Does cyber insurance cover the amount transferred?
Not automatically. Direct financial losses from deception often require an express fraud or social engineering module and may be subject to a separate sublimit or control requirements.
Is a callback by phone enough?
Only if the number comes from an independent, already known source and the person confirming verifies the specific instruction. Calling the number in the suspicious message only confirms the attacker.
What matters more: technology or training?
Both help, but the mandatory approval process is the last financial barrier. Email tagging, MFA and filters help; four-eyes approval and independent confirmation prevent a convincing message from leading to a payment on its own.
Official and primary sources
- NCSC: CEO fraud – characteristics, immediate and preventive measures
- NCSC: “Urgent money transfer” – CEO fraud and SMEs, 27 January 2026
- Swiss Insurance Association: cyber insurance benefits and product differences (in German)
- AXA Switzerland: market example of fidelity insurance including social engineering
Content reviewed on 18 July 2026. The lines of insurance mentioned are for orientation only and do not constitute a promise of cover. The individual case and the complete, current contract documents are decisive.