Separate vendor verification from internal approval

The FTC recommends confirming suspicious communications using a telephone number already known to be correct—not one supplied in the message. Travelers' guidance, written for financial institutions, similarly emphasizes trusted contact details, consistent procedures and escalation. These are prevention practices, not promises of insurance coverage.

For a SaaS finance team, a useful application is to distinguish two questions: Did management authorize this payment? Did someone independently confirm that the vendor requested the bank change? Two approvals of the same email answer only the first.

Map who receives the request, verifies it, edits the vendor record and releases payment. Include urgent exceptions and staff absences. Then compare that workflow with the proposed policy instead of assuming an internal approval procedure satisfies every insurance condition.

• Does the proposed wording require a particular verification method, and when does it apply?
• Who must complete verification if a contractor maintains the vendor records?
• What documentation is expected, and what would a missed verification step mean for coverage?

Sources: Federal Trade Commission: Cybersecurity for Small Business · Travelers: Social Engineering Fraud and Scams

Record the amount available for this fraud scenario

Coalition's discussion of funds-transfer fraud notes that losses can exceed applicable policy sublimits. Do not substitute the overall policy limit for the amount available under the relevant fraud coverage.

As an internal planning exercise, compare the applicable amount with your largest ordinary vendor payment and with payments that might accumulate before reconciliation identifies a wrong account. This is a way to frame questions—not a universal limit recommendation.

Keep the answers beside the coverage wording in your renewal worksheet. A clearly stated limit is useful only after you have established which coverage provision might respond.

• What limit applies to this exact loss, rather than to crime coverage generally?
• Is that limit per occurrence, an annual aggregate, or part of a shared limit?
• Would several payments following one fraudulent bank change count as one event?
• What deductible or retention applies, and do covered expenses reduce the available limit?

Sources: Coalition: Funds Transfer Fraud: How Coverage Responds

Review cyber overlap without assuming limits add together

Coalition describes coordinated limits and a single highest retention for specified paired surplus-lines crime and cyber products when an event is covered by both. That arrangement is product-specific; it is not a rule for any two policies.

Ask which policy would respond to the employee-authorized vendor payment, how other-insurance provisions operate, and whether separate retentions could apply. Request an explanation tied to the proposed forms.

Also separate stolen money from incident-response expenses. Chubb's cyber overview lists response costs, such as forensic and legal services, separately from cyber-crime endorsements. The practical inference is that coverage for investigating an incident does not itself establish reimbursement of the diverted payment.

Sources: Coalition: Funds Transfer Fraud: How Coverage Responds · Chubb: Cyber Insurance Coverage & Products

Prepare one focused renewal worksheet

Use four columns: payment scenario, relevant policy wording, verification steps and unresolved questions. Have finance describe the process while the person responsible for insurance records the wording questions. Mark each unanswered issue for follow-up before choosing coverage.

When requesting a quote from Atlas Risk Partners, identify employee-authorized vendor-payment fraud as the exposure to review. That keeps the conversation more specific than a request for crime insurance alone.

Availability varies by carrier, state and risk. These insurer examples do not establish Atlas carrier access. This is general education, not an individualized recommendation, and does not bind or establish coverage. The issued policy wording and facts of a loss control.

Sources: Coalition: Funds Transfer Fraud: How Coverage Responds · Travelers: Social Engineering Fraud and Scams