Criminals time fake bank change requests and impersonation emails to ownership changes because everything is changing at once: new bank accounts, new approvers, a new owner nobody on staff knows well, and often a public closing announcement. Your best defense is a written rule: no payment detail changes without a call to a number already on file. Then check your crime and cyber policies. In everyday use, funds transfer fraud means any scheme that gets a business to send money to a criminal. In an insurance policy it usually means something narrower, a fake instruction sent to your bank without your knowledge, so it often does not pay when your own employee is tricked into sending the money. This guide is for new owners who want to stop wire and payment fraud in the first months and understand what insurance would and would not cover.
The short answer
- Closing announcements, new bank accounts and unfamiliar approvers give fraudsters perfect cover for a fake payment request.
- Many of these frauds start with an email that looks like it came from a vendor, the seller or you. A call back to a number already on file can stop many of them.
- Funds transfer fraud coverage, in its traditional wording, covers instructions to your bank that you did not send. It is different from an employee being tricked into sending money.
- That second situation, social engineering, is often excluded unless you add specific coverage, which usually has a lower sublimit and verification conditions.
- If money goes out, call your bank at once, report it to the Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3) and notify your insurers.
Why do fraudsters target businesses that just changed hands?
Business email compromise (BEC), where criminals use real or fake email accounts to redirect payments, is one of the costliest frauds reported to federal authorities. The FBI's Internet Crime Complaint Center logged 24,768 such complaints in 2025, with reported losses of about $3.05 billion, and many losses are never reported. An ownership change makes a company easier to fool, for reasons that are mostly legitimate:
- Public signals. Press releases, social media posts and customer letters announce the deal and name the new owner.
- Real changes look like fake ones. New bank accounts, new payroll providers and new invoicing systems mean staff expect change requests.
- Unfamiliar voices. Staff know how the seller wrote emails. They do not yet know how you write them, or whether you would ever ask for an urgent wire.
- Vendor records in motion. Vendor and payee lists are being moved into new accounting systems, and few people check each entry.
- Controls that left with the seller. In many owner-run businesses, the seller personally approved every payment. That check walks out the door at closing.
Migration projects add more openings, such as old email accounts and shared passwords. See cyber risk during IT and email migration.
What do these schemes look like?
Many schemes follow one of six patterns, and each has a simple check that can help stop it.
| Scheme | How it looks | Who usually loses | Verification step |
|---|---|---|---|
| Fake vendor bank change | A supplier "updates" its bank details because of a new bank or an audit | Your company | Call the vendor on a number already in your records |
| New owner impersonation | An urgent, confidential wire request that appears to come from you | Your company | Staff confirm any executive payment request by phone or in person |
| Seller or closing impersonation | A "final" payoff, escrow or working capital payment to a new account | Your company | Confirm closing-related payments with deal counsel by phone |
| Customer redirect | Your customers receive emails, in your name, with new remittance details | The customer, you or both, depending on the facts, plus your relationship | Tell customers how bank changes will be communicated and confirmed |
| Payroll diversion | An employee "asks" HR to change their direct deposit account | Your company or the employee | Confirm in person or by a known phone number |
| Hijacked email thread | A real vendor's email is hacked, and the request arrives in an existing conversation | Your company, though who bears the loss between you and the vendor can be disputed | Treat any bank change as suspicious, even from a real address |
What verification procedure should a new owner put in place?
Write it down, train staff on it and follow it yourself, especially in the first six months:
- No payment detail changes by email alone. Any new or changed bank account must be confirmed by phone, using a number from your existing records or the vendor's contract, never one from the email.
- Dual approval. Two people approve wires and new payees above a set amount, and one of them is not the person who entered the payment.
- A hold period for new payees. New or changed accounts wait a few business days before the first payment, with a small test payment where practical.
- An executive rule. Tell staff in writing that you will never ask for an urgent, secret wire by email or text, and that they will not be in trouble for calling to check.
- Bank tools. Ask your bank about payee verification, positive pay for checks (your bank matches each check against a list you send), blocks on automated clearing house (ACH) debits, transfer limits and dual control in online banking.
- Customer notice. Tell customers in your closing letter how you will communicate any bank change, and ask them to call before paying a new account.
- Keep a record. Note who verified each change, when and how. Some insurance coverage requires proof that you verified.
Insurance can pay for some losses; it does not stop them. Pair these steps with the employee theft controls in employee theft when you do not know the team yet.
Does crime insurance or cyber insurance cover social engineering losses?
It depends on which coverage parts (insurers call them insuring agreements) you bought and how they are worded. A commercial crime policy and a cyber policy can both include fraud coverage. The labels sound alike, so focus on who sent the instruction and whether anyone on your team was tricked.
| Coverage | Usually found in | What it covers in plain terms | Common catch |
|---|---|---|---|
| Funds transfer fraud | Crime policy; some cyber policies | A fraudulent instruction to your bank, made to look like it came from you, sent without your knowledge, such as a criminal using your online banking login | Usually does not apply when your own employee sends the payment, even if they were deceived |
| Computer fraud | Crime policy | Money or property taken through fraudulent use of a computer to make a transfer | Courts are split on whether an email that tricks an employee counts |
| Fraudulent impersonation or social engineering | Crime policy as an added coverage; many cyber policies | A good faith transfer by your employee after someone impersonates a vendor, client or executive | Often a lower sublimit; may require verification by a method other than the original email |
| Incident response | Cyber policy | Forensics and legal help if an email account was hacked | Pays to investigate, not necessarily to replace the stolen money |
| Invoice manipulation | Some cyber policies | Payment you cannot collect for goods or services you delivered, after a criminal used your breached systems to send your customers fake payment instructions (often only your cost, not your profit) | Usually requires a breach of your systems; often sublimited |
Two points decide many claims. First, a "voluntary parting" exclusion removes coverage when your employee willingly sent the money, even after being deceived. In one federal case, Midlothian Enterprises v. Owners Insurance (E.D. Va., 2020), a $42,302 wire sent after a fake email was not covered for that reason, though other courts have reached different results on different wording. Second, the Insurance Services Office (ISO) added an optional fraudulent impersonation insuring agreement to its 2022 crime forms, and coverage of this kind generally expects a reasonable effort to verify requests by another method. Your verification procedure can be an insurance condition as well as a control.
If both a crime and a cyber policy might respond, check how their other insurance clauses interact and report to both. For the policy-by-policy review, see the commercial crime review and the cyber insurance review.
What should you do in the first hour after a fraudulent payment?
- Call your bank's fraud line now. Ask it to recall the wire or stop the payment and to contact the receiving bank. Speed matters more than anything else.
- Report it to IC3 at ic3.gov, and to local law enforcement if your bank or insurer asks. Fast reporting can help recovery efforts, though recovery is never assured.
- Notify your insurers. Follow the notice steps in your crime and cyber policies, and tell your broker. Late notice can create coverage problems.
- Preserve evidence. Keep the emails, headers, invoices and call logs. Do not delete the fake messages.
- Secure any hacked account. Reset the password and sign out all sessions now, but do not delete mailboxes or logs. Call your cyber policy's breach hotline so its incident response team can investigate.
- Warn the people involved. Tell the real vendor or customer so they can secure their own systems.
How does one fake email turn into an uninsured loss?
A hypothetical example. Two weeks after a buyer announces the acquisition of a distribution company, the bookkeeper receives an email from a long-time supplier saying it has moved banks. The email is a reply in a real thread, because the supplier's email was hacked. She updates the vendor record and pays two invoices totaling $90,000 to the new account. The supplier calls a month later asking where its money is.
The company's crime policy includes funds transfer fraud but no fraudulent impersonation coverage. Because the bookkeeper sent the payments herself, funds transfer fraud coverage likely does not apply, and an argument under computer fraud would likely run into a voluntary parting exclusion, subject to the wording. Had the policy carried a social engineering sublimit (a smaller cap for this coverage inside the policy limit), the next question would have been whether anyone verified the change by phone, as the coverage required. A one-line rule and the right endorsement could have changed the outcome. Morrow can review your crime and cyber policies side by side and request quotes for the missing pieces; any coverage depends on carrier underwriting and starts only once bound.
Keep reading
- New Owner Review: Commercial Crime and Employee Theft
- New Owner Review: Cyber Insurance
- Cyber Risk During IT and Email Migration After You Buy a Business
- Employee Theft After You Buy a Business and Don't Know the Team Yet
- Your First 90 Days of Insurance After Buying a Business: A Checklist
- All guides for new business owners
Frequently asked questions
Is funds transfer fraud the same as social engineering?
No. Funds transfer fraud, in its traditional crime policy wording, covers instructions to your bank that you did not send, such as a criminal using your banking login. Social engineering is when your own employee is tricked into sending the money. Many policies treat them very differently.
How much social engineering coverage should a new owner carry?
There is no standard number. Start with the largest single payment your team routinely sends, such as a big supplier invoice or a payroll run, and how many wires go out each month. Ask your broker what sublimits are available on your crime and cyber policies and what verification conditions come with them.
Should social engineering coverage sit in my crime policy or my cyber policy?
Either can work, and some businesses have it in both. What matters is the sublimit, the definitions and the verification conditions. If you have both, ask your broker how the two policies would share a loss.
Can the bank get my money back after a fake wire?
Sometimes, if you report it quickly and the money has not moved on. Call your bank's fraud line right away and report to the FBI's Internet Crime Complaint Center. Recovery is never assured, which is why prevention and coverage both matter.
How do I warn customers that someone might impersonate my company?
Tell them in your closing letter and on invoices that you will never change bank details by email alone, and give them a known phone number to confirm any change. That protects their money and your relationship.
References
- Federal Bureau of Investigation: Internet Crime Complaint Center 2025 Internet Crime Report
- Federal Bureau of Investigation: Internet Crime Complaint Center (file a complaint)
- IRMI: Need to Know, Major Changes to the ISO Commercial Crime Program
- IRMI: Crime, Getting More Out of the Policy
- The D&O Diary: Voluntary Parting Exclusion Precludes Coverage for Social Engineering Fraud Loss (2020)
Just bought a business? Get your insurance reviewed.
Send Morrow the declarations pages, loss runs and key contracts you inherited. Morrow can review them against the business you bought, flag gaps and request quotes where it makes sense. Any new terms depend on carrier underwriting.
Morrow · 25 New Chardon Street, 4th Floor, Boston, MA 02114
This article is general information, not legal, tax or financial advice, and not a coverage determination. Coverage depends on the actual policy wording, carrier underwriting, your purchase agreement and your contracts. Ask your attorney and accountant about deal and legal questions.