Cyber insurance in 2021: Social engineering and BEC drove a new wave of claims

When people talked about cyber insurance in 2021, they usually talked about ransomware. The high-profile attacks against fuel pipelines, food suppliers, and healthcare providers dominated the conversation, and ransomware was rightly seen as the single biggest driver of the hardening market. But beneath that headline, a quieter category of loss was growing fast: social engineering and business email compromise. Fraudsters who tricked employees into wiring money or changing payment details were costing organizations billions, and carriers were taking notice. Here is why the human layer became a focal point of underwriting in 2021.

The fraud that does not look like a breach

Business email compromise is different from ransomware in an important way: it rarely involves a technical intrusion at all. An attacker impersonates an executive, a vendor, or a business partner, and convinces an employee to transfer funds or change account details. There is no malware to detect, no encryption to reverse, and often no obvious security failure to point to. The money simply moves, and by the time anyone realizes it, it is gone. This made BEC a hard category for insurers to underwrite, because the loss did not fit the breach-and-response model that most cyber policies were built around.

Why social engineering claims kept climbing

Social engineering losses climbed in 2021 for the same reasons they always have: the attacks exploit trust, not technology, and trust is hard to patch. The shift to remote and hybrid work made things worse. Employees who could not walk over to a colleague to verify a request relied on email and messaging, exactly the channels attackers manipulate. At the same time, the tools for social engineering improved, with attackers investing in reconnaissance to craft messages that matched an organization's real tone and relationships. The result was a steady stream of successful frauds, each one a claim for an insurer.

The coverage question

Social engineering and BEC losses also exposed a gap in many policies. Traditional cyber insurance was built around data breach response, not funds-transfer fraud, and some policies offered only narrow, low-limit coverage for social engineering, or none at all. Policyholders who assumed their cyber policy covered a fraudulent wire transfer sometimes discovered too late that it did not, or that the coverage was capped at a fraction of the loss. Through 2021, carriers and brokers began clarifying these distinctions, and organizations learned to ask pointed questions about exactly what their policy covered.

Why carriers focused on the human layer

The rise of social engineering claims pushed carriers to scrutinize the human factor more closely. Underwriters began asking whether organizations ran security awareness training, whether they tested it with phishing simulations, and whether they had verification procedures for payments and account changes. The logic was straightforward: social engineering succeeds when people are unprepared, so an organization that trains its people and enforces verification-by-process is measurably lower risk. Documented training stopped being a nice-to-have and became evidence that the organization was actively reducing its most exploited vulnerability.

Verification by process became the control

The most effective defense against BEC and social engineering is procedural, and insurers increasingly looked for it. Organizations that required dual approval for large transfers, confirmed account changes through a separate, pre-agreed channel, and trained employees to verify before acting were in a far stronger position. These controls could not be bolted on after a claim, they had to be documented and demonstrated. In the 2021 market, the ability to show these procedures, backed by training records, became a meaningful factor in both coverage and pricing.

The lesson that outlasted the headlines

Ransomware got the attention in 2021, but social engineering was the quieter, more persistent threat, and it was not going away. The lesson for organizations was that the human layer is not a soft afterthought but a primary attack surface, and that reducing its risk requires deliberate, documented effort. Carriers understood this, and they priced it in. The organizations that invested in training, testing, and verification procedures found themselves better covered and better protected. The ones that treated the human factor as an afterthought found it increasingly expensive in every sense.