When cyber insurance should trigger a crime coverage conversation

Cyber and crime insurance are often treated as separate products, but several loss types trigger both policies and create coverage questions. Business email compromise (BEC) / wire fraud attacks are the most common overlap: a CEO email spoofing attack that results in a fraudulent wire transfer could potentially be covered under cyber (if email compromise is included) or crime (if the loss is financial fraud). The distinction matters because cyber policies often exclude social engineering or impose very low sublimits on BEC losses, while crime policies (particularly crime policies with financial fraud coverage) may be primary for wire fraud claims. Additional overlaps include employee embezzlement via compromised accounts (is it cyber, crime, or both?), ransomware payments (cyber typically covers extortion/blackmail), and data breach costs (cyber covers breach notification and remediation; crime does not). The critical issue is policy language: a cyber policy with a social engineering exclusion will deny coverage for BEC losses, leaving the crime policy to respond. Conversely, some crime policies exclude losses involving computer fraud or hacking, creating a gap if cyber is denied. Brokers should conduct a side-by-side policy review at renewal: identify potential claims that span both policies, understand which policy is primary for each type of loss, check for exclusions that create coverage gaps, and identify sublimit issues. A wire fraud loss of $500,000 is devastating if the cyber policy has a $50,000 BEC sublimit and the crime policy has a $100,000 fraud limit—creating a $350,000 gap.