Quick Answer
Phishing insurance is the coverage that pays when an employee falls for a fake email, text, call or QR code. Cyber insurance pays for the breach: forensics, notification, restoration and lost income. Money wired to a criminal usually needs a separate social engineering or crime grant, often capped well below the main limit. Phishing is the most reported cybercrime to the FBI, so check both pieces before you need them.
Ready to check your coverage?
The Coyle Group is a commercial insurance agency that handles the complex, high-value risks other agencies don’t know how to structure, where the details in the policy are the difference between a paid claim and a denied one.
Phishing attacks are on the rise, and threaten the cybersecurity of firms large and small. The best defense against any type of cybercrime is education. Understanding the threat and having your employees understand the threat will help lessen the chances that hackers can infiltrate your network.
If you’re worried that one click or one fake invoice could drain your account, and you’re not sure which policy would pay, you’re in good company. We manage the market for you: we read your cyber and crime forms first, find where your phishing insurance falls short and then decide which insurers fit. In my experience, almost all insurance programs we review contain at least one fatal mistake.
The next step is a short, confidential call.
What does a phishing attack cost without phishing insurance?
Phishing attacks can cost a business anywhere from a few thousand dollars to millions, and without phishing insurance the money that leaves by wire is often gone for good. Business email compromise alone took almost $3.05 billion in reported losses in 2025. What surprises owners is how much of that loss no policy they own will touch.
The latest numbers:
Phishing is the most reported cybercrime.
The FBI’s 2025 Internet Crime Report logged 1,008,597 complaints and nearly $21 billion in losses, with phishing/spoofing among the most reported.
Business email compromise is the second costliest scam.
BEC took the No. 2 spot with almost $3.05 billion in losses, and wire transfers made up the bulk of that fraud.
Breaches are expensive.
The global average cost of a data breach reached $4.99 million in IBM’s 2026 report, a 12% increase over the prior year.
Volume keeps climbing.
The Anti-Phishing Working Group counted 1,003,924 phishing attacks in the first quarter of 2025 alone.
Ultimately though, your company is at risk and may become a victim of a cyber event. Whether it’s the theft of funds, theft of private information, or the total seizure of your network, the costs can be extremely high.
Do you know which of your policies would pay for a fake invoice? Contact us and we’ll tell you before it happens.
What does phishing insurance cover?
Phishing insurance is usually two coverages, not one: cyber insurance pays for the breach, and crime or social engineering coverage pays for money an employee was tricked into sending. Many owners assume one cyber policy handles both, and that gap is where the largest losses from phishing attacks land.
That’s why cyber insurance is a must today. Cyber insurance can not only respond to the immediate threat, but the consequential loss caused by infiltration, notification costs, and data remediation costs.
Here is how the two policies usually respond:
Phishing outcome |
Cyber insurance |
Crime / social engineering coverage |
|---|---|---|
|
Malware or ransomware installed |
Usually responds: forensics, restoration, business income |
Usually not the main policy |
|
Customer data exposed |
Usually responds: notification, legal, regulatory defense |
Usually doesn’t respond |
|
Employee tricked into wiring money |
Only if a social engineering grant is added, often sublimited |
Responds if the fraudulent instruction coverage is included |
|
Hacker sends a payment from your account |
Funds transfer fraud grant, if included |
Computer or funds transfer fraud, if included |
|
Employee steals money |
Usually excluded |
Employee dishonesty coverage |
Our posts on what cyber insurance covers, what crime insurance is and cyber insurance versus crime insurance go deeper.
Watch: Cyber Insurance vs. Crime Insurance: Understanding the Difference
What good phishing insurance gets you
A response team on day one.
Breach coaches, forensics and legal help.
Stolen funds replaced, up to the limit.
Only if your phishing insurance includes social engineering coverage.
Business income while systems are down.
Revenue no other policy pays.
Prevention tools.
Many cyber policies include pre-breach services that help stop phishing attacks.
I tell every client the same thing: there’s a difference between being covered and being adequately covered. One checks a box. The other protects your business.
Not sure your phishing insurance names social engineering? Book a call and we’ll check it in 15 minutes.
What is a phishing attack, in simple terms?
A phishing attack is a message that pretends to come from someone you trust so you’ll click, open, type in a password or send money. It’s a form of social engineering, which means it attacks people, not computers. The tricky part is that the most convincing phishing attacks don’t look like attacks at all.
Our guide on phishing attacks will help give you and your team a thorough understanding of the risks this threat presents to your organization. Here are some highlights:
Watch: What are Phishing Attacks and how do you prevent them?
In broad terms, hackers go on a “fishing expedition” by sending millions of emails to unsuspecting receivers hoping they will click a link, open a file, or enter private information into fraudulent websites. The result can be loss of money, credit card fraud, identity theft and more.
It doesn’t matter the size of your organization. Large and small firms are hit by these attacks daily. Hackers play the odds by sending huge volumes of emails out hoping for that click-through which will give them the opportunity to steal money or seize a network. Like baiting a hook and dropping a line in the ocean, you don’t know if you’ll catch a large fish or small one. For hackers size doesn’t really matter, it’s just the catch that matters to them because each catch can be monetized.
Hackers have upped their game and created sophisticated email schemes to trick receivers into believing that the emails are authentic and warrant them clicking through dangerous links.
The Ponemon Institute reports that human error accounted for nearly 30% of worldwide data breaches, and this tells me that cyber risk education is paramount. Read more on how human error drives data breaches. CISA puts the same point more simply today: “Most online attacks begin with a single click.”
Think your anti-virus or spam blockers will prevent an attack? Think again, most phishing messages bypass filters and anti-virus software and arrive in your employee’s inbox like hundreds of other emails every day. Cybercriminals rely on psychology and misdirection to get employees to click harmful links.
Is your team ready for the next fake email? Book a call and we’ll show you where you’re exposed.
What are the main types of phishing attacks?
The main types of phishing attacks are mass phishing, spear phishing, whaling, clone phishing, business email compromise, smishing, vishing and quishing. They all use a trusted disguise but arrive through different doors, and each door needs a slightly different defense from your team.
Here is how the common types compare:
Type |
How it reaches you |
What the criminal wants |
|---|---|---|
|
Mass phishing |
Generic email to thousands of people |
Passwords, malware installs |
|
Spear phishing |
Personal email using real names and projects |
Access to one person’s accounts |
|
Whaling |
Targeted email aimed at an owner or executive |
Big payments, sensitive data |
|
Clone phishing |
A copy of a real email you received, with the link or file swapped |
Passwords, malware installs |
|
Business email compromise (BEC) |
Spoofed or hacked email from a boss or vendor |
A wire to the criminal’s account |
|
Smishing |
Text message with a link |
Mobile logins, payment data |
|
Vishing |
Phone call or voicemail |
Passwords, MFA codes, approvals |
|
Quishing |
QR code in an email, flyer or invoice |
Logins entered on a fake site |
Watch: What is Social Engineering?
Business email compromise is the one that empties accounts
BEC is where phishing attacks turn into wire transfer fraud. The criminal gets into a real mailbox, or registers a look-alike domain, then waits. One owner told us the criminals used a domain “with only a single letter changed.” Then another said, “The actor had the actual invoice.” The request is real; only the bank account is fake.
Watch: Wire Transfer Fraud – What Is It?
Text, voice, QR and AI phishing attacks are growing fastest
Verizon’s 2026 report puts it plainly: “We’ve gotten better at spotting phishing emails, so attackers are moving to our pockets.” The FBI’s report now has an AI section too, with 22,364 complaints costing nearly $893 million. Voice clones and typo-free emails remove the old warning signs, which is why we cover phones in our post on employee training for devices.
How do you spot a phishing email?
You spot a phishing email by looking for pressure, a change and a mismatch: pressure to act fast, a change to the normal process and a sender or link that doesn’t quite match. The Cybersecurity and Infrastructure Security Agency says scams are getting harder to spot, so a short checklist beats gut feel.
Here are seven warning signs to teach every employee:
Frankly, the most dangerous phishing attacks hit none of these signs because they come from a real, hacked mailbox.
Want this checklist turned into a payment rule? Book a call and we’ll help.
Which businesses need phishing insurance most?
Every business that sends email and moves money needs phishing insurance, but criminals favor firms with fast payments, valuable data and thin IT staff. Each is targeted for a different reason, so know which door a criminal will try first at yours.
Law firms and title companies.
They wire client and closing funds.
Financial advisors and RIAs.
Client money and data; see cyber insurance for RIAs.
Medical practices.
Patient records, and doctor’s offices face notice costs.
Wholesalers, distributors and manufacturers.
Large vendor payments hide fake invoices.
Contractors.
Progress payments and many subcontractors.
Small businesses of every kind.
One person approving payments; see small business cyber insurance.
Whatever the industry, the common thread is one person who can move money without a second check.
How do you stop phishing attacks before they cost you money?
You stop phishing attacks with three layers: trained people, technical controls and a payment process that never trusts email alone. Training lowers the odds of a click. Controls limit the damage. The payment process catches the fake invoice that slips past both, and that’s the layer most businesses skip.
What’s the solution? As I mentioned, continued education and regular discussion of these threats is important. While this guide is lengthy, it’s not required to be read cover to cover. Flipping through it will engage your team, and get them to understand what to look for and how sophisticated these attacks have become. If you wish to take certain sections out and specifically send them to your team to train on phishing attack risks, you can do that as well.
Train people more than once a year
CISA warns that once-a-year training isn’t enough. Short, frequent sessions and test emails work better, and underwriters ask about them. Our cybersecurity awareness training best practices and our guide to building an effective training program lay out a schedule you can use.
Put technical controls in place
Multifactor authentication (MFA).
On email, banking and remote access.
Email authentication.
SPF, DKIM and DMARC make your domain harder to spoof.
Filtering and endpoint protection.
They stop most phishing attacks, not all.
Strong passwords.
Use a password manager.
Watch: Password Hygiene – A Lynchpin To Cyber Security
Never pay on email alone
Call back on a known number.
CISA says verify through a contact method you already have, never the one in the message.
Require two approvals.
No single person releases a large or changed payment.
Lock vendor bank changes.
Changes need a callback and a waiting period.
See how to prevent wire transfer fraud in 3 steps and our 3 cyber security risk tips.
Watch: Wire Transfer Fraud | Three Simple Steps to Preventing Digital Frauds
Want a second set of eyes on your payment process? Book a call and we’ll review it with you.
What should you do in the first hour after someone clicks?
In the first hour, contain the account, call the bank if money moved, then report to the FBI and your insurer. Speed matters most when a wire went out, because funds move fast. Order matters too: a late notice to your insurer can create its own problem with the claim.
Signs you’ve already been phished
Surprise resets.
Password reset emails you didn’t request.
Ghost activity.
Sent messages or new mailbox rules you didn’t create.
Confused contacts.
People asking about an email you never sent.
Strange logins.
Sign-ins from places or devices you don’t recognize.
The first-hour response, in order
Follow this order:
Never pay a ransom or a “recovery service” on your own. Phishing is a common way ransomware gets in; let your policy’s response team guide any decision.
Already dealing with a click or a bad wire? Contact us today and we’ll help you sort out the claim.
How much does phishing insurance cost?
Most small and mid-sized businesses pay roughly $500 to $5,000 a year for the cyber insurance at the core of phishing insurance, and adding real social engineering limits costs more. The price depends on your revenue, industry, controls and the limits you pick. The bigger question is usually how low the hidden sublimit is.
Typical costs and limits:
Coverage piece |
Typical range |
Source |
|---|---|---|
|
Standalone cyber policy, small business |
$500 to $5,000 a year |
|
|
Standalone cyber, our M&A advisory client |
$1,300 a year (replaced a $280 endorsement) |
Coyle case study |
|
Cyber endorsement on a package policy |
Often only $10,000 to $25,000 of coverage |
Coyle review experience |
|
Crime sublimit inside a package policy |
About $10,000 to $25,000, usually inadequate |
Coyle review experience |
|
Social engineering sublimit in a cyber policy |
Most cap it at $250,000 or less |
Price drivers: revenue, payment volume, records held, industry, controls, limits and loss history. For a rough start, try our cyber insurance cost calculator, then read how much cyber insurance to buy.
Watch: Your Cyber Insurance Policy Won’t Cover Social Engineering Fraud (Here’s Why)
What underwriters check before they offer phishing insurance
Factors underwriters check before quoting social engineering coverage:
Factor |
Why underwriters care |
What to have ready |
|---|---|---|
|
Payment verification process |
It’s the main defense against fake wire instructions |
A written callback and dual-approval procedure |
|
MFA on email and banking |
Stolen passwords drive account takeover |
Proof MFA is on for all users |
|
Training frequency |
Trained staff click less |
Training dates and test-email results |
|
Wire volume and size |
Bigger, frequent wires mean bigger losses |
Typical monthly wire count and largest wire |
|
Prior losses |
Past fraud predicts future fraud |
Details of any incident and what changed |
If you’ve held off on buying cyber, for whatever reason, I believe now is the time to make the decision to purchase protection. The threats continue to escalate, the potential for loss is very significant, and the cost of coverage is relatively low. In fact, obtaining coverage has never been easier.
Wondering what your phishing insurance would pay after a fake invoice? Contact us and we’ll review it for you.
What can go wrong with phishing insurance?
The biggest problems are low sublimits, missing social engineering grants and conditions that void the claim if you skipped a verification step. They hide in the fine print, and most owners find them only after the money is already gone.
Common exclusions and gotchas:
Voluntary parting.
Many policies exclude money an employee “voluntarily” sent, even when tricked.
Verification conditions.
Skip a required callback and the claim can be denied.
Sublimits.
A $1 million cyber policy may carry a far smaller social engineering limit.
Endorsements posing as policies.
A small add-on isn’t a standalone cyber policy.
Late notice.
Even a few weeks of delay can hurt the claim.
Real-world example: the $400,000 wire fraud loss the insurer wouldn’t pay.
In my video on law firm wire fraud, I talked about a firm that lost $400,000, and their insurance company was denying the claim because they failed to follow required authentication procedures. Still, the coverage existed. However, the firm’s own process broke the condition. That’s why I read conditions as closely as limits, and why our post on why cyber insurance isn’t paying out matters.
Watch: Law Firm Wire Fraud: 4 Cyber Insurance Gaps That Cost Thousands
Red flags your phishing insurance is wrong
“Cyber” is a small, third-party-only endorsement.
I call this the Cyber Coverage Mirage; we found a $50,000 one at an M&A advisory firm.
Social engineering isn’t on the declarations page.
If it’s not named, assume your phishing insurance won’t pay for a tricked wire.
The crime sublimit is about $25,000.
That won’t cover one fake invoice for most firms.
Nobody walked you through the verification conditions.
You can’t follow a rule you don’t know.
Your limits stayed flat while your wires grew.
Old limits rarely fit today’s payments.
For more real cases, see our cyber insurance claims examples.
Spot one of these red flags in your policy? Book a call and we’ll walk through it together.
How do you evaluate your own exposure to phishing attacks?
Start with three questions: who can move money, how a payment change gets verified and which policy names social engineering. If any answer is “I’m not sure,” you’ve found your gap. In my experience, gaps around phishing attacks are among the most common flaws in a program review.
Map the money.
List who can release a wire or change vendor details.
Test the process.
Ask your team how they’d handle an urgent bank-change email.
Read the declarations.
Check that your phishing insurance lists social engineering and funds transfer fraud limits.
Score your controls.
Our cyber risk scorecard is a simple start.
Why work with The Coyle Group on phishing insurance?
We look at your phishing exposure, your payment process and your cyber and crime forms together, then place phishing insurance that matches how you actually move money. I hold the CPCU and ARM designations, and cyber and technology risk is one of our core areas.
The Coyle Process
95% of our clients stay with us, and we return calls and emails within one business day.
Diagnose the risk.
Who moves money, how often and how it’s verified.
Identify the right insurers.
Ones whose cyber and crime forms fit your operation.
Explain where we’re going and why.
Before we approach anyone.
Bring viable options back for comparison.
Limits, sublimits and conditions side by side.
The benefit is fewer applications, fewer duplicate requests and one point of contact.
About shopping your coverage
Comparing options is smart. Indiscriminate shopping isn’t. Several brokers mean duplicate applications, the same insurers approached more than once and a generalist who may misclassify your risk. You don’t need five brokers shopping your insurance. You need one capable broker making sure the right insurers compete for your business.
Who this isn’t right for
First, we only handle business insurance. Also, if you want someone to rubber-stamp what you have at a lower price, there are brokers who will do that, and we’re not one of them. We also won’t copy a program that leaves social engineering uncovered and call it fine. And if you’re a very small business with a simple risk, a basic cyber policy may serve you well, and I’ll tell you so.
Your next step: a 15-minute call, not an application
If you have coverage today.
A confidential review of your phishing insurance: cyber and crime forms, exclusions and conditions.
If you need new coverage.
We build the underwriting picture first, then identify which insurers fit.
Don’t sign a policy you don’t fully understand. Book a call and let’s have a conversation.
Frequently Asked Questions
Author’s Expertise
This article was written by the CEO of The Coyle Group, Gordon B. Coyle, CPCU, ARM, AMIM, PWCA, who has over 40 years of experience working with business owners of all sizes and industries across the US, solving their insurance challenges.
