Skip to main content
Marsh logo

Article

Commercial crime insurance: An “all risks” approach helps protect against emerging fraud risk

Fraud against organisations is becoming progressively more sophisticated, increasing the likelihood and potential value of a loss. Commercial crime insurance provides balance sheet protection to complement in-house fraud mitigation strategies, not only protecting organisations but also management from repercussions and blame following a large-scale fraud.

14/03/2025 · 6 minute read

Fraud against organisations is becoming progressively more sophisticated, increasing the likelihood and potential value of a loss. Commercial crime insurance provides balance sheet protection to complement in-house fraud mitigation strategies, not only protecting organisations but also management from repercussions and blame following a large-scale fraud. 

What a commercial crime insurance policy should cover

A well-written commercial crime insurance policy should cover direct financial loss — that is, money actually stolen — from the following crimes.

Employee white-collar fraud

Most crimes against organisations are perpetrated by long-standing and trusted employees, often in management positions where they operate with little oversight. Marsh data suggests approximately 50% of crime policy notifications are for employee fidelity losses. Examples include payment diversion, where the fraudster sends monies to a fraudulently created supplier over many years, keeping payments low enough to avoid detection via internal controls such as dual sign-off. An organisation’s trust in their employees can create opportunities that can be abused, particularly in times of economic hardship.

Third-party fraud

This category includes any individual who is not an employee committing a fraud against the organisation. Social engineering and similar losses are considered separately below. Examples include the employee of a third party, with whom you frequently trade, fraudulently changing bank details on an invoice to direct monies to a dummy company from which they can personally benefit.

Collusion

Collusion can occur between employees and third parties or between staff members. When managers and employees collude, it becomes more difficult to uncover the crime, as it undermines the segregation of duties. In such cases, employees may be able to avoid detection by even the best internal controls. The longer the fraud remains undetected, the greater the potential losses.

Hacking or computer-related crime

While crime policies usually exclude ransomware attacks — where hackers threaten to divulge personal or confidential information, or to introduce malicious code, if the subject doesn’t pay a ransom — most will cover funds stolen by cyber criminals “breaking in” to an organisation’s computer systems to commit a theft. This could be via phishing attacks or the use of hacking tools or surveillance. While a cyber insurance policy will cover many of the costs associated with dealing with the impact of a cyberattack, such as business interruption costs or regulatory investigations, only a crime policy will pay the amount stolen by the cybercriminals — that is, the direct financial loss. 

Social engineering fraud

Social engineering covers deception frauds where the criminal impersonates someone, such as a senior director, and requests the transfer of funds for a “confidential and urgent” transaction. This could be done via email or over the phone, or even by video call. These deceptions have become increasingly convincing through the use of AI to replicate the voices or even faces of the senior team, often referred to as “deepfake fraud”.

Tangible asset theft

Crime policies also cover “old fashioned” theft of valuable property, including safes or vaults and their contents, such as cash. Additionally, separate specie policies are available that cover valuable items such as fine art, jewelry, and gold bullion.

Fraud can lead to reputational damage and regulatory risk

In addition to the financial loss caused by fraud, there are other consequential losses to consider. 

There is reputational damage if the fraud becomes public. This could impact the willingness of clients or suppliers to do business with an organisation perceived to have poor internal controls.

There is also the possibility of regulatory action following a fraud. This could result in unlimited fines against the organisation if it benefits from the fraud — even if that was not the main purpose of the deception — and it has not taken reasonable steps to prevent the fraud. This new failure to prevent fraud offence was introduced by the Economic Crime and Corporate Transparency Act 2023 (ECCTA) and is discussed here.  

The Economic Crime and Corporate Transparency Act 2023 strengthens the powers of law enforcement agencies to investigate and prosecute economic crimes. Similarly, the UK Corporate Governance Code 2024 places a strong and increased emphasis on risk management and fraud prevention. While commercial crime insurance does not replace obligations contained within these Acts, it complements many of their objectives, as procuring crime insurance forms part of an effective risk management strategy.

There can be significant repercussions for directors if a large-scale fraud is committed under their watch. For example, an aerospace manufacturer suffered a cyber fraud in which hackers stole around €50 million by posing as the CEO in an email. The organisation sacked the CFO and the CEO, as well as the employee who fell for the fraud, and sued the CEO and CFO for not doing enough to protect the business against cyber fraud. While their suit was dismissed, it shows that directors must take cybersecurity and fraud seriously and take steps to mitigate potential losses.

How to ensure your crime insurance policy covers new risk

A well-drafted crime insurance policy will respond to an incident of fraud by paying out the direct financial loss resulting from it — that is, the funds actually stolen — up to the limit purchased. Marsh’s policy wordings, for example, do not specify particular methods of fraud. Instead, they seek to adopt an “all risks” approach to cover. This is advantageous because prescriptive policies often fail to keep up with new and emerging exposures, such as social engineering, including deepfake fraud. Marsh’s flagship Delta Crime policy is designed to cover these exposures through broad insuring triggers and no exclusions in relation to “voluntary exchange” or “social engineering,” which sometimes feature in market standard wordings. ​​

Why now may be a good time to buy crime insurance or renegotiate existing cover

As management liability insurers have sought to expand their book of business in recent years, capacity and appetite has broadened in the London market. This a good time to consider buying crime cover for the first time, or increasing existing limits, reducing retentions, or broadening cover on existing programmes. Speak to your Marsh broker to discuss what options might be available.

Next steps: take a holistic approach to emerging fraud risk

Risk transfer through insurance should be used as the final safeguard against fraud risk. Organisations should also consider fraud risk mitigation services, such as those provided by specialists in Marsh Advisory, to help them understand their fraud risk, close gaps that fraudsters could exploit, and become more resilient to these new threats.​

For more information on crime insurance and fraud risk mitigation, contact your Marsh advisor.

Marsh commercial crime insurance solutions

Marsh supports clients seeking protection against financial losses due to fraud.

Click to learn more

Our people

Zelda Pitman

Zelda Pitman

Senior Client Executive, Management Liability

  • United Kingdom

Placeholder Image

Gavin Farrow

Placement Specialist, Norwich Retail team, Management Liability

  • United Kingdom

Placeholder Image

Jessica Luff

London Retail Placement Broker, Management Liability

  • United Kingdom

Related insights

Young businesswoman and her diverse team brainstorming with sticky notes on a glass wall while working together in a modern office

Article

Impact of identification doctrine reforms on D&O insurance

17/06/2024