Crime insurance schemes: employee fraud and invoice fraud

In short. The claims examples published by insurers show that the greatest crime risk is not a technical attack but trust, the concentration of roles in one person's hands and the pressure to act quickly. Crime insurance typically indemnifies the sums directly embezzled or paid to the fraudster and part of the investigation costs; reputational harm, management time and business disruption are as a rule borne by the policyholder.¹ The examples are generalised and the policyholders anonymous; they are the author's summaries of claims examples published by insurers and service providers and should be read as illustrative scenarios of how a crime policy may respond, not as verified reports of particular payments.

A. Insurers' published examples of employee fraud

1. A fictitious vendor created by the IT manager

The IT manager of an international manufacturing company had broad rights both in the procurement system and in the accounting software. He created a credible vendor profile, supposedly for a supplier of software and maintenance, submitted invoices in its name and approved them himself. The loss exceeded USD 2 million. Uncovering it required external forensic accounting. According to the insurer's claims example, the employee theft cover paid the sums paid out on the false invoices and a significant part of the forensic costs.²

Lesson. Administrator "super-user" rights in the procurement system and in payments are a classic precondition for employee fraud. Segregation of duties and periodic review of elevated rights are expected both by internal control and by the insurer.

2. Long-running embezzlement by a bookkeeper

A company's bookkeeper controlled payments to vendors and to employees as well as the general ledger entries. Fictitious vendors were created and money was diverted to accounts under the bookkeeper's control, with the payments concealed through reclassifications between accounts. The fraud came to light when the bookkeeper was on holiday and the stand-in noticed discrepancies. For such a loss, employee dishonesty cover as a rule pays the embezzled sums and, to the extent provided in the policy, the investigation costs, but not the reputational harm or the disruption to operations.

Lesson. Mandatory leave and rotation of duties are simple and effective controls. Concentration of roles is particularly common in small and medium-sized companies.

3. A Ponzi-like scheme at a property management company

The finance manager of a property management company began temporarily covering the expenses of one homeowners' association with the money of another. The practice became systematic: new receipts were used to plug old holes. In the insurer's claims scenario the associations lost more than USD 1 million.³ For such a loss, employee dishonesty cover as a rule pays the embezzled sums and, to the extent provided in the policy, the costs of reconstructing the accounts and of the investigation, but not interest, contractual penalties or reputational harm.

Lesson. A management company that holds clients' money must also insure client property and keep client funds segregated.

4. Collusive embezzlement by two bank employees

A European bank applied dual control: one person initiates a payment and another approves it. Two employees acted in concert and transferred small amounts from customer accounts to the accounts of third parties, staying below the automated alert thresholds. According to the insurer's claims example, the crime insurance paid the direct loss and a significant part of the forensic audit; reputational harm and a possible regulatory fine remained uncovered.⁴

Lesson. The four-eyes principle does not protect against collusion. The policy must cover fraud committed by several employees acting together.

5. A fake bank call and a stolen authentication code

In the insurer's claims example, a fraudster posing as the company's bank called the chief financial officer, warned of possible fraud and talked the CFO into resetting the password through a link the fraudster supplied. The CFO unknowingly handed over the account credentials and a multi-factor authentication code, after which the fraudster drained the account; the loss exceeded one million dollars. The loss was paid under the funds transfer fraud cover, which responds to unreimbursed fraudulent electronic transfers; nothing could be recovered from the bank.⁵

Unlike the situation in example 7, no employee of the company issued the payment instruction here: the transfers were made by the fraudster with the stolen credentials. This often decides whether a loss falls within funds transfer fraud cover or requires a separate fraudulent instruction extension.⁶

6. Theft of client funds and the limits of professional indemnity insurance

For years the finance director of a UK professional services firm embezzled client money. The clients brought claims. The professional indemnity insurance paid part of the loss, but a critical gap emerged: the firm had no crime insurance, which would have covered the direct loss resulting from the employee's dishonest conduct.⁷

Lesson. Professional indemnity insurance does not replace crime insurance. Auditors, law firms, accounting firms and asset managers need both. See Professional indemnity insurance and claims in Estonia.

B. Insurers' published examples of fraudulent payment instructions

7. Takeover of a supplier's e-mail

Fraudsters take over a supplier's e-mail account, or register an almost identical domain, and send a routine invoice with new bank details. The correspondence looks genuine: earlier invoices, the usual style, the right people. Case law and commentary explain that traditional computer fraud or funds transfer fraud cover may not respond to such a loss: the bank carried out an instruction given by the insured's own employee, the employee approved the payment and no computer system was breached. In 2017, for example, an Alberta court dismissed the insured's claim under funds transfer fraud cover because the payment instruction had been given to the bank by the insured's own employee, so that the transfer was made with the insured's consent.⁶ A separate fraudulent instruction (social engineering fraud) extension is therefore offered.⁸

8. An urgent instruction in the chief executive's name

An accountant received a telephone call and e-mails from a person posing as the chief executive, who demanded a confidential transfer in connection with an acquisition. The bank refused to reimburse the loss because the transaction had been executed on a correctly given instruction. Such a loss falls under fraudulent instruction cover, which insurers usually tie to stricter procedures for the future: a call-back and double approval of urgent payments.

Lesson. Fraudulent instruction cover is designed precisely for cases in which an employee makes a formally "authorised" payment under the influence of fraud. The cover usually carries a sub-limit and is tied to a call-back requirement.

C. Fraud schemes common in Estonia

The schemes below are generalisations drawn from the public warnings of the Information System Authority (Riigi Infosüsteemi Amet, RIA) and from public criminal cases; they do not describe the case of any particular company.⁹

Under criminal law such acts may constitute embezzlement, fraud or computer-related fraud (Penal Code (karistusseadustik, KarS) §§ 201, 209, 213).¹⁰ Whether there is an insured event is nevertheless determined by the insurance contract.

D. What the examples show together

1. Crime insurance is the last line of defence once internal controls have failed. It does not replace controls; it presupposes them.
2. Concentration of roles is the main precondition for employee fraud. A small company has to compensate for the small number of people in its roles through management oversight and technical restrictions.
3. Indirect loss often remains uncovered. Reputational harm, management time, contractual penalties and interest have to be budgeted as the company's own retained loss.
4. Client property needs separate cover. If the company holds clients' money, this must be clearly agreed in the policy.
5. Fraudulent instruction cover and its sub-limit are often the only cover that responds to invoice fraud and CEO fraud.

E. Preventive controls by scheme

Insurers ask about these controls in the proposal form and often make them a condition of cover. Whether the controls actually work is therefore a question both of loss prevention and of insurance cover.

Related pages

• Crime and fidelity claims in Estonia
• Crime insurance court cases
• Simulatsioonid (in Estonian): simulations, including an invoice fraud chain
• Esimesed 72 tundi (in Estonian): what to do in the first 72 hours after a loss

References