You receive an urgent email from the CEO requesting a payment be processed before the end of the day. The email looks genuine, the writing style appears familiar, the address is correct and relevant supporting documentation is attached. You know the CEO has been flat out on a new project and has a lot on her plate, so it’s not unusual for this to be left to the last minute. You process the payment as requested and update the CEO via email.
The only issue is that the CEO never sent the email.
AI-enabled fraud – why it’s changing the game
Social engineering fraud is not new. However, the use of artificial intelligence (AI) to perpetrate that fraud at speed and scale, combined with rapid advances in technology is making these frauds more convincing and increasingly difficult to identify. It allows for the creation of realistic emails, fabricated documents, cloned voices/deepfakes or synthetic identities at little to no cost or time investment. AI is enabling perpetrators to replicate legitimacy with an unprecedented degree of sophistication.
A social engineering type fraud usually involves one or a combination of the following methodologies:
- Business email compromise
- Payment diversions
- Supplier impersonations
- Identity theft
- Forged documents
AI increasingly allows perpetrators to more easily exploit one of the most fundamental elements of business – Trust.
What does this mean for Insurance?
A social engineering loss should not be assumed to fall automatically within a cyber policy. Depending on the wording and facts, potentially relevant cover may sit within a cyber policy, a crime policy, a management liability crime section, a professional indemnity policy or possibly a specific social engineering extension attached to any of these policies. The existence of several potentially relevant policy classes can create both overlaps and gaps.
The coverage analysis commonly turns on the following questions:
- What property was lost: the insured’s money, a third party’s money, goods, data or another asset?
- Who was deceived: an employee of the insured, a bank, a customer, a supplier or another third party?
- Was there unauthorised access to a computer system or did the fraud succeed without a system breach?
- Was the transfer made voluntarily by an authorised employee, even though the instruction was fraudulent?
- Does the wording distinguish between computer fraud, funds transfer fraud, phishing, impersonation and social engineering?
- Is the cover part of the main limit or subject to a separate sub-limit, deductible, aggregate or territorial restriction?
- Were specified verification, call-back, segregation-of-duties or multi-factor approval procedures required and followed?
Some policies offer social engineering or cyber fraud only as optional cover and apply a lower sub-limit than the overall policy limit. Some newer policies specifically recognise AI or deepfake-enabled events.
The Claims Challenge
AI-enabled social engineering can create evidentiary problems as well as coverage problems. Email incidents may leave message headers, mailbox rules, login records and transaction data. Voice or video impersonation however, may leave a more limited documentary trail.
A well-supported claim should establish a clear chronology from the first contact to discovery and response. Relevant material may include:
- The original email files and headers, rather than screenshots alone
- Invoices, change-of-bank forms and versions of supporting documents
- Telephone records, meeting invitations, chat logs and recordings where lawfully available
- Payment approvals, bank confirmations and bank statements
- Identity and access logs, mailbox forwarding rules and multi-factor authentication records
- The organisation’s written payment and verification procedures, together with evidence showing how they were applied
- Communications with the bank, broker, insurer, police and any other relevant party.
Investigators can assist by tracing the movement and quantifying funds, distinguishing direct loss from consequential losses, assessing the claimed loss against policy definitions and sub-limits and presenting the evidence in a coherent way for Insurers. Early coordination with legal, cyber, insurance and banking advisers is important so that recovery opportunities are pursued without compromising evidence or policy rights.
From recognition to verification
Traditional awareness training remains useful, but it cannot be the principal control when fraudulent communication is designed to look genuine. The stronger approach is to ensure robust verification procedures when dealing with high-risk transactions. The mindset needs to change from:
Practical measures include:
- Independently calling a known contact using a number already held in trusted records, not the number supplied in the request
- Prohibiting bank-detail changes from being approved solely by email
- Requiring dual approval for new payees, changing or updating bank details and unusual or urgent payments
- using multi-factor authentication and restricting privileged access to email and finance systems
- documenting the verification performed e.g. by whom, when and through which independent channel
- allow staff to pause, question and escalate a request even where it appears to come from a senior executive without fear of repercussion.
The control needs to work in practice. A written procedure that is unknown, inconsistently followed or impossible to evidence may provide little protection in a claim. Controls should be tested against realistic scenarios including a compromised supplier mailbox, an urgent executive request and a voice and/or video impersonation.
Example: a new bowling green loses bowls club $120,000
In 2023, Victoria’s Upwey-Tecoma Bowls Club lost more than $120,000 after falling victim to a Business Email Compromise (BEC) scam when making the final payment for flood-recovery works. The club believed it was paying a legitimate contractor using details provided in an email that showed no obvious signs of fraud.
The payment was later found to have been directed to a fraudulent bank account after cybercriminals allegedly intercepted communications and issued a near-identical invoice with amended banking details. The contractor, project and invoice all appeared genuine. Only the bank account had changed.
Despite engaging its bank, forensic IT specialists and relevant authorities, the club reported that the funds were unrecoverable.
Cybercriminals can compromise systems without knowledge and monitor email exchanges for long periods to learn communication styles, key contacts, and timing opportunities. This allows them to intercept and send emails that impersonate real business contacts and make fraudulent alterations or requests almost impossible to identify.
When an incident occurs
Speed is critical. The business should contact its financial institution immediately, preserve all physical and electronic evidence and notify police and its broker or insurer as a matter of priority. It should avoid deleting or altering affected accounts or appointing advisers without first considering any consent requirements. Suspected business email compromise should also be reported through the appropriate law-enforcement and cyber-reporting channels such as ACSC, ASIC, and/or AFP.
Conclusion
AI has not changed the fundamental nature of social engineering fraud. It has simply changed the tools available to perpetrators. Businesses that fail to adapt to the ever-changing environment and continue to rely solely on staff to recognise suspicious behaviour may find themselves falling victim, unable to distinguish fraudulent communications from legitimate ones.
Businesses should look to shift their mindset from trust to verify. A shift from asking, “Does this look fraudulent?” to asking, “What independent evidence confirms that this is genuine?”. Strong verification controls reduce the likelihood of loss. Just as importantly, documented and consistently applied controls place businesses in a stronger position when coverage, liability and quantum are examined after an incident.
