Can a Deepfake Phone Call Trigger a Cyber Insurance Claim?

The call sounds exactly like the managing partner: same voice, same impatience, a closing that has to fund today and a new account number for the wire. The employee sends it. Hours later, the real partner walks in and knows nothing about it. Whether insurance pays for that money depends far less on the technology used to fake the voice than on how the policy describes payments the business was tricked into making. Many business owners find that out only after the wire has cleared.

How voice cloning shows up in payment fraud

The FBI's Internet Crime Complaint Center warned in a December 2024 public service announcement that criminals use generative AI to make fraud more convincing. Its examples included AI-generated audio, which the bureau calls vocal cloning, used to impersonate public figures or relatives and to gain access to bank accounts by imitating account holders. It also described fraudsters using AI-generated video in real-time chats that appear to show company executives or other authority figures.

In a business setting the pattern tends to be familiar even when the voice is new: an urgent request from someone senior, a reason the normal process has to be skipped, a changed bank account and pressure to keep it quiet. The deepfake does not replace the old social engineering playbook. It removes the one check many employees relied on, which was recognizing the caller's voice.

Why the payment itself is the hard part of the claim

Insurance policies draw a line between money taken from a business and money a business sent because it was deceived. That line often decides how a deepfake claim turns out.

• If an attacker breaks into your systems or your bank account and moves money without anyone at the company authorizing it, that looks like classic computer or funds transfer fraud.
• If an employee, believing the call, logs in and sends the wire personally, the transfer was authorized by the business. Coverage built only for unauthorized transfers may not respond; the standard crime wording for funds transfer fraud, for example, refers to instructions issued without the business's knowledge or consent.

A deepfake call almost always produces the second situation. So the question is whether the policy includes coverage written for deception-driven payments, often labeled social engineering, fraudulent instruction or impersonation coverage.

Which policy sections might respond

Depending on how a program is built, one or more of these could be in play:

• Social engineering coverage in a cyber policy. Many cyber policies offer it, often by endorsement and often with a sublimit well below the main policy limit.
• Impersonation coverage in a crime policy. Newer standard crime forms include an insuring agreement for payments made in good faith on instructions from someone posing as a vendor, customer or authorized person.
• Funds transfer or computer fraud coverage. Relevant if the attacker also compromised email, phones or bank credentials to make the scheme work.
• Incident response costs under a cyber policy. If the fraud started with a breach, such as a hijacked mailbox used to learn about the deal, forensic and response costs may be covered even where the stolen funds are not.

The order and overlap matter. When a business carries both cyber and crime insurance, confirm in advance which policy is meant to be primary for a social engineering loss and how the sublimits relate.

Definitions written for email may not fit a phone call

Much social engineering wording was drafted when the typical scam was a spoofed email. Read the definitions closely. Some describe a fraudulent instruction delivered electronically or in writing, and a live phone call or video meeting may or may not fit the language. Others define the impersonated person narrowly, for example as an employee, vendor or client, which can matter when the fake caller claims to be a lender, a title agent or a government official.

Ask the insurer, in writing, whether a fraudulent instruction delivered by telephone, voicemail or video call is covered, and whether an impersonated executive, outside professional or business partner falls within the definition.

Verification conditions insurers expect

Social engineering coverage often comes with conditions. Some policies require the business to verify a payment instruction or a bank detail change by calling back a phone number already on file, not one supplied in the request. If the employee skipped the call-back, the claim may be reduced or denied under that condition even though the business was plainly defrauded.

The FBI's advice to the public lines up with what insurers look for: hang up, independently find the organization's contact information and call that number directly, and be wary of urgent requests for money from people you know only by phone or online. For families, it also suggests agreeing a secret word or phrase to confirm identity. Businesses can adapt that idea for executives who approve large payments.

Habits that help prevent the loss and support the claim

• Require call-back verification to a known number for every new payee or changed bank account, with no exceptions for urgency.
• Use two-person approval for wires above a set amount.
• Agree a code phrase or out-of-band confirmation step for executive payment requests.
• Train staff that a familiar voice is no longer proof of identity.
• Document each verification step, because the insurer may ask for evidence it happened.

Firms that move client money are frequent targets. Real estate professionals are one example, and the Florida real estate cyber insurance page covers the wire-fraud exposures that come with closings.

What to do if a deepfake payment goes out

Call your bank immediately and ask it to try to stop or recall the transfer. Report the incident to the FBI's Internet Crime Complaint Center at ic3.gov; the bureau asks victims to include identifying details about the people involved and the transaction, including dates, amounts, account numbers and the receiving institution. Then notify your insurer promptly under every policy that might apply, and keep call logs, voicemails, emails and approval records together for the claim.

Frequently asked questions

Is a deepfake phone call considered a cyberattack under my policy?

Not necessarily. Many policies treat a scam that persuades an employee to pay as social engineering, which is often a separate, sublimited coverage, rather than as a network security event. The policy's definitions decide which bucket the loss falls into.

Does it matter that the attacker never touched our computers?

It can. Coverage aimed at unauthorized transfers or system intrusions may not respond when an employee made the payment voluntarily. Deception-based coverage is the more likely route, if the policy has it.

Would a crime policy cover this instead of a cyber policy?

Possibly. Newer standard crime forms include an impersonation agreement for good-faith payments made on fraudulent instructions. Whether yours does, and at what limit, depends on the edition and endorsements.

Will reporting to the FBI hurt the insurance claim?

Reporting is what the FBI asks victims to do, and it creates a record of the event. Notify the insurer as well, because policies set their own notice requirements that a law enforcement report does not satisfy.

What Truscott recommends

Read your cyber and crime policies side by side with one scenario in mind: an employee who sends a wire because a convincing voice told them to. A Truscott coverage review checks whether that loss has a home, how the social engineering sublimit compares with the size of your typical payments, and which verification steps the policy requires. Start with the cyber insurance overview, or see how coverage works for Florida businesses in your industry.