We Paid a Fake Invoice and Whether Business Insurance Will Cover the Loss

Your controller walks into your office on a Tuesday afternoon and closes the door. A vendor you have paid for six years sent an email last week with new bank details, the invoice looked right, the amount was right, and $84,000 went out by wire on Friday. This morning the real vendor called asking why they have not been paid. The money went to a criminal, and the first question out of almost every owner's mouth is the same one: will our insurance cover this?

The honest answer is that it depends on which policy you have, what endorsements are attached to it, and what you do in the next few hours. That last part is the piece most businesses get wrong, because the order of the calls you make today can decide whether the money comes back and whether a claim is paid later. This guide walks through that order in plain English, explains why your cyber policy and your crime policy may treat the same loss very differently, and covers what a carrier will ask you to prove.

One note before we start. We are not an insurance broker and we are not lawyers. We cannot tell you what your specific policy covers, and nobody can without reading it. What we can do is explain how these claims usually work, what the common gaps look like, and what evidence every carrier will want to see.

Call the Bank Before You Call Anyone Else

Insurance is the second call, not the first. The single biggest factor in whether you recover money after paying a fake invoice is how fast your bank asks the receiving bank to freeze it. Criminals move stolen funds out of the first account quickly, often within a day or two, and every hour you spend reading your policy is an hour the money has to disappear.

Call your bank's fraud line, not your branch, and ask them to initiate a recall of the wire or a reversal of the ACH payment. An ACH payment, short for Automated Clearing House, is the electronic bank transfer most businesses use for payroll and vendor payments, and it has different recall rules than a wire. Have the date, amount, receiving account number and receiving bank ready. Expect the bank to ask you to sign an indemnification document, often called a hold harmless letter, as part of the recall request, so have someone with signing authority available. We cover the full first hour in more detail in our guide on what to do after you pay a fake invoice by wire, and the ACH version in the first hour after a fraudulent ACH payment.

Then file a complaint at ic3.gov, the FBI's Internet Crime Complaint Center, regardless of the amount. The FBI's Recovery Asset Team uses those reports to contact banks and request freezes. Your carrier will almost certainly ask whether you filed, and a report filed the same day reads very differently in a claim file than one filed three weeks later.

Only once those two things are moving should you pick up the phone to your insurance broker or carrier. Doing it in this order does not hurt your claim. Doing it in the reverse order can cost you the money itself.

Your Cyber Policy and Your Crime Policy Are Not the Same Thing

This is where most owners are surprised. Many small and mid-sized businesses in McKinney, Plano and across North Texas carry a cyber insurance policy, and they assume it covers anything that involves email, hackers or computers. In practice, insurers often split the loss from a fake invoice into two very different buckets.

The first bucket is the cost of dealing with the compromise itself. If a criminal got into a mailbox, someone has to figure out how they got in, what they read, whether they set up rules to hide replies, and whether customer or employee data was exposed. That investigation, any legal advice about notifying people, and in some cases the cost of notifying them, is the kind of expense cyber policies are generally built to cover.

The second bucket is the money you sent. This is the part that matters most to your bank balance, and it is the part most likely to be excluded or limited. Many policies treat a payment that your own employee chose to send, even after being tricked, as a voluntary transfer rather than a theft. Coverage for that kind of loss usually lives in a specific add-on, often called a social engineering fraud endorsement or a funds transfer fraud endorsement, or under a separate commercial crime policy. An endorsement is simply an amendment attached to a policy that adds or changes coverage.

Those add-ons frequently carry a much lower limit than the main policy. A business can hold a cyber policy with a large headline limit and discover that the part covering a fake invoice payment is a fraction of that amount, with its own deductible. Some policies do not include the endorsement at all unless you asked for it when you bought the policy. That is why "we have cyber insurance" and "our fake invoice loss is covered" are two very different sentences.

Notify the Carrier Before You Hire Anyone or Admit Anything

Almost every cyber and crime policy has a notice requirement, meaning you must tell the carrier about a loss within a certain period of discovering it. Missing that window is one of the most common reasons claims run into trouble, and it has nothing to do with whether the underlying loss was covered.

Many cyber policies also control who you can hire. They maintain a panel, which is a pre-approved list of incident investigators and breach lawyers, and some will only reimburse the cost of firms on that list. If you hire an outside firm before telling the carrier, you may end up paying for that work yourself. The fix is simple. Notify the carrier, ask whether they have panel requirements, and ask whether they will approve the firm you want to use before work begins. Our own business email compromise response service starts many engagements on the same day a business discovers the problem, and we tell callers to notify their carrier first for exactly this reason.

The second half of this rule is about what you say. In the first hours after a loss it is natural to apologize to the vendor, promise to make them whole, or tell a client that the breach was your fault. Statements like that can complicate a claim, because many policies prohibit you from admitting liability or agreeing to a settlement without the carrier's consent. You can and should tell affected parties what happened and what you are doing about it. Leave the question of who is responsible to your counsel and your carrier until the facts are established.

That last phrase matters more than it sounds. In many fake invoice cases it is not yet clear whose mailbox was compromised. It might have been your accounts payable inbox, the vendor's billing inbox, or neither, if the criminal used a lookalike domain. Which one it was affects who carries the loss, and it can affect which policy responds. That is a technical question, and it gets answered from logs, not from assumptions.

What the Claim File Will Ask You to Prove

Carriers and their adjusters want a clean, documented story. The faster you can give them one, the faster the claim moves. In our experience the questions fall into four groups.

They will want a timeline. When did the first fraudulent email arrive, when was the payment approved, when was it sent, when did you discover the fraud, and when did you call the bank. Write this down today while memories are fresh, and keep it factual. A timeline built from email timestamps and bank records is far stronger than one built from recollection.

They will want the emails themselves, in their original form. That means the actual messages with their full technical headers, not screenshots and not forwarded copies. Headers are the hidden routing information attached to every email, and they show where a message really came from. Do not delete anything, do not clean up the inbox, and do not let anyone "fix" the mailbox before the evidence is preserved. This is where digital forensics earns its cost, because a properly preserved record of what happened in the mailbox is the document an adjuster, a bank and a lawyer will all rely on.

They will want proof of the recovery effort. That means the date and time you contacted your bank, the recall request, any hold harmless letter you signed, and your IC3 complaint number. Carriers expect you to try to reduce the loss, and showing that you moved within hours is part of the claim.

They will want to see your controls. Many social engineering endorsements require that the business had a verification procedure, such as calling a known phone number to confirm any change to a vendor's bank details. Some reduce or deny payment if that step was skipped. If your team did call back and was still fooled, document exactly how. If they did not, say so honestly and let your broker advise you on how it affects the claim.

How Much Money Is Actually at Stake

It is easy to treat this as a rare event. It is not. According to the FBI's Internet Crime Complaint Center 2025 annual report, business email compromise, the scheme where a criminal poses as a boss or vendor to redirect a payment, accounted for $3.05 billion in reported losses in 2025 across 24,768 complaints. Those are only the losses that were reported.

For a business with 20 to 100 employees, a single redirected payment can wipe out a quarter's profit. The real cost is usually larger than the payment itself. Someone has to pay the vendor who was never paid, because their invoice is still legitimately due. Your controller and owner lose days to the bank, the carrier, the lawyer and the vendor. If the mailbox that was compromised was yours, you may have to notify clients whose information was exposed, and a criminal who sat in your inbox may now be sending fake invoices to your customers in your name. That is how one bad wire becomes a reputation problem.

Insurance can soften some of that, but only the parts the policy actually covers, up to the limit it actually carries, after the deductible. That is why the response steps above matter more than the policy. A recalled wire is worth more than a paid claim, because a recalled wire has no deductible and no sub-limit.

Read Your Policy Before You Need It

If you are reading this before anything has happened, you have the best version of this problem. Pull out your cyber policy and any commercial crime policy this week and look for three things. First, look for the words social engineering, funds transfer fraud, or fraudulent instruction, and note the limit and deductible next to each one. Second, find the notice requirement and write down who you call and how fast. Third, check whether the policy names a required panel of investigators or lawyers.

Then call your broker and ask one direct question: if my bookkeeper is tricked into paying a fake invoice for $100,000 tomorrow, what does this policy pay? If the answer is vague, or the social engineering limit is far below what your business routinely wires, that is a conversation worth having at renewal rather than after a loss. Our earlier guide on what cyber insurance companies require from North Texas businesses covers the controls carriers ask about when you apply, which often overlap with the controls they check after a claim.

The most valuable control is also the cheapest. Any change to a vendor's bank details gets confirmed by calling a phone number you already had on file, never a number in the email asking for the change. Combine that with email security that flags lookalike domains and suspicious forwarding rules, and you close most of the doors these schemes walk through. Many Collin County businesses also add dark web monitoring so they learn when an employee's email password shows up for sale, which is often the first step in a mailbox takeover.

Getting Help the Same Day in McKinney and North Texas

When a fake invoice has already been paid, you need two things fast: someone to help you stop the bleeding, and someone to establish what actually happened in the mailbox so your bank, carrier and lawyer are all working from the same facts. Innovation Network Design is headquartered in McKinney and works with businesses across Allen, Plano, Frisco and the rest of DFW. We do not sell insurance and we do not give legal advice. We produce the timeline and evidence that your bank, insurer and counsel will each ask for, and we can usually start the same day.

If it has already happened, call your bank first, then your carrier, then call us at 512-518-4408 or reach us through our contact page. If it has not happened yet, take our free security assessment and find out whether your email controls would catch the next fake invoice before it is paid.

Frequently Asked Questions

Does cyber insurance cover a fake invoice payment?

Sometimes, but often only partly. Many cyber policies cover the cost of investigating a compromised mailbox while treating the money your staff chose to send as a voluntary transfer. Coverage for the payment itself usually depends on a social engineering or funds transfer fraud endorsement, or a separate crime policy, and those often carry a lower limit than the main policy.

Should I call my bank or my insurance company first after paying a fake invoice?

Call your bank first. A recall request has the best chance of working within the first hours, and nothing in a typical policy is harmed by protecting the money first. Notify your carrier the same day, before you hire any outside firm or agree to anything with the vendor.

What documents do I need for a business email compromise insurance claim?

Expect to provide a written timeline, the original fraudulent emails with full headers, your bank recall request and any hold harmless letter, your IC3 complaint number, and a description of how your team normally verifies bank detail changes. Preserve the mailbox before anyone changes or cleans it up, because that record is the evidence the claim depends on.

Can my insurance company deny a claim if we did not verify the new bank details?

It can affect the claim. Some social engineering endorsements require a callback or similar verification step before a payment change is accepted, and they may reduce or deny payment if it was skipped. Ask your broker how your policy words it, and document honestly what your team did.

Who pays if the vendor's email was hacked and not ours?

There is no automatic answer. Contracts, which mailbox was actually compromised, and who was better placed to stop the payment all play a part, and your counsel makes that call. Establishing whose mailbox was breached is a question for the logs, which is why the evidence should be preserved before anyone argues about blame.