Commercial Insurance · California
Commercial crime insurance, for the losses your own people cause.
Every other policy on a California program covers what outsiders and accidents do to you. Crime is the one that covers what somebody with a login and a reason does.
At a glance
The gap
Employee dishonesty is excluded on everything else
Commercial crime insurance covers loss of money, securities and property caused by dishonesty rather than by a peril. The main insuring agreements are employee theft, forgery, funds transfer fraud, computer fraud and social engineering. Property and general liability both exclude employee dishonesty, and cyber liability usually answers the data breach rather than the money that left the account, which is why social engineering cover has to be checked on both policies.
Read the exclusions on your commercial property policy. Dishonest acts by your own employees are on the list. Read general liability: it covers bodily injury and property damage caused to others, not money that walks out of your own accounts. So the exposure that most reliably damages a mid-sized company sits outside both.
Crime coverage exists to fill exactly that hole. It is written as a set of insuring agreements rather than one blanket promise, and you buy the ones that match how money actually moves through your business.
A one-person business has no employee dishonesty exposure and no accounts payable clerk to impersonate. The moment you have people handling money, approving invoices or holding customer funds, you have the exposure this policy was built for.
Coverage detail
The agreements, and which ones you need
| Insuring agreement | What it answers | Who needs it |
|---|---|---|
| Employee theft | Money, securities or property taken by your own staff | Everyone with employees |
| Forgery or alteration | Forged checks and altered instruments drawn on you | Anyone still writing checks |
| Inside the premises | Money and securities taken from your office or safe | Cash-handling operations |
| Outside the premises | Loss in transit or in a messenger’s custody | Anyone banking cash |
| Computer fraud | Property taken by a fraudulent entry into your systems | Everyone |
| Funds transfer fraud | A fraudulent instruction to your bank to transfer funds | Everyone with wire capability |
| Social engineering | You were tricked into sending the money yourself | Everyone. Usually the real claim |
| Clients’ property | Theft by your employee from a customer’s premises | Service and trade businesses |
Coverage positions reflect standard market forms. Specific terms vary by carrier and endorsement. Refer to the issued policy.
Social engineering is the one to read twice
Funds transfer fraud covers a criminal instructing your bank. Social engineering covers your own employee being deceived into making the payment. Those are different clauses, and the second is the one that actually happens. It is almost always written at a sublimit well below the policy limit, and it usually carries a callback verification condition. If your team does not verify payment changes by phone to a previously known number, read that condition before you rely on the cover.
Where it overlaps cyber
Two policies, one loss
A fraudulent payment usually starts with a compromised mailbox. That means two policies are in the frame, and how they interact decides whether you are paid once, twice or not at all.
The practical answer is to place both with the overlap deliberate rather than accidental, and to know before a loss which policy is intended to respond first. See cyber liability insurance for the other half of this.
Program fit
Where crime sits in the program
Commercial crime is usually written inside a commercial package policy, which is one of the reasons the package matters: a business owner’s policy typically offers employee dishonesty only at a token sublimit, if at all.
- Commercial property, which excludes employee dishonesty
- General liability, which covers injury and third-party damage, not your own money
- Cyber liability, for the breach that usually precedes the fraud
- Directors and officers liability, where the question becomes who allowed it to happen
Common questions
What buyers ask before they buy
Does my property policy cover employee theft?
No. Dishonest acts by your own employees are a standard exclusion on commercial property. Commercial crime insurance exists specifically to cover what that exclusion removes.
What is the difference between funds transfer fraud and social engineering?
Funds transfer fraud is a criminal instructing your bank without your involvement. Social engineering is your own employee being deceived into making the payment. The second is what usually happens and it is a separate clause, normally at a lower sublimit.
Does cyber liability already cover a fraudulent wire?
Sometimes, at a small sublimit. Cyber is built around the data breach: response, notification and liability. The money that left the account is a crime policy exposure. Place both and make the overlap deliberate.
Do I need crime cover if my business owner’s policy includes employee dishonesty?
A business owner’s policy typically offers it at a token sublimit, often $5,000 to $25,000, which is not a real limit for a company with a finance team. That is one of the reasons to move to a commercial package.
What conditions does social engineering coverage carry?
Most carriers require verification of any change to payment instructions by telephone to a number you already held, not a number in the request. Failing that condition is the most common reason a social engineering claim is declined.
Does crime insurance cover a customer’s property my employee stole?
Under the clients’ property insuring agreement, yes. It is not automatic on every form, so it has to be selected if your people work inside customer premises.
How we put this page together
Coverage positions reflect standard commercial crime insuring agreements as written in the California market rather than any single carrier’s program. Sublimits and the verification conditions attaching to social engineering coverage vary materially between carriers and must be read on the issued policy. Written and kept current by the Golden Benchmark team and reviewed by Emmi Ensign, a licensed California insurance broker with 38 years placing commercial insurance for California businesses.
Next step
Have your social engineering sublimit and conditions read
Send your declarations pages for both your crime and your cyber policy. A named California broker reads which one is meant to respond to a fraudulent payment, at what limit, and what verification condition attaches. No call center.
A licensed broker reviews every submission. Already have your paperwork? Upload your declarations pages with a program review request.
Reviewed by Emmi Ensign, a licensed California broker at Golden Benchmark Insurance Services (agency CA License 0D06566), which has placed commercial insurance for California businesses since 1988. Named broker on every policy we place.