Commercial Crime Insurance

A crime policy is built from separate insuring agreements, each with its own limit and deductible. A business buys the ones it needs and leaves the rest blank on the declarations:

• Employee theft. Money, securities and other property stolen by an employee, acting alone or with others. This is the agreement most claims are made under, and the one that replaces a traditional fidelity bond.
• Forgery or alteration. Loss from forged or altered checks, drafts and promissory notes drawn on the insured's accounts, or made out in the insured's name.
• Inside the premises. Theft of money and securities from the insured's premises or a bank, and robbery or safe burglary of other property, including damage to the safe, the door and the cash drawer.
• Outside the premises. Money and securities stolen while in the care of a messenger or an armored car company, such as a deposit on its way to the bank.
• Computer fraud. Loss caused by someone using a computer to transfer money or property fraudulently out of the insured's premises or accounts.
• Funds transfer fraud. Loss when a fraudulent instruction, sent to the insured's bank without the insured's knowledge, causes the bank to move money from the insured's account.
• Money orders and counterfeit money. Counterfeit currency accepted in good faith, and money orders that turn out to be worthless.

Two additions matter most for property businesses. Clients' property coverage extends employee theft to money the insured holds for someone else, which is the core exposure for a manager with owners' funds in trust. Social engineering coverage, added by endorsement, responds when the insured's own staff are deceived into sending a payment, which funds transfer fraud does not.

Most disputed crime claims turn on a short list of exclusions and conditions:

• Voluntary parting. Loss from giving up title to or possession of money because someone was tricked into it. This is why an employee who wires funds after a convincing email from a fake vendor is not covered under computer fraud or funds transfer fraud. The bank was not fooled; the staff member was.
• Acts of owners and partners. Theft by a sole owner, a partner or, on many forms, a principal owning a stated share of the business.
• Prior dishonesty. Coverage for an employee ends the moment anyone in management, not in collusion with that person, learns of a dishonest act by them, including one from before they were hired. A manager who keeps on a bookkeeper caught with a small shortfall can lose coverage for that bookkeeper's next theft.
• Indirect loss. Lost income, interest that money would have earned, and the cost of proving the loss, though some forms add investigation expense.
• Inventory shortages. A loss shown only by comparing an inventory count with the books is excluded, unless the insured can identify the employee and the theft by other evidence.

Theft of equipment, furniture or tools by an outsider is a commercial property insurance question, or an inland marine insurance one for equipment that travels. A crime policy is for money, securities and, under employee theft, property stolen by staff.

Crime premium is driven by the employee count, the class of business, the amount of money handled and how it moves, and the internal controls the application describes. Each insuring agreement is rated separately. Employee theft is usually the largest limit and the largest charge, while inside and outside the premises limits are set to the most cash the business ever holds at once.

A practical way to size employee theft is to ask how much one trusted person could take before anyone noticed. That is usually a function of three things:

• the largest balance a single person can move or sign against;
• how often an independent person reconciles the accounts;
• how long a theft could run before an audit or an owner statement exposed it.

For an association, that means the reserve fund plus the operating balance and the assessments collected in a typical quarter. Governing documents and lenders often state a minimum fidelity amount, and the policy should meet whichever figure is higher. For a management firm, it means the trust and escrow balances at their monthly peak, which usually fall on the days rents and deposits come in. Social engineering is often available only at a sublimit well below the employee theft limit, so the gap should be known and either accepted or filled.

A deductible chosen to save premium can quietly remove the small, frequent thefts most businesses actually suffer.

Crime underwriting is mostly a review of controls, because the controls decide how large a theft can grow before it is caught. The application usually asks for:

• Segregation of duties. Whether the person who records payments is different from the person who deposits them, and whether the person who approves invoices also signs checks.
• Reconciliation. Whether bank statements go to someone other than the bookkeeper, and how often accounts are reconciled.
• Dual control. Countersignature or a second approval above a stated amount, and dual control on wires and ACH.
• Vendor change procedures. How a change to a vendor's bank details is verified, and whether that check uses a phone number already on file rather than one in the request.
• Audits. Annual audit or review by an outside accountant, and whether the audit covers trust accounts.
• Hiring. Background checks for anyone who handles money or has signing authority.

The social engineering endorsement brings its own questions, and the answers become conditions. If the application says the business confirms every payment change by calling back on a known number, and a staff member skips that step, the claim can be denied even though the loss is plainly a fraud. Writing down a procedure the business does not actually follow is the most common way a crime claim is lost before it is filed.

A crime claim is a proof of loss, not a report of damage. The insured has to show what was taken, by whom and when, usually within 120 days of discovery on standard forms, though the period varies. The proof is built from bank records, general ledger entries, canceled checks, payroll, vendor files and, for employee theft, a forensic accountant's reconstruction of the scheme. Some forms pay part of that accountant's cost; many do not.

When the loss is a fraudulent wire, speed decides how much is recovered before the policy pays anything. The FBI's Internet Crime Complaint Center advises contacting the originating financial institution as soon as the fraud is recognized to request a recall or reversal, and filing a detailed complaint with the center that includes the banking information. The scale is why carriers write social engineering cover cautiously: an FBI public service announcement from September 2024 put domestic and international exposed losses from business email compromise between October 2013 and December 2023 at more than $55 billion.

Whether the policy reads loss sustained or loss discovered matters most at claim time. A discovery form covers theft discovered during the policy period, however long ago it began, which suits a long embezzlement found years later. A loss sustained form covers theft that happened during the policy period and is discovered within a set window afterward, so switching carriers without the right prior coverage wording can leave years of an old theft uninsured.

Property management firms holding owners' rents and deposits have the deepest exposure on this list. Rents, security deposits and owner distributions pass through trust and escrow accounts the firm controls, and a theft from those accounts is a loss to the owners. The firm needs clients' property coverage on the employee theft agreement, a limit sized to peak trust balances, and social engineering cover for the vendor and owner payment changes that arrive by email every week.

Condo and townhouse associations with reserve funds face the classic fidelity loss: a treasurer or a manager with signing authority draining the reserve over several years. The policy has to define employee to include directors, officers, committee members and volunteers, and the management company and its staff where they handle association money. Without that, a theft by the manager falls outside employee theft entirely.

Car wash operators handling cash, cards and memberships lose money in small, repeated amounts: skimming at the pay station, voided sales, refunds issued on unlimited memberships to accounts the employee controls. A modest employee theft limit with a low deductible fits that pattern better than a large limit with a deductible no single theft ever reaches.

Hotels with front desk cash and vendor payables combine cash exposure at the desk and the night audit with a large volume of payments to suppliers, franchise fees and contractors, which is exactly what a payment redirection fraud imitates.

The crime policy sits alongside two related lines. Cyber liability insurance for breach response pays to investigate an intrusion, notify affected people and defend privacy claims, and some cyber forms add a funds transfer sublimit; the crime policy is the place for the full theft limit. Surety and fidelity bonds answer the same question as the employee theft agreement, and many associations meet a fidelity bond requirement through the crime policy, provided its wording and amount satisfy the documents.

• No social engineering endorsement. The most common fraud a property business now meets is excluded by voluntary parting unless the endorsement is added.
• Clients' money left out. A manager's employee theft agreement that covers only the firm's own funds, not the trust balances it holds for owners.
• The manager not an employee. An association policy that leaves out the management company, so a theft by the manager is not covered.
• A gap at a carrier change. Moving from one loss sustained form to another without prior loss wording, leaving an undiscovered theft from earlier years uninsured.
• A procedure on paper only. A callback or dual approval described on the application that staff do not follow, turning a covered fraud into a denied one.