Case study: Wholesale and distribution business

Senior impersonation results in a £500,000 transfer

Cyber crime can exploit people, processes and pressure, not just technology.

This anonymised case study is based on an actual cyber claim and shows how senior impersonation and a convincing chain of communications led to a substantial fraudulent transfer.

It also highlights where cyber insurance can help, from cyber crime cover and forensic investigation to legal support and claims guidance, while showing why payment controls and policy limits should be reviewed before an incident happens.

The Cyber incident

This anonymised example illustrates how cyber insurance responded in a particular circumstance. Cover and claim outcomes depend on the individual policy wording and facts of each incident. Limits, sub-limits, exclusions, conditions, excesses and retentions may apply. The example is not a guarantee that another claim would be covered or settled on the same basis.

A UK wholesale and distribution business was targeted by a sophisticated social-engineering fraud. Criminals impersonated a senior company figure and introduced a fake professional adviser. A confidentiality agreement and convincing communications added credibility, leading an employee to transfer approximately £500,000 to an overseas account.

The investigation found no evidence that the company’s email environment had been compromised. However, dual-approval procedures were not followed, and the supposed adviser used an imitation email domain that could have been spotted through independent verification.

Coverage was accepted under the cyber-crime section, and a settlement of approximately £250,000, the full policy limit, was agreed. Legal and forensic costs were handled separately, subject to a £2,500 deductible and VAT. Attempts to recover the transferred funds were unsuccessful because of the delay and lack of cooperation from overseas parties.

What this means for businesses

Urgent or confidential payment requests from senior leaders must always be independently verified.

Confidentiality agreements and apparent professional advisers can be used to discourage normal internal checks.

Payment controls must be followed without exception, regardless of seniority or urgency.

Email domains should be checked carefully and advisers verified using trusted contact details.

Suspected fraud must be reported immediately, as the chance of freezing or recovering funds declines rapidly.

Cyber-crime sub-limits may leave a substantial uninsured balance following a major transfer.

Financial fraud can have a significant personal impact on the employee who was deceived.

Cyber crime can exploit people, processes and pressure, not just technology. Insurance can help reduce the financial impact, but this example also shows why policy limits, sub-limits and payment controls should be reviewed before an incident happens.

Ready to strengthen your business? Find out more about cyber insurance and how it can help protect your business, or contact the Haven Knox-Johnston Commercial team to discuss the right cover for you.

Call our team of experts on 01905 930 760 today.

Why choose us?

Expert navigation of the marine trade market

Well-established relationships with specialist insurers means we can swiftly source the right protection for your business.

A longstanding
experienced crew

With 20 years in Marine Trade insurance, we understand the industry’s nuance and provide guidance, efficiency and support.

On board with
every business

We have the flexibility and scope to offer the highest standards of cover for marine businesses and associations of all shapes and sizes.

Call us today on

01905 930 760

Enquire here

Request a Quote

Marine trade insurance, expertly navigated

Useful Links

Haven Knox-Johnston Commercial is a trading name of Howden UK Brokers Limited, which is authorised and regulated by the Financial Conduct Authority No. 307663. Registered in England and Wales under company registration number 02831010. Registered Office: One Creechurch Place, London EC3A 5AF. Calls may be monitored and recorded for quality assurance purposes