Many California small businesses shop for commercial insurance by asking for the cheapest package. A wire that goes to a criminal, or ransomware that locks the books, rarely looks like a property or general liability claim. Cyber risk needs its own review: social engineering, funds-transfer fraud, ransomware response, and cyber business interruption.

This page follows Speaking of Insurance, episode 27, "Cyber Insurance for Small Businesses: Protecting Against BEC Scams & Ransomware." Aaron Bollinger recorded it for Bollinsure Insurance Services, and it was published on October 23, 2026. The episode page has the audio, chapter marks, and full transcript.

A shorter checklist post, Cyber Insurance for California Small Businesses: Questions to Ask, stays with FTC and CCPA pointers. The deep guide, cyber insurance for California businesses, covers application evidence and privacy depth. This page owns the BEC narrative, social-engineering versus unauthorized transfer, and ransomware plus cyber BI story from episode 27. Start product placement on cyber insurance.

If you want a cyber coverage review, Get quoted or call 562-268-9355. An indication is not coverage in force.

Why the cheapest GL rarely answers a wire-fraud loss

General liability and commercial property are not designed as substitutes for cyber or crime coverage when someone is deceived into sending a payment, or when systems fail without physical damage. Ask which policy would respond to fraudulent payment instructions before you assume the package already covers it.

How business email compromise actually works

Business email compromise (BEC) is fraud that impersonates a supplier, executive, employee, or client to redirect a payment. Criminals may compromise a real mailbox, use a lookalike domain, or insert themselves into a thread. AI can make voices and documents more believable.

Episode illustration (hypothetical): a Southern California general contractor receives what looks like a supplier invoice update and wires about $85,000 to a criminal account. The amount is an episode illustration, not a claim outcome or quote. The supplier still expects payment. Industries that move large transfers (construction, real estate, professional services, medical, retail) are frequent targets. Trust is the exploit.

Reported context from the episode (FBI and Verizon reported figures, not Bollinsure research): the FBI's 2025 Internet Crime Report described nearly $21 billion in reported internet crime losses for 2025; FBI reporting also described more than $30 million in reported AI-related BEC losses; Verizon's 2026 DBIR described ransomware in about 48% of breaches analyzed. Those are reported or study figures, not a guarantee of your exposure.

First-party vs third-party cyber coverage

Cyber is not one standardized product. First-party coverage can address certain costs the insured business incurs: forensics, restoration, incident response, some extortion-related expenses, and cyber business interruption when granted. Third-party coverage can address defense and indemnity for certain privacy or network claims brought by others. Definitions, sublimits, waiting periods, and panel requirements vary by form.

Social engineering and funds-transfer fraud

A voluntary authorized payment to a criminal after a deceptive invoice is not the same as a hacker moving funds after unauthorized system access. Some cyber policies include social-engineering or fraudulent funds-transfer grants. Others need a commercial crime policy or endorsement, often reviewed alongside the rest of a business insurance program. Sublimits, verification conditions, and deductibles often matter more than the face limit.

Episode illustration only, not a quote: a $1 million cyber face limit can still carry a much smaller social-engineering sublimit. Having "cyber" on the binder is not proof that a BEC wire is covered.

Ransomware, incident response, and cyber business interruption

Ransomware can encrypt systems, steal data, or disrupt operations while criminals demand payment. A cyber policy may help with access to an incident response team (legal, forensics, and related specialists) and certain recovery expenses when terms are met. Ransom decisions need legal and security advice. Nothing is automatic.

Cyber business interruption addresses lost income when systems are down without the physical property damage a commercial property policy expects. Waiting periods, separate BI limits, and dependent / contingent BI for a cloud or payment vendor outage are common review items. A retailer that cannot take payments while the building looks fine is the plain-English example.

Controls carriers ask about

Educational only, not a certification checklist: independently verify payment-instruction changes; use multi-factor authentication on email and remote access; require dual approval for larger transfers; maintain tested backups; train employees. The FBI theme of independent verification of payment changes is the practical habit. If money already left the account, contact the bank immediately and notify the broker. Recovery is not guaranteed.

Describe actual controls accurately on the application. Requirements vary by insurer.

Five questions for a cyber submission

  1. Do I currently have cyber insurance?
  2. Does it include social engineering or fraudulent funds-transfer coverage, and at what sublimit?
  3. If ransomware shuts systems down, is cyber business interruption included?
  4. Is there dependent BI if a third-party software platform fails?
  5. What cybersecurity procedures does the insurer expect me to maintain?

Next step with Bollinsure

If you are unsure whether your commercial program includes cyber, social engineering, or cyber BI, Get quoted or call 562-268-9355. Bring how you take payments, which systems you rely on, and what controls you already run. Leave passwords, bank credentials, and other secrets out of an ordinary first message.

WJB Services, Inc. dba Bollinsure Insurance Services. California DOI agency license 6013787.

Related reading

Frequently asked questions

Does general liability cover a business email compromise?

Do not assume it does. GL is not designed as a substitute for cyber or crime coverage for deceptive wire transfers. Review the actual forms with a broker.

What is social-engineering or funds-transfer fraud coverage?

Coverage on cyber, crime, or endorsement that may address losses when someone is deceived into sending money. That is different from a hacker moving funds after unauthorized system access. Sublimits, verification conditions, and deductibles often apply.

Will cyber pay ransomware extortion and recovery?

Some policies can help with incident response, forensics, restoration, and certain extortion-related expenses when terms are met. Ransom decisions need legal and security advice. Nothing is automatic.

What security controls do carriers usually ask about?

Common topics include MFA on email and remote access, payment dual-approval, tested backups, and employee training. Requirements vary. Describe actual controls accurately on the application.

Do California privacy laws change cyber need?

CCPA / CPRA and breach-notification rules can create obligations for some businesses and incidents. Applicability needs counsel. Insurance coverage is a separate policy review. Use the long cyber guide for CCPA depth rather than restating it here.

How fast can a small business get a cyber quote?

Timing depends on complete application answers, controls evidence, and underwriting. Gather systems and payment details and control status before the review to avoid delays.

Primary Sources and Further Reading

This page is general educational information. It is not legal advice, not a coverage determination, and not a statement that a cyber or crime form will pay a wire or ransomware loss. Dollar figures are episode illustrations. No coverage is bound through this article.