Read the episode transcript
Aaron Bollinger (00:01)
Hello everybody and welcome to the Speaking of Insurance podcast. My name is Aaron Bollinger. Today's episode, of course, is brought to you by Bollinger Insurance Services. Today we're going to be talking about something I think every business owner needs to understand, regardless of how large or small your company is. That is cyber insurance. Now, this is a late night podcast because the prior recordings went awry due to technical errors. No, it was not a cybersecurity issue. We're going to get into those. So if I do sound a little bit tired, just notice because I am dedicated to
Aaron Bollinger (00:29)
Putting the consistent information out there across the internet about cybersecurity and what it means to have a cyber attack. Usually most people picture a hacker sitting behind a computer, breaking into some massive corporation, stealing millions of dollars or passwords, and shutting down an entire network. And while these things definitely certainly do happen, the reality is that cybercrime can be a lot simpler than that. Sometimes all it takes is one email. Let me give an example.
Aaron Bollinger (00:56)
Imagine you're a GC in SoCal, general contractor in Southern California. You're working on a $500,000 residential construction project. You've been coordinating with suppliers for months. You've got subcontractors scheduled, materials being delivered, and payments going out regularly. One afternoon, you receive an email from one of your suppliers. It looks completely legitimate, like all the emails do. Supplier's name is correct. Invoice maybe even matches the right number. The amount is exactly what you're expecting as well. But there's one difference. The email says they've updated their banking information.
Aaron Bollinger (01:25)
And they ask you to send the payment to a new account. You process the payment, maybe your employee does, don't really think twice about it. Then they call you up, they say, Hey, we haven't received our money. You sent eighty-five thousand dollars to a criminal.
Aaron Bollinger (01:37)
The money may have already been transferred to the receiving account. Your supplier still expects the payment, of course, and your construction project could be delayed or worse, canceled. And now you're trying to figure out what you're going to do to recover that money. And here's the question: Does your business insurance cover that $85,000 loss? And of course, the answer is much more nuanced than just yes or no. Today we're gonna be talking about how these scams work, what cyber insurance actually covers, some recent statistics that show how significant this problem has become.
Aaron Bollinger (02:05)
And why having a cyber policy doesn't necessarily mean every type of cyber-related loss is covered. Most importantly, we're gonna be talking about things that you can actively do to protect yourself. The contractor story I just shared is hypothetical. I mean, there are more specific examples we can get into of phishing scams, and my grandparents, I'm sure maybe everybody's grandparents have fallen for a phishing scam or your parents. But let's start with some numbers, something concrete.
Aaron Bollinger (02:28)
According to the FBI's 2025 Internet Crime Report, Americans reported nearly $21 billion in internet crime losses during 2025. Remember, those are just reported losses. Not just every incident gets reported. It's selective. And not every victim even realizes immediately that they've gotten targeted in the first place. So I find this specific aspect of that incredibly interesting.
Aaron Bollinger (02:51)
now one of the things I find especially concerning is the rise of BEC, business email compromise. business email compromise is a type of fraud where criminals impersonate someone involved in legitimate business transactions. That's what I just mentioned with a contractor and $95,000. Somebody might impersonate a supplier, a executive, an employee, a real estate agent, a client. The goal is to convince you to send the money to somebody who is not the person who should be getting the money sent to.
Aaron Bollinger (03:13)
and here's what makes these attacks all the more effective. It is that the criminal doesn't necessarily even need to break into your company's entire computer system. They can just compromise an email account or an employee. Other times they create an email address that looks almost exactly identical to a legit one. They can change one letter in the domain name. I've seen this on phishing scams where it's like Apple that's emailing you. But
Aaron Bollinger (03:36)
Apple shouldn't be emailing you about testing out this new advertising scheme. So yeah, they use Apple logo, maybe even the signature. Maybe they insert themselves directly into an email chain as well. There's another way for them to be able to do that. It looks like a normal part of business, but I think this the reason that the BEC, the business email compromise statistics have increased. And it targets something that every single company, I think, relies on. That's trust. Industries like construction, real estate, insurance, professional services.
Aaron Bollinger (04:06)
Or any actual service-based business that has large payments, trust can be exploited by these cybercriminals. So keep that in mind. But maybe it's not a cyber criminal. Maybe it's AI. Maybe it's a cyber criminal using AI. And of course, AI is changing the way that criminals can impersonate people as well. So they used to have unusual wording or spelling mistakes when they would reach out to you via text. it was really obvious. But today there are AI tools that make it look like a human. Maybe they even
Aaron Bollinger (04:35)
impersonate a voice. Maybe they make realistic looking documents. According to FBI reporting on 2025 cybercrime, AI related business email compromise schemes accounted for more than $30 million in reported losses. $30 million. If you're an employee responsible for processing payments and you receive a message that looks like it's coming from your owner, your boss or whatever, maybe it's just an urgent payment, you don't think twice about it, maybe they even call you up and they're like in that little synth synthetic AI voice, make payment to me.
Aaron Bollinger (05:05)
But it's like, it's from, the appropriate number. It's from an 818 number, voice sounds like your boss. Everything seems legit. You pay them. That person wasn't your boss. Could not be your boss. That's why having proper procedures on the business side for making payments and big transfers, especially, is super important. Traditional phishing and email compromise, of course, are still very prevalent. And not every single cybercrime incident involves AI.
Aaron Bollinger (05:31)
But AI can make certain impersonation attempts more believable and easier to produce. That is what has made a new challenge for businesses as well. So we need to talk about the procedures, of course, that help you verify the transaction independently. But first, we have to talk about what is actually covered by this magical thing called cyber insurance, designed to address certain financial losses and abilities associated with cyber incidents. One thing I want to emphasize is that cyber insurance isn't a single standardized product.
Aaron Bollinger (05:59)
Different insurance companies and policies offer completely different things, different definitions, different exclusions, conditions, deductibles, limits, et cetera, et cetera. Cyber insurance can include two major categories of protection. The first called first party coverage. The second is called third party coverage. First party coverage addresses certain losses and expenses experienced directly by the insured's business. Third party coverage is against the business by other parties.
Aaron Bollinger (06:27)
So, for first party coverage, if a ransomware attack locks your company's computer systems down, depending on the policy, first-party cyber coverage can address expenses like the forensic investigations that help identify what happened, the data restoration of things that might have gotten deleted, the incident response to that actual incident, and cyber extortion expenses and certain other business interruption losses as well. But let's say
Aaron Bollinger (06:55)
A business experiences data breach and customers allege that the business failed to protect their information. Maybe some of their information got leaked out, some of the information that was being stolen. Cyber liability policy can provide defense and indemnity coverage for certain cover claims under this third-party liability example. Of course, not every single cyber-related loss is automatically covered by a cyber policy, even if it's a first or third party claim. It's subject to the policy and conditions. But let's go to the $85,000 contractor example.
Aaron Bollinger (07:25)
that we had before. They received a fraudulent invoice. They voluntarily authorized $85,000 wire transfer. Money goes to a criminal.
Aaron Bollinger (07:33)
Let's say the contractor calls their insurance broker and says, I've got cyber insurance, right? I'm totally covered. Not necessarily. And that is where the policy language becomes extremely important. Some cyber insurance policies include social engineering fraud coverage. Some include fraudulent funds transfer coverage. Others require a separate commercial crime policy or endorsement that you could have potentially not added to the policy in the first place. Maybe you didn't even know about it because your insurance broker didn't talk about it with you. And even when those coverages exist, the conditions can be different.
Aaron Bollinger (07:59)
one coverage might address a criminal directly gaining unauthorized access to a computer system and then transferring funds within the access to that computer system. And then another situation could be where an employee is deceived into voluntarily sending money
Aaron Bollinger (08:14)
And those are two completely different insurable expenses and situations. So if you have a cyber insurance policy for a million-dollar overall limit, there are sublimits for these kinds of things, especially the social engineering coverage. Those other numbers that I've given before are hypothetical examples: the $85,000, the million-dollar face coverage.
Aaron Bollinger (08:34)
So if you lose the $85,000 that we had mentioned, there are circumstances where it is recoverable based on the coverage amount or the sublimin amount meeting that threshold, but it could also be substantially less than the overall cyber policy limit with those sneaky sublimits that we had talked about as well. Same way. And so obviously there are also deductibles that come into play, different deductibles, verification requirements for determining eligibility for that coverage, and other conditions that
Aaron Bollinger (08:59)
I bet I'm forgetting. This why I encourage business owners to look into their coverage, not just the face coverage. You understand what types of losses are insured for and how the loss and the policy is treated individually, one by one, in specific situations and scenarios. Maybe that ChatGBT gives you going through them with your insurance broker, asking about that policy and the eligibility for specific types of possible claims that your business could be susceptible to based off the business type. And so again, reiterating.
Aaron Bollinger (09:29)
A million dollar face coverage amount on the cyber insurance policy does not indicate that every single claim will be covered up to a million dollars. But let's talk about ransomware is malicious software or another attack method used to encrypt systems, steal information.
Aaron Bollinger (09:43)
or otherwise disrupt operations while criminals demand payment. Major threat. Verizon's 2026 data breach investigation report showed that ransomware was involved in approximately forty eight percent of breaches analyzed. That's a significant proportion. Of course this doesn't mean that all of the cyber related events, 48% of them, mean that businesses were attacked by ransomware. It just means that in this specific study, that is the case.
Aaron Bollinger (10:08)
But if you run a small accounting firm and you have 10 employees and you maintain financial records for hundreds of clients, one morning your employees arrive at work and discover they can't access company files. Maybe they have a ransom demand on their screens, you've got a huge problem. You have to do a few things, four things. Determine what happened, contain the incident and restore the systems, evaluate whether sensitive client information was compromised. And
Aaron Bollinger (10:35)
Identify if current work can be resumed and if not, what can be done about it. A cyber insurance policy can help provide access to an incident response team, including legal counsel, forensic specialists, and other professionals during this process that can help you with a few of these. It can also cover certain qualifying recovery expenses. But you've got to understand your insurance coverage before you know that you're eligible for that. Losing revenue while the system is unavailable is a complete other issue.
Aaron Bollinger (11:04)
Because cyber business interruption is a different animal. A cyber attack can disable a company system without causing the kind of physical property damage covered by a commercial property policy. So let's say a retailer's payment processing system is disabled by a covered cyber attack. The building can be fine, everything else can be fine physically, but business operations can't resume because they can't take payment. And so a cyber business interruption provision can help qualify them for getting
Aaron Bollinger (11:32)
access to some of the lost income and possible additional expenses that they would have incurred during that event. But those, of course, are separate issues and things to review. Some policies require a specified type of security failure or system failure. Some have waiting periods before that coverage actually kicks in. There also can be separate limits for cyber business interruption than just the face value that you'd assume. Some policies distinguish between failures of the insured companies
Aaron Bollinger (12:00)
own systems and failures involving outside technology providers. So if you rely on a third-party software platform like a lot of businesses do, if that platform goes down because of a cyber incident, your own computers might still function perfectly, but your business still can't operate. So understanding because a lot of businesses nowadays rely on these cloud-based softwares and online payment processing and outside technology providers, how your insurance and your cyber insurance responds in the event that one of these systems that you're relying so heavily on were to go down.
Aaron Bollinger (12:31)
Because the physical location of your office isn't necessarily the only thing keeping your business operational. Your digital infrastructure in this day and age 100% matters too. And so one thing is like when you watch shows on or, TikTok videos or shorts or even the TV and you see the news or you read in the newspaper and you see the news about all these big, you know, corporations that are getting hacked by AI or hacked by X, Y, and Z, there's a big misconception that it's just that these bigger corporations are being targeted.
Aaron Bollinger (13:01)
I understand why, right? It makes the national headlines, but smaller businesses face a very similar and serious exposure, maybe even worse in a lot of cases, because you might rely on an outside IT provider. Maybe you have less cybersecurity resources than these billion dollar companies that are getting hacked. And of course you have employees that try and do a bit of everything. Maybe they've got their hands in a lot of pots, the financial side of things, the responsibilities, the internal controls that larger organizations use, you don't necessarily have.
Aaron Bollinger (13:31)
So if you're that small contractor or a contractor in general, you might not have a sophisticated cybersecurity department. And so you could still be tapping into tens to hundreds of thousands of dollars that could be susceptible to losses. Same thing with like medical offices that have sensitive patient information that these cyber attacks can go in and get access to, accounting firms with financial records, retail businesses with customer payments, contractors, of course, larger transactions like I mentioned.
Aaron Bollinger (14:01)
High value wire transfers for real estate businesses, just to name a few. The exposures are different, but the common factor is that digital systems and electronic communications are essential to everyday operations and have to be understood as a risk for your insurance operations. So with that, I want to talk about what you can do. What is the solution? Prevention. There's no solution to cyber attacks, no 100% sureproof solution, unless you want to go back to just paper, but then there's
Aaron Bollinger (14:28)
Other types of risks with that, obviously, you might lose some business. But the first thing that I would do is verifying changes to payment instructions, looking into if there are any changes, requests pending, things like that, future requests, having a workflow for that, a procedure for that. The second would be using MFA multi-factor authentication. It's just another layer on top of a password. It can be like a key, it can be a USB that you plug in. It's there's a bunch of different things that you can do.
Aaron Bollinger (14:58)
The third is approval procedures for larger payments, requiring a secondary authorization before an employee can approve transfers. And the fourth would be to maintain secure tested backups. And another thing that goes in that is training. that encapsulates all of it is how are you training your employees to deal with these different situations and make sure that they are up to date and properly set up for the risk program and procedures that you are trying to implement.
Aaron Bollinger (15:27)
The FBI specifically recommends independently verifying payment changes and being cautious with unexpected requests involving money. So if you already sent the money, contact the financial institution immediately, explain that the transfer was fraudulent, and request that they initiate any available recall or recovery procedures. Recovery, of course, isn't guaranteed, but waiting can make the situation worse. 100%, notify your insurance broker if something horrible happened, see if it's covered. Here are the five questions I'd ask.
Aaron Bollinger (15:55)
I'm starting to do this at the end of every podcast. Whether you're AI listening to this or you like listening to cyber insurance and understanding the risk with living in the 21st century, operating businesses in the 21st century from a third generation insurance broker. Here are the five questions that I would ask. Do I currently have cyber insurance? Does my insurance include social engineering fraud or fraudulent funds transfer coverage?
Aaron Bollinger (16:19)
If a ransomware attack shuts down my systems, does the policy include cyber business interruption coverage?
Aaron Bollinger (16:26)
If a third-party software provider experiences a cyber attack that affects my business, is there any dependent business interruption coverage? And number five, last but not least, what cybersecurity procedures does my insurer expect me to maintain? If you're not staying up to date with communicating with your insurance company on the way that you're handling personal information, payment information, or how much information you have stored, that is a big gap in your insurance knowledge. Your insurance program should 100% understand.
Aaron Bollinger (16:53)
Based off of the prior underwriting, based off of the updating of the risk profile that you have as you grow, as you shrink, as you change operations, your insurance has to change with you. So you can make sure that you don't get sued. So you can make sure that you don't lose a bunch of money and the insurance does its job right. That's the way to do it. So here's what I want everybody to take away from this episode. Cybercrime doesn't always look like what you see in the movies. There's no dramatic computer screen most of the time, no obvious warning. Sometimes it's just an email, an invoice, a call in.
Aaron Bollinger (17:23)
Payment requests that looks completely normal. But the financial consequences of these can be all the more significant. For a small business or medium-sized business losing hundreds of thousands of dollars, tens of thousands of dollars, absolutely ridiculous, and create a serious cash flow problem. 100% comes from all these things. A ransomware attack could interrupt operations, data breach result in expensive investigations and legal obligations.
Aaron Bollinger (17:47)
And these risks aren't limited to technology companies. Contractors, retailers, professional offices, medical practices, and businesses of all size that rely on digital systems and electronic payments are susceptible. That's why cyber insurance deserves to be a part of the broader conversation about commercial risk management for all businesses in this day and age. Last thing, having cyber insurance does not automatically mean cyber related loss is 100% covered. Exclusions, subliminal deductibles, guys, we've mentioned this so many times before.
Aaron Bollinger (18:17)
If you're a California business owner and you're not sure whether your current insurance includes cyber liability, social engineering fraud, or cyber business interruption coverage, that's something we can help review with you at Bollinsure Insurance Services. We look at your operations, discuss your potential exposures, and explore available coverage solutions. Because sometimes the biggest financial risk to your business is in a fire, a lawsuit, or a natural disaster. Sometimes it's a payment that goes to the wrong person. I'm Aaron Bollinger. This has been Speaking of Insurance Podcast.
Aaron Bollinger (18:46)
Brought to you by Bollinsure Insurance Services. Thank you for listening. I'll see you all in the next episode. Stay safe. Don't fall for fishing scams. We are not fishing.
