A fraudulent payment instruction is often designed to look routine. It may arrive in the middle of a closing, a settlement, a tax payment, or a vendor cycle, using details that make it look like it belongs in the firm’s ordinary workflow.
That is why a professional-services firm should not wait for a breach notification to ask about insurance. The important facts are already in the payment process: whose money is moving, who can authorize it, how a change is verified, and what the firm has promised its client about safeguarding funds.
Does cyber insurance cover client-fund theft?
Maybe, but the answer has to be found in the form. A cyber form, crime form, funds-transfer endorsement, and social-engineering coverage can use different definitions, conditions, exclusions, and sublimits. The claim can turn on whose money moved, how the instruction arrived, what approval controls were used, and whether the policy addresses client funds or voluntary parting.
Aon’s 2026 guidance for professional-services firms makes the core problem clear: firms holding trust, escrow, settlement, or transaction funds can face large losses, while social-engineering protection may sit behind a smaller sublimit and policy language may focus on the firm’s own assets.
Start with the money, not the policy name
Before I compare a limit, I want to see the largest ordinary client-money movement, the maximum balance held in trust or escrow, and the payment-approval workflow. A social-engineering sublimit that looks adequate in a proposal may be inadequate against the firm’s ordinary payment flow.
Run one useful tabletop: a convincing message asks the firm to redirect client money, and the request passes the usual workflow. Who calls back? Which number is trusted? Who can stop the transfer? Which account was used? Who has to notify the carrier and counsel? The answers should be written down before a loss turns them into an emergency.
Crime, cyber, and E&O can all be part of the review
Cyber coverage may address a security incident, forensic work, breach counsel, notification, or privacy claims, subject to the form. Crime and social-engineering provisions may address a fraudulent instruction in a different way. Professional liability can become relevant when the client alleges that the firm failed to exercise the care it owed while providing services.
Those are different paths through a claim. Price Forbes’ professional-services overview similarly treats professional indemnity, cyber, crime, and media liability as separate elements of a program. One policy name cannot settle all of them.
Our job as a broker is to place the policy forms beside the actual payment process and the firm’s contract duties. We look for the definition of covered property, the social-engineering or funds-transfer limit, approval conditions, voluntary-parting language, and the services definition in the E&O form. The policy terms and claim facts still decide whether any particular loss is covered.
For firms that also publish advice, reports, or creative work, media and defamation coverage deserve a separate conversation. The immediate client-funds question remains the same: how much can move, how is it verified, and what does the actual wording say about that loss?
