Cyber vs Crime Insurance for Fractional CFO Firms

Key takeaways

• Use the loss mechanism and policy wording, not the label, to frame the review.
• Ask separately about computer fraud, social engineering, funds-transfer fraud, and employee dishonesty.
• Coordinate cyber and crime terms with payment authority and E&O allegations.

Different policy purposes, overlapping facts

Cyber programs often address incident response, privacy, network security, extortion, and selected financial-fraud provisions. Crime programs often address fidelity or fraud exposures such as employee dishonesty and may include endorsements for funds-transfer or social-engineering loss. The exact scope varies by form and endorsement.

A CFO firm's facts can involve stolen credentials, a spoofed instruction, an employee's dishonest act, a client employee's action, or an allegation that the firm's payment controls were negligent. These are not the same event for policy analysis.

Compare the terms that matter

Ask who is insured, whose funds are involved, how the policy defines a fraudulent instruction, what verification condition applies, whether a sublimit or retention is different, and whether the act must involve a computer, employee, outsider, or particular communication method. Also compare defense and investigation provisions with the professional-liability policy if the client alleges negligent controls.

• Computer fraud versus funds-transfer fraud
• Social engineering versus employee dishonesty
• First-party loss versus liability to a client
• Client funds versus the firm's own funds
• Sublimits, retentions, exclusions, and verification conditions

Coordinate the program before a loss

Record access permissions, dual approvals, trusted-channel callbacks, vendor-change controls, multifactor authentication, reconciliation, and incident reporting. Then ask an advisor to compare the cyber, crime, E&O, and client requirements without treating a control description as a coverage guarantee.

Scope of this guide

This guide is educational only. General insurance education, not legal, accounting, actuarial, professional-standards or policy-specific advice. Coverage depends on the policy form, endorsements, limits, deductibles, exclusions, jurisdiction and facts. Submission does not bind coverage or guarantee a quotation or carrier approval.

Hypothetical: Hypothetical: the same incident produces two allegations

A compromised mailbox leads to an unauthorized vendor payment, and the client alleges that the CFO firm's approval process was negligent. The direct transfer loss and the professional-negligence allegation should be presented as separate questions for the applicable forms and endorsements.

Sources

• National Association of Insurance Commissioners: Small Business Insurance — accessed 2026-09-13; supports General business insurance categories and the need to compare actual operations and policy terms..
• U.S. Small Business Administration: Get business insurance — accessed 2026-09-13; supports Business insurance planning should reflect the business, its activities, contracts, and applicable requirements..
• Professional Liability Underwriting Society: Professional Liability Insurance: Introduction — accessed 2026-09-13; supports Educational context on professional-liability policy components and claims-made concepts; not a policy interpretation..