Business Cyber Fraud Insurance: What Finance Teams Should Do

Business cyber fraud insurance can be relevant after a suspicious business payment, but it is not a substitute for urgent containment and it does not assure recovery for a particular transfer. Finance teams should contact their bank, preserve evidence, report suspected financial cyber fraud and then assess the loss against the issued policy’s wording, limits and conditions. This guide helps Indian CFOs, finance heads and SME owners take those steps in the right order.

What the reported cyber-fraud incident means for business finance teams

Spandana Sphoorty Financial said in its 2 November 2026 exchange filing on a cyber-fraud incident that unauthorised transactions of approximately ₹7.80 crore were debited from one of its bank accounts on 1 November 2026 and transferred to multiple beneficiary accounts. The company said it stopped affected services, asked the bank to reverse transactions and freeze beneficiary accounts, registered a complaint through the National Cyber Crime Reporting Portal, and was filing a claim with its insurer. The filing said the method, people involved, recoveries and investigation outcome remained under investigation.

The practical lesson is to avoid deciding too early whether the event was a system compromise, credential misuse or payment diversion. Treat it first as an urgent finance and cyber-response incident. Fraud proceeds can move through chains of mule accounts within minutes, making swift reporting and bank action more valuable than a later reconciliation. The Department of Telecommunications explains why recovery becomes a race against time.

Does business cyber fraud insurance cover a fraudulent transfer?

It can, but business cyber fraud insurance is not a standard promise that applies to every payment loss. The policy schedule determines which insuring clauses were purchased, the limits attached to them and the applicable deductible. An HDFC ERGO Cyber Security Insurance policy wording, for example, includes separate E-Theft Loss and E-Communications Loss clauses, with single-loss limits and deductibles shown in the schedule.

The facts behind the payment matter. In that wording, E-Theft Loss is defined around a direct loss caused by fraudulent data entered into the insured’s system or through its network. A payment approved by an employee after a deceptive email, vendor-bank-detail request or purported executive instruction may not fit that definition. It should be assessed against the wording actually issued to the company, including any relevant fraudulent-instruction or social-engineering endorsement if one was purchased. The issued policy’s E-Theft Loss definition

Before describing a loss as insured, review the schedule, policy wording and every endorsement. Check the insuring clause, definitions, exclusions, single-loss and aggregate limits, deductible, notification requirements and evidence required. Policies are issued by insurers, and claim decisions remain subject to policy terms and assessment.

Cyberattack, payment diversion and social engineering: the differences that affect cover

A cyberattack can involve unauthorised access to systems, malicious code, credential compromise or other interference with technology. The CERT-In Directions dated 28 April 2022 list unauthorised access to IT systems or data, phishing and identity theft, data breaches, and incidents affecting digital payment systems as reportable incident categories for covered entities.

Payment diversion is the outcome: money intended for a genuine vendor, employee or other payee is sent to another account. It may follow a technical compromise, but it may also start with a false request to change vendor bank details.

Social engineering is the deception used to persuade a person to act. A finance employee may receive what appears to be a genuine message from a supplier or senior executive and release a payment. This distinction is important because a policy clause linked to fraudulent access to the company’s systems is not automatically the same as cover for a payment authorised after deception. Ask the insurer or broker to identify the exact clause intended to respond, rather than relying on the policy’s general label.

The first question for the incident team is simple: Was money moved through unauthorised system activity, or did an employee approve payment after being deceived? The answer helps determine the bank investigation, evidence collection and potential insurance route.

The first 24 hours after suspected business payment fraud

Use this cyber fraud response checklist as soon as a suspicious debit, beneficiary change or payment instruction is identified:

1. Contact the bank through its established fraud channel. Ask it to stop pending payments where possible, seek reversal, flag the beneficiary accounts and begin its investigation. Time is critical because fraud proceeds may move quickly across accounts. The Department of Telecommunications’ financial-fraud guidance
2. Report financial cyber fraud immediately. Call 1930 and report through the National Cyber Crime Reporting Portal. The Department of Telecommunications states that the first hour matters most. The Department of Telecommunications’ reporting guidance
3. Contain without destroying evidence. Suspend affected payment credentials, sessions, integrations or services where appropriate. Preserve bank alerts, payment references, email headers, user IDs, IP logs, approval trails and device information.
4. Create one incident record. Record when the issue was noticed, every transaction reference, beneficiary account, approver, bank case number, 1930 acknowledgement and containment decision.
5. Notify the insurer or broker under the policy. Give notice promptly without making assumptions about coverage or recoveries. The HDFC ERGO wording cited above, for example, requires notice of a loss or expense as soon as practicable and no later than 90 days after discovery for specified clauses. The policy’s reporting conditions
6. Assess CERT-In reporting promptly. Effective from 27 June 2022, the CERT-In Directions dated 28 April 2022 require service providers, intermediaries, data centres, body corporates and government organisations to report listed cyber incidents within six hours of noticing them or being informed of them.

For wider preparation, see this business breach-response checklist, which can help allocate responsibilities before an incident.

Five payment controls to check before the next vendor transfer

1. Confirm bank-detail changes independently. Do not rely on the email thread that requested the change. Call a known vendor contact using a number already held in the vendor master or sourced independently.
2. Use two-person approval for beneficiary changes and payments. Separate the person who creates or changes a beneficiary from the person who releases the payment.
3. Set a cooling period for sensitive changes. Hold the first payment to an amended vendor account until verification and second approval are complete.
4. Create payment thresholds and exception alerts. Require stronger approval for high-value, urgent, unusual-country, out-of-hours or first-time beneficiary payments.
5. Restrict payment access. Review bank-portal users, remove dormant rights, require multi-factor authentication and reconcile payment reports against approved invoices daily.

Write these controls into the accounts-payable process and test them. The Department of Telecommunications advises users to pause and verify independently when a banking or UPI application displays a payment warning. The Department of Telecommunications’ payment-warning advice

Cyber-policy wording finance teams should review before renewal

Ask for the complete policy wording, schedule and endorsements. Then review them with finance, risk and technology teams:

• Insuring clauses: Identify whether the policy includes a clause for electronic theft, fraudulent communications, funds-transfer loss, fraudulent instructions or payment diversion.
• Definitions: Establish what action must cause the loss. A wording may require fraudulent data input into the insured system, rather than merely a deceptive communication received by an employee.
• Limits and deductibles: Check the single-loss limit, the aggregate limit for the policy period and the amount the business must bear before the policy responds. In the HDFC ERGO wording, the schedule contains individual loss limits and deductibles, while the policy applies only to loss above the applicable deductible. The policy’s limits and deductible provisions
• Sub-limits: Check whether a relevant extension has its own lower limit and whether that amount sits within, rather than in addition to, the main policy limit.
• Notification and proof: Identify who must notify the insurer, by when, and what bank records, logs, complaint records and internal approvals may be needed.
• Exclusions and procedures: Review exclusions, warranties, conditions and any requirements to follow specified payment-verification processes.
• Related insurance: Consider whether a commercial crime, fidelity or cyber policy is intended to respond and how other-insurance clauses could affect the route of a claim.

The wording should guide the insurance discussion, but it should not replace payment controls. A policy can reduce the financial impact of an eligible loss; it cannot stop a fraudulent instruction from reaching the bank.

For a broader buying checklist, read what Indian SMEs should check before buying cyber insurance. You can also review corporate cyber insurance alongside your payment controls and incident-response plan.

FAQs: cyber fraud insurance and business bank-account losses

Is a vendor-bank-detail change scam covered by cyber insurance?

It depends on the issued policy and the facts. A loss caused by fraudulent data entering the company’s system may be treated differently from a payment an employee approved after receiving a deceptive vendor-bank-detail request. Review the schedule, definitions and endorsements, and obtain the insurer’s or broker’s view on the applicable clause before relying on cover. An example of an issued E-Theft Loss definition

What is the difference between funds-transfer fraud and social engineering fraud?

Funds-transfer loss wording may focus on the mechanism that caused money to be transferred, such as fraudulent data input into the insured’s system. Social engineering describes the manipulation of a person into authorising an action. The terms and coverage consequences are policy-specific, so finance teams should compare the incident facts with the relevant definitions rather than assume that the labels are interchangeable.

Should a business wait for the bank’s investigation before calling 1930?

No. Contact the bank and report financial cyber fraud immediately through 1930 or the National Cyber Crime Reporting Portal. The Department of Telecommunications says that the first hour matters most. The Department of Telecommunications’ financial-fraud guidance

Does every suspected payment fraud need to be reported to CERT-In?

CERT-In’s directions apply to the named entities and listed incident categories. Involve technology and legal teams promptly where the facts suggest phishing, unauthorised access, data compromise or an incident affecting digital payment systems. Effective from 27 June 2022, the CERT-In Directions dated 28 April 2022 require covered entities to report listed incidents within six hours of noticing them or being informed about them.

Can a bank reversal or insurance recovery be assumed after a fraudulent transfer?

No. The ability to stop, freeze or recover funds depends on timing and the transaction path. An insurance claim depends on the issued policy, evidence, applicable limits, deductible and insurer assessment. Pursue bank action, reporting and insurance notification in parallel, while keeping a clear record of each step.

Ask Coverbiz for a corporate cyber-insurance review that considers your payment processes, incident-response needs and applicable policy terms.