Most cyber claims start with an email, not ransomware

Most owners I talk to buy cyber insurance picturing ransomware. The claims data says that's not what's hitting them.

Coalition, which insures more than 100,000 businesses, published its 2026 claims report this year. Business email compromise and funds transfer fraud together made up 58% of every claim they saw last year. Ransomware gets the headlines. A wire going to the wrong account is what generates the claim.

And 71% of those funds transfer fraud claims came down to social engineering — no malware, nothing a firewall would have caught. Someone read an email that looked exactly right and moved money.

For a wealth management firm, that's the whole nightmare in one sentence. A client sells a position, the wire instructions get spoofed, and six figures leaves the account before anyone picks up a phone. Average loss on a funds transfer claim that started as a compromised mailbox: $112,000.

So ask your broker two questions. Is funds transfer fraud covered at my full limit, or a smaller one? And what controls do you expect me to have in place when I file? The answers surprise people more often than not.

Then make the attack harder. Verify every change to wire instructions by phone, on a number you already had. Watch for mailbox forwarding rules nobody set up. Treat "urgent" as a reason to slow down, not speed up.

Worth sorting out before your next renewal.