Every day, employees across businesses of every size open emails, approve invoices, click links, and share login credentials — often without a second thought. That routine is exactly what cybercriminals count on. Phishing scams have become one of the most persistent, costly, and rapidly evolving threats facing businesses today, and no company — regardless of size or industry — is immune.

What makes these attacks particularly dangerous is not just their volume. It is their sophistication. Modern phishing attempts do not look like obvious spam. They mirror real vendor branding, reference legitimate internal processes, impersonate executives, and exploit the natural trust employees extend to familiar communication channels. By the time a business realizes an attack was successful, the financial and operational damage is already underway.

For businesses operating in today’s environment, understanding how phishing scams originate, escalate, and ultimately intersect with commercial insurance programs is no longer optional. It is a foundational element of responsible risk management.

The Data Is Speaking — and Businesses Need to Listen

The numbers surrounding phishing and cyber-enabled fraud are not abstract projections. They are current, documented, and trending in the wrong direction for any organization that is not actively managing this risk.

According to the FBI’s 2025 Internet Crime Report, the Internet Crime Complaint Center (IC3) received more than one million complaints for the first time in its history — a significant increase from 859,532 complaints in 2024. Total reported cybercrime losses reached $20.877 billion in 2025, a 26% increase year over year. Phishing and spoofing topped the list by complaint volume, with 191,561 reported incidents.

The financial damage embedded in those numbers goes well beyond the complaint count. According to the FBI IC3 2025 report, BEC alone accounted for $3.04 billion in losses — the second-highest loss category behind investment fraud. Industry analysis of the IC3 report by Red Sift found that across three email-origin crime categories — Business Email Compromise, phishing, and government impersonation — combined losses exceeded $4 billion in 2025, a 46% increase from 2024. Phishing losses alone grew 208% year over year, even as complaint volume held roughly flat. That means each successful attack is doing far more damage than before. According to IBM’s Cost of a Data Breach Report 2025, the average cost of a breach initiated by phishing reached $4.8 million. In the United States, the average cost of a data breach across all vectors climbed to $10.22 million.

Business Email Compromise deserves its own attention. BEC is a sophisticated, targeted form of phishing in which criminals impersonate trusted internal or external parties — a CEO, a vendor, an accounts payable contact — to deceive employees into authorizing fraudulent wire transfers, changing payment account information, or surrendering sensitive credentials. Over the three-year period from 2022 through 2024, BEC generated nearly $8.5 billion in total losses reported to IC3, according to Nacha — and in 2025 the trend continued, with $3.04 billion in losses reported in that year alone. A separate survey by the Association for Financial Professionals found that 63% of organizations experienced BEC in 2024.

For small and mid-sized businesses, the risk profile is not softer — it is often worse. According to Heimdal Security, 43% of small and medium-sized businesses faced at least one cyberattack in the past 12 months, and phishing is the most common attack type, appearing in 33.8% of all SMB breaches. Yet research consistently finds that fewer than half of businesses with fewer than 50 employees have a formal cybersecurity plan in place — making them precisely the targets that cybercriminals prioritize. It is often easier for an attacker to collect $50,000 from 20 small businesses than to attack a large corporation with hardened defenses. The average downtime following a successful phishing-led attack is now 24 days — nearly a month of operational disruption for a business that may have no playbook for recovery.

Why This Is an Insurance Problem, Not Just an IT One

Many business owners respond to phishing threats as a technology or IT matter — adding a spam filter, implementing a password policy, and moving on. That instinct is understandable. It is also dangerously incomplete.

Phishing scams are a commercial insurance problem. A single successful attack can trigger exposure across multiple lines of coverage simultaneously, and how well or poorly an organization has structured its internal controls directly determines how it is priced, underwritten, and — in serious cases — whether it remains insurable at the limits it needs.

Here is where phishing and cyber-enabled fraud create specific insurance exposure across a business’s commercial program:

Cyber Liability Insurance

This is the most direct line of exposure, and the one most businesses think of first. Cyber liability coverage is designed to respond when a breach, attack, or cyber event results in financial loss. Depending on policy structure and endorsements, coverage can include forensic investigation and incident response costs, business interruption and lost net income during system downtime, legal fees, regulatory fines, and notification expenses for affected customers or partners.

One critical point that many businesses miss: standard cyber liability policies do not automatically cover losses arising from social engineering fraud — the category that includes phishing-induced wire transfers and BEC. The Coyle Group’s cyber insurance analysis specifically identifies social engineering fraud coverage as one of the fastest-growing forms of cybercrime loss, noting that many base policies exclude it unless specifically endorsed. A business that suffered a fraudulent wire transfer because an employee was deceived by a convincing vendor impersonation email may find that its cyber policy responds differently than expected — or not at all — if that endorsement is absent.

Verifying that social engineering fraud coverage is explicitly included in your cyber policy is not a minor housekeeping item. It is a material gap in your program if it is missing.

Commercial Crime and Fidelity Coverage

There is meaningful overlap between phishing-enabled financial fraud and commercial crime coverage, and many businesses are uninsured or underinsured in this area without realizing it. Commercial property policies typically do not cover losses resulting from employee dishonesty, fraudulent wire instructions, or unauthorized fund transfers. A standalone commercial crime policy or fidelity bond is designed to address this exposure.

For businesses that process payments, handle client funds, or operate with financial access distributed across multiple staff members, this is not a theoretical risk. A construction firm’s controller tricked into wiring $250,000 to a fraudulent vendor account is a commercial crime claim, not simply a cyber claim. Businesses without the right policy structures in place absorb that loss entirely out of pocket.

Professional Liability / Errors and Omissions (E&O)

If your business delivers professional services to clients, the connection between a phishing-enabled breach and E&O exposure is direct. When compromised credentials lead to unauthorized access to client systems, exposure of confidential client data, or the delivery of corrupted or fraudulent outputs, the resulting client harm falls squarely within the professional liability exposure spectrum. Organizations where cyber awareness is weak tend to also have weaker data governance, weaker access controls, and higher rates of undetected compromise — all of which increase E&O claims frequency.

General Liability and Business Interruption

Phishing attacks that result in ransomware infections or system lockouts create business interruption losses that ripple across a commercial program. Depending on policy structure, business interruption coverage may respond to downtime caused by a cyber event — but only if the policy is structured to include it and if the cause of the loss qualifies under the policy’s trigger language. Many general liability policies contain explicit cyber exclusions, meaning that phishing-caused losses that might otherwise seem covered are carved out entirely unless a cyber-specific policy is in place.

Common Phishing Tactics Targeting Businesses

Understanding how these attacks work is the starting point for building defenses that hold up under real-world pressure. The most frequently used and financially damaging tactics include:

Spear Phishing

Unlike broad phishing campaigns that cast a wide net, spear phishing is highly targeted. Attackers research a specific employee — often someone in finance, HR, or a leadership role — and craft a personalized message that references real colleagues, ongoing projects, internal systems, or company language. The result is a message that looks nothing like generic spam and is specifically designed to pass the threshold of casual skepticism.

CEO Fraud and Executive Impersonation

In this variant, an employee in accounts payable or HR receives an email that appears to come from the company’s CEO or another senior executive requesting an urgent wire transfer, a change to direct deposit information, or access to sensitive employee data. The message typically creates time pressure — “I need this done before I get on a flight” — specifically to discourage the employee from pausing to verify through a secondary channel. According to FBI IC3 data, high-value executive-targeting attacks average tens of millions of dollars per incident.

Vendor and Invoice Fraud

Attackers impersonate a known vendor, often by compromising that vendor’s email account or by registering a domain that closely mimics the real one. The employee receives what appears to be a legitimate invoice or a notification of updated banking details. The payment goes to a fraudulent account. By the time the discrepancy is discovered, recovery is difficult and often incomplete.

Credential Harvesting

Employees receive a message directing them to a login page that appears identical to a real platform — Microsoft 365, a payroll portal, a banking interface — and unknowingly enter their credentials into an attacker-controlled site. Those credentials are then used to access internal systems, move laterally through the organization, or stage a larger attack. According to the 2025 Verizon Data Breach Investigations Report, 60% of all breaches involved the human element, and stolen credentials appeared as an initial access vector in 22% of incidents.

AI-Generated Phishing

This is the emerging frontier that is materially changing the threat landscape. Large language models have reduced the time required to craft a convincing, grammatically flawless phishing campaign from approximately 16 hours to five minutes. According to VIPRE Security Group’s Q2 2024 Email Threat Trends Report, 40% of BEC emails analyzed were assessed to be AI-generated. The practical implication for businesses is significant: the traditional heuristics employees use to spot phishing — poor grammar, generic salutations, obvious misspellings — are increasingly unreliable signals. The FBI’s 2025 IC3 report introduced AI-related crime as a formal category for the first time, logging over 22,000 complaints with nearly $893 million in associated losses.

Where Internal Controls Break Down — and Why It Matters for Coverage

Strong cyber defenses do not typically collapse all at once. They erode gradually, through predictable patterns that organizations can identify and correct — if they are paying attention.

Absent or Inconsistent Security Awareness Training

Employee behavior is the most exploited attack surface in any organization. According to the 2025 Verizon DBIR, the median time from email delivery to an employee clicking a malicious link is just 21 seconds. Training that was delivered once at onboarding, or that consists of a single annual video, does not create the reflexive vigilance that withstands real-world pressure.

Effective security awareness programs include regular, role-specific training that covers how to identify suspicious senders, how to handle unexpected payment or credential requests, what to do when something seems off, and how to report concerns quickly. Simulated phishing campaigns — where employees receive controlled test messages that mimic real attack techniques — reinforce training with practical, low-stakes practice that builds organizational muscle memory.

From an underwriting standpoint, carriers increasingly require documented security awareness training with proof of completion as a condition of coverage. According to Aldridge’s cyber insurance qualification analysis, businesses without an active training and simulated phishing testing program may find coverage unavailable or significantly restricted.

No Multi-Factor Authentication

Multi-factor authentication is arguably the single highest-impact technical control a business can implement against credential-harvesting phishing attacks. Even when an employee’s login credentials are successfully stolen, MFA creates an additional verification barrier that prevents attackers from accessing the system.

Cyber insurance underwriters have moved firmly past treating MFA as a best practice recommendation. According to ManageEngine’s cyber insurance MFA analysis, carriers now require MFA implementation as a prerequisite for policy approval — covering privileged accounts, remote access, email, and cloud platforms at minimum. According to Marsh McLennan, 41% of cyber insurance applications are denied on first submission, with missing MFA and inadequate endpoint protection among the most common reasons. Businesses that present for renewal without MFA in place should expect narrower coverage, higher premiums, or outright denial.

Weak or Absent Payment Verification Protocols

One of the most directly costly gaps in business phishing defense is the absence of formal protocols for verifying payment and wire transfer instructions received via email. When a finance employee receives an invoice with updated banking details or an executive request to wire funds, that request requires independent, out-of-band verification — a separate phone call to a known contact number, for example — before being processed.

Organizations that rely on email alone to verify financial transactions are structurally exposed to vendor impersonation and BEC attacks. The control is not complex, but it requires clear written policy, consistent enforcement, and explicit training on why the protocol exists and what it prevents.

No Incident Response Plan

When a phishing attack succeeds, the organization’s ability to contain the damage and minimize financial loss depends entirely on how quickly and competently it responds. Businesses without documented incident response plans — defining who to call, what to shut down, how to preserve evidence, when to notify regulators, and who manages external communication — lose critical hours in the moments that matter most. Cyber insurance carriers increasingly require evidence of incident response planning as a condition of underwriting, and organizations with tested plans experience materially faster containment and lower total breach costs.

Outdated Email Security Infrastructure

Domain authentication tools — specifically SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) — provide foundational technical protection against email spoofing and domain impersonation. When properly configured, they help prevent attackers from sending emails that appear to originate from legitimate company or vendor domains.

Research by Red Sift found that only 35 to 44% of top U.S. organizations across major regions have reached full DMARC enforcement — meaning the majority of businesses remain structurally vulnerable to domain spoofing attacks. Spam filters alone are insufficient. Comprehensive email security requires domain authentication, endpoint detection, and active monitoring working together.

The Specific Coverages Businesses Need to Review

Given the threat landscape above, businesses should be evaluating their commercial program not only at renewal, but as an active reflection of how their cyber risk environment is actually functioning. Several specific coverage areas deserve close attention:

Cyber Liability — Confirm Social Engineering Fraud Endorsement

Review your cyber liability policy for explicit social engineering fraud coverage. Verify that losses arising from phishing-induced wire transfers, BEC-related fund diversions, and fraudulent invoice payments are covered — not excluded or subject to sublimits that don’t reflect your actual transaction volumes. For businesses handling significant financial transactions or managing client funds, this endorsement is not optional.

Commercial Crime / Fidelity

Confirm whether your commercial property or package policy covers losses from fraudulent wire transfers or unauthorized fund transfers. If it does not — and most standard property policies do not — a standalone commercial crime policy or fidelity bond is necessary to close that gap. This is particularly critical for any business with employees handling payments, vendor relationships, or client asset management.

Cyber Liability — Business Interruption

Verify that your policy’s business interruption coverage responds to cyber-caused downtime and that the trigger language does not require physical damage as a precondition. Phishing-initiated ransomware that locks business systems causes the same operational disruption as a physical event — the coverage should reflect that.

Limits Relative to Realistic Exposure

Cyber liability limits set during an earlier period may no longer reflect the business’s actual exposure. As revenue, transaction volume, data volume, and vendor relationships grow, so does the potential loss magnitude. Review limits against current breach cost benchmarks — including the $10.22 million U.S. average — and confirm that deductibles are calibrated against realistic first-dollar costs for even a contained incident response.

For businesses that want to understand how their full commercial program maps to their actual cyber risk exposures, the Commercial Insurance and Risk Management Services page provides a structured starting point for that conversation.

Building Internal Controls That Actually Reduce Risk — and Reduce Claims

Effective cyber defenses share a common set of characteristics across the organizations that manage this risk most successfully. They are documented, consistently enforced, regularly tested, actively communicated, and structured in ways that hold up under the scrutiny of a cyber insurance underwriter — or a breach investigation.

Documented, Role-Specific Security Training

Security awareness programs should be designed around how employees actually encounter phishing — through email, vendor communications, and internal platforms — and should be updated as attack techniques evolve. Training should be repeated at meaningful intervals, not delivered once. Completion records should be maintained and available for underwriting review. The investment rationale is clear: the 2025 Verizon DBIR links 60% of all breaches to the human element, and no other single control category offers the same per-dollar return on reducing breach frequency.

Mandatory MFA Across All Critical Access Points

Multi-factor authentication should be enforced on email, remote access, cloud platforms, financial systems, and all privileged accounts. Implementation should be documented and verifiable. Carrier questionnaires now ask for proof of MFA adoption, not assertions of intent. According to MoneyGeek’s cyber insurance research, businesses with strong security controls — including MFA — can reduce cyber insurance premiums by 15 to 30% compared to those without.

Payment Verification Protocols — Written, Trained, and Enforced

Wire transfer and payment instructions received by email should require independent verbal verification before processing. Updated vendor banking details should require a documented approval workflow that does not rely solely on the email chain containing the request. These protocols should be codified in written policy, communicated during employee onboarding and training, and applied consistently regardless of the seniority of the requester.

Documented Incident Response Plan

Every business should have a written incident response plan that defines the steps to take when a phishing attack is suspected or confirmed — covering initial containment, evidence preservation, internal communication, regulatory notification obligations, and engagement with legal counsel and your cyber insurance carrier. It should be tested through tabletop exercises and updated annually.

Email Authentication and Technical Security Infrastructure

SPF, DKIM, and DMARC should be implemented and enforced. Endpoint detection and response tools should be deployed on all business devices. Patch management should be current. These are not advanced enterprise-level capabilities — they are baseline requirements that cyber insurance carriers now treat as prerequisites for coverage eligibility.

HR and Risk Management Support Infrastructure

For businesses without full internal IT or HR capability, access to professional risk management consultation on demand is a practical, high-value tool. Ensuring that cyber incidents, vendor communications, and employee security concerns are handled by people with the expertise to navigate them — rather than managers improvising under pressure — meaningfully reduces the frequency of escalation into covered losses.

Infinity Insurance Partners offers clients access to HR and business risk reduction tools, as well as structured risk management resources designed to support proactive operational risk management.

How This Connects Directly to Your Insurance Program

Phishing scams do not stay contained to a single email. A successful attack escalates into financial loss, data exposure, regulatory inquiry, and operational disruption — often across multiple coverage lines simultaneously. The businesses that manage this risk most effectively have built the internal controls, the coverage structure, and the operational infrastructure to prevent escalation before it begins — and underwriters reward them for it at renewal.

The FBI IC3, IBM’s Cost of a Data Breach Report, and the Verizon DBIR all point to the same conclusion: early detection, consistent controls, and properly structured coverage are the most effective tools available for limiting the financial impact of phishing-related losses.

Infinity Insurance Partners works with businesses to align their commercial insurance programs with their actual risk environment — including the phishing and cyber exposures that most standard renewals fail to fully address. That means structuring cyber liability, commercial crime, professional liability, and business interruption coverage around how an organization actually operates, and treating the commercial insurance program as an active part of business risk management.

If your organization has not conducted a full review of its cyber liability coverage, its social engineering fraud endorsements, or the alignment between its risk management practices and its commercial insurance program, now is the right time to start that conversation.

Contact our team to discuss how your current risk controls align with your coverage — and where there may be gaps worth addressing before they become claims.

This blog is intended for general informational purposes and does not constitute legal or insurance advice. Coverage availability, terms, and requirements vary by state and circumstance. Consult a licensed insurance professional regarding your organization’s specific situation.