We use analytics cookies to understand how the site is used and improve it. No tracking runs until you allow it. See our Privacy Policy.
Cover for the money that leaves your business through trusted staff, forged cheques and convincing emails.
Get a quoteIn short
Commercial crime insurance pays for money, securities and other property a business loses to dishonest acts, which a property policy covers only narrowly or not at all. Its insuring agreements cover employee theft, forgery or alteration of cheques, robbery and burglary of money, computer fraud and funds transfer fraud. Social engineering fraud, where an employee is tricked into sending a payment, is usually a separate, sublimited agreement that has to be added.
Last reviewed
Commercial crime insurance covers the losses a property policy doesn't: an employee who quietly diverts funds for years, a forged or altered cheque, a hacker who moves money from your bank account, and the impersonation emails that persuade staff to pay a fake supplier. Each of those is a separate insuring agreement with its own limit, so what you have depends on what you chose.
Most crime claims that go wrong fail on the details: a social engineering sublimit far below the payment that was diverted, a callback condition nobody followed, or a loss sustained form that only covers part of a long-running fraud. We set up crime coverage around how your money actually moves, and line it up with your cyber liability policy so every fraud has one clear home.
A crime policy is a set of separate insuring agreements, each with its own limit and deductible. You choose which ones to buy, so the declarations page tells you what you actually have. The usual menu looks like this.
| Insuring agreement | What it covers | Typical loss |
|---|---|---|
| Employee dishonesty (employee theft) | Direct loss of money, securities or other property caused by theft or fraud by an employee, acting alone or with others | A bookkeeper pays personal bills from the operating account for three years |
| Forgery or alteration | Loss from forged or altered cheques, drafts and promissory notes drawn on your accounts | A cheque is stolen from the mail, washed and cashed for a larger amount |
| Money and securities, inside the premises | Theft, disappearance or destruction of cash and securities on site, including robbery and safe burglary | Night deposit cash taken from the office safe after a break-in |
| Money and securities, outside the premises | The same losses while cash is with a messenger or armoured car company | A staff member is robbed on the way to the bank |
| Computer fraud | Loss from a fraudulent entry or change of data in your computer system that causes money or property to be transferred | An intruder gets into the payment system and adds a payee |
| Funds transfer fraud | Loss from fraudulent instructions sent to your bank, without your knowledge or consent, to move money out of your account | Someone impersonates your controller to the bank and wires out funds |
| Money orders and counterfeit currency | Accepting, in good faith, counterfeit currency or money orders that are not paid | A retailer takes counterfeit $100 bills over a busy weekend |
| Social engineering fraud (usually an add-on) | Loss when an employee is deceived into transferring money by someone impersonating a vendor, client or executive | Accounts payable updates a supplier's banking details on a fake email |
What crime insurance does not do is just as important. It does not pay for physical damage to your building or stock, which belongs on commercial property. It does not pay for data restoration, breach notification or ransomware response, which belong on cyber liability. And it does not cover ordinary shrinkage or shoplifting with no identifiable theft behind it, which our guide to organized retail crime explains.
Any business that pays suppliers by electronic transfer, gives staff access to its bank accounts, or holds cash, stock or client funds. The exposure is not about size. A five-person firm with one bookkeeper and no second signature can lose more, proportionally, than a large company with segregated duties.
Fraud is also badly under-counted. The Canadian Anti-Fraud Centre (CAFC) recorded more than 112,000 fraud reports and more than $704 million in reported losses in 2025, and the Competition Bureau estimates that only 5% to 10% of frauds are reported at all. Spear phishing, the targeted email fraud behind most payment diversion schemes, ranked second by dollar loss in the CAFC's 2025 figures at $67.9 million. The CAFC reports that Canadian businesses and organizations alone lost more than $43 million to spear phishing in 2025, with accounts payable staff often the target.
Employee fraud is usually found long after it starts. That makes the trigger, the rule that decides which policy year pays, the most important clause in the wording. Canadian crime policies use one of two.
| Discovery form | Loss sustained form | |
|---|---|---|
| Which policy pays | The policy in force when the loss is first discovered | The policy in force when the loss happened, if discovered during that policy or a short window after it |
| Past acts | Covers acts before the policy began, unless the wording sets a retroactive date | Earlier acts are covered only if prior insurance carried over, often through a superseded-insurance clause |
| When you switch insurers | The new policy picks up losses discovered after the switch | Gaps open if the old and new wordings do not dovetail |
| Main risk to watch | A retroactive date that cuts off years of hidden theft | A fraud that ran across several policy years, with only part of it covered |
Discovery generally means the moment you first become aware of facts that would make a reasonable person assume a covered loss has occurred, even if you do not yet know the amount or who did it. Report at that point. Waiting until the internal review is complete can breach the notice condition.
Most wordings also treat every act by the same person, or the same group acting together, as a single occurrence. That means one limit and one deductible apply to the whole scheme. As BFL Canada's Philippe Côté told Insurance Business in April 2026, a scheme repeated over and over generally counts as one loss. A weekly $2,000 fictitious invoice that runs for two years is one $208,000 claim against one limit, not 104 small ones.
Two more conditions matter. Coverage for an employee usually ends once an owner or officer, not in collusion, learns of any dishonest act by that person. And if you cancel or switch policies, check for an extended period to discover losses from the old policy term.
Payment fraud sits on the seam between cyber liability and crime. Some cyber policies include a social engineering or funds transfer extension; others leave theft of money entirely to the crime policy. The goal is for every scenario to have one clear home, without a gap or a fight between insurers.
| Event | Crime policy | Cyber policy |
|---|---|---|
| Employee steals money from the operating account | Employee dishonesty | Not covered |
| Staff pay a fake supplier invoice after a spoofed email | Social engineering agreement, if purchased | Only if the cyber policy has a social engineering extension |
| Hacker gets into online banking and moves money | Computer fraud or funds transfer fraud | Sometimes, under a funds transfer extension |
| Ransomware encrypts files and halts operations | Not covered | Extortion, data restoration and business interruption |
| Customer data exposed in the same intrusion | Not covered | Breach response, notification and privacy breach liability |
| Forged cheque cashed against your account | Forgery or alteration | Not covered |
A business email compromise often produces both kinds of loss at once: diverted payments and an exposed mailbox full of client data. Cyber pricing is soft at the moment, with Marsh putting Canadian cyber rates down 5% in the third quarter of 2026, which makes this a good renewal to line up both policies.
A crime limit should be set from what could realistically leave the business before anyone noticed, not from a round number in a package. Work through each agreement separately.
Crime wordings vary more between insurers than most commercial lines, so exclusions need to be read, not assumed.
| Excluded or limited | How to close the gap |
|---|---|
| Voluntary parting: money handed over by an employee who was tricked | Buy a social engineering agreement; Future Electronics shows the exclusion can bar other agreements |
| Theft by owners, partners or directors | Generally not insurable for owner-managed firms; rely on outside accountants and board oversight |
| Acts by an employee after you knew of earlier dishonesty | Act on red flags immediately and remove access; disclose known issues at renewal |
| Inventory shortages proved only by a count or profit calculation | Keep records that identify the specific theft; some forms allow inventory evidence to support a proved loss |
| Loss of income, data and investigation costs | Add claim expense coverage where offered; insure data and downtime under cyber |
| Losses from trading or investment decisions | Not insurable under crime; governance belongs with directors and officers cover |
| Damage to premises during a burglary | Insured under commercial property, not crime |
A wholesale distributor receives an email from what appears to be its largest supplier's accounts receivable manager. The supplier has changed banks, the email says, and the next invoice should be paid to a new account. Accounts payable updates the vendor file and sends three payments over six weeks totalling $186,000 before the real supplier calls about its overdue balance.
The distributor has a crime policy with a $500,000 employee dishonesty limit, $250,000 funds transfer fraud, and a social engineering endorsement at $50,000 with a $5,000 deductible. The funds transfer agreement does not respond, because the distributor's own employee instructed the bank. The three payments are one scheme, so one limit and one deductible apply. The social engineering endorsement pays $45,000. The remaining $141,000 is the distributor's, less anything the bank manages to recall.
Two things would have changed the outcome: a callback to a known number before any banking change, as the CAFC recommends, and a social engineering limit sized to a full payment run.
Crime premiums are set by the agreements and limits you buy, and above all by how hard your controls make it to steal.
Small firms can often add crime to a package policy or bundle it with property and liability. Larger limits, social engineering above the package sublimit, and businesses with client funds usually need a standalone crime policy.
Insurabiz is an independent brokerage that works only in business insurance. We don't work for one insurer, so we can match the crime wording to how your money actually moves.
Our claims team works with you, the adjuster and any forensic accountant from first notice to settlement. For prevention, our guide to employee theft and crime coverage covers the two-person controls that stop most internal fraud.
Good to know
Sources
This page is general information, not insurance or legal advice. Coverage depends on your policy wording and the insurer. Speak with a licensed broker about your situation.
Insurer partners
We shop these partners to find the right coverage and price for you.
Commercial Crime Insurance
Compare 17 insurers, no obligation
Speak with an advisor
A fast, no-obligation quote from Canada's commercial insurance specialists. Real advice, the whole market compared, and someone who picks up the phone.
Social engineering fraud: the gap most policies leave open
In a social engineering loss, nobody hacks anything. A fraudster sends a convincing email from a spoofed or compromised account, often posing as a supplier with new banking details, and your own employee sends the money. Because an authorized person initiated the payment, the standard computer fraud and funds transfer fraud agreements usually do not respond.
Canadian courts have confirmed it. In The Brick Warehouse LP v. Chubb Insurance Company of Canada, 2017 ABQB 413, a fraudster posing as a vendor persuaded accounts payable to record a new bank account, and the retailer then sent several payments to it. The Alberta court held that the funds transfer fraud agreement did not apply, because the instructions to the bank came from the insured's own employee and were made with its knowledge or consent. In Future Electronics v. Chubb, 2020 QCCS 3042, a vendor impersonation loss was held to fall only under the social engineering endorsement, which carried a $50,000 limit, rather than the computer fraud and funds transfer agreements, which carried $25 million.
The lesson is simple: if you pay by transfer, you need social engineering coverage named on the declarations page, at a limit that reflects your payments.