A spoofed email that changes the bank details on a progress payment or supplier invoice is usually not answered by a standard crime policy: its computer fraud and funds transfer fraud grants are built for break-ins and forged instructions to your bank, not a trusted employee who was fooled. Ransomware and exposed crew records belong to a cyber policy.
A new account number on the draw request
The loss starts in the office, not on the job. Paving money moves by bank transfer: progress payments, retainage releases and change-order payments coming in from an owner or general contractor, and invoices going out to the hot-mix plant, the emulsion or sealer supplier and the trucking sub. Every one of those transfers is a target.
The FBI’s Internet Crime Complaint Center, in its public service announcement on business email compromise, describes the scheme as “a sophisticated scam that targets both businesses and individuals who perform legitimate transfer-of-funds requests.” An email that appears to come from a supplier you pay every month, or from your own controller, announces new bank details just before an invoice or a draw is due. The U.S. Small Business Administration’s cybersecurity guidance for small businesses warns that “Phishing emails can appear legitimate, or appear to be sent from a known entity.”
The loss can run either way. If you pay a fake supplier account, your own money is gone, and that is a first-party question for your insurance. If your customer pays a fake account that claims to be yours, the money left the customer’s bank, and who bears it depends on the contract, the facts and the law that applies; your own contract and policy wording decide it, and nothing here is legal advice. The exposure is the same for a sealcoating company paying its sealer supplier and a striping contractor waiting on a property manager.
Computer fraud: the break-in that moves the money itself
The first grant answers an outsider getting into your system, where the fraudulent entry itself is what sends the money. It does not answer a person you gave access to.
The standard form to read is the Commercial Crime Coverage Form, Discovery Form (CR 00 20 11 15, the edition we read, an ISO form as commonly written). Its insuring agreement headed “Computer And Funds Transfer Fraud” is only part of a policy when the declarations show a limit for it, so check that it was bought at all. The computer fraud half pays for “Loss resulting directly from a fraudulent” entry or change of electronic data or a computer program in a computer system you own, lease or operate, where that entry causes “‘Money’, ‘securities’ or ‘other property’ to be transferred, paid or delivered” or causes “Your account at a ‘financial institution’ to be debited or deleted.”
The exclusions then take out the insider. The grant does not apply to an entry or change made “by a person or organization with authorized access to that ‘computer system’”, apart from a narrow route for instructions from a software contractor working under a written agreement. Your bookkeeper, your office manager and you all have authorized access.
The same crime form is also where employee theft is insured, and it comes in a discovery version and a loss sustained version (CR 00 21 11 15, the Loss Sustained Form, the edition we read); both are explained in employee theft and crime coverage for paving companies.
Funds transfer fraud: an instruction to your bank that claims to be you
The second grant is narrower than its name suggests. It answers a forged instruction sent to your bank in your name, not an instruction sent to your employee in someone else’s name.
The crime form covers “Loss resulting directly from a ‘fraudulent instruction’ directing a ‘financial institution’ to debit your ‘transfer account’ and to transfer, pay or deliver ‘money’ or ‘securities’ from that account.” The definition does the narrowing. A fraudulent instruction is “A computer, telefacsimile, telephone or other electronic instruction directing a ‘financial institution’ to debit your ‘transfer account’”, and it counts only if, in the form’s words, it “purports to have been issued by you, but which in fact was fraudulently issued by someone else without your knowledge or consent”.
The account in question is your transfer account, which the form describes as “an account maintained by you at a ‘financial institution’ from which you can initiate the transfer, payment or delivery of ‘money’ or ‘securities’”.
In practice, that is a thief who contacts your bank pretending to be you. It happens, but it is not the scheme most paving offices meet.
Why a payment your bookkeeper sends on a spoofed email usually falls outside both grants
When your own employee sends the money, both grants tend to miss. The employee meant to pay; the deception was only about where the money went.
It is not a funds transfer fraud, because the instruction to the bank came from your bookkeeper, with your authority, and did not pretend to come from you. It is not computer fraud, because nobody broke in and changed anything; an authorized user keyed a real payment. Then the crime form’s fraudulent instructions exclusion removes what is left. It excludes loss resulting from an “employee” or “financial institution” acting upon any instruction to transfer or pay money, or to debit your account, “which instruction proves to be fraudulent”, except where the funds transfer fraud grant or the software-contractor route applies.
Neither crime form we read uses the words social engineering or grants cover for an employee tricked into paying. Where that cover is offered, it is an added grant on a crime or cyber policy, and it can carry conditions of its own, such as a verification step before the money goes out; read whether yours does.
Real-World Scenario: A striping company’s office manager receives an email that looks like it comes from the paint supplier the company has paid for years, saying the supplier has changed banks, with new account details. The invoice is due, the email reads right, and she pays it. Weeks later the real supplier calls about the unpaid invoice. The company’s crime policy carries computer and funds transfer fraud, but no one broke into its system and no one forged an instruction to its bank, and no separate grant for tricked employees was ever added.
Ransomware on the estimating, payroll and dispatch files
Ransomware is the other office loss, and a crime policy is not built for it. The Cybersecurity and Infrastructure Security Agency’s #StopRansomware Guide puts it directly: “Ransomware is a form of malware designed to encrypt files on a device, rendering them and the systems that rely on them unusable.” The guide adds that it can arrive at the end of an earlier intrusion, including “business email compromise (BEC).”
For a paving company, the files at risk are estimating and takeoff files, bid documents with a deadline, job-cost records, payroll and certified-payroll records, and dispatch and plant-ticket records. The crime form does not pay to restore them. Its definition says “‘Other property’ does not include ‘computer programs’, ‘electronic data’ or any property specifically excluded under this insurance.” It also excludes “Loss that is an indirect result of an ‘occurrence’ covered by this insurance”, which takes out lost income.
Your general liability policy does not reach it either. The Commercial General Liability Coverage Form (CG 00 01 04 13, the edition we read) excludes, at I.2.p, “Damages arising out of the loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data.” At V.17 it adds: “For the purposes of this insurance, electronic data is not tangible property.” A stolen office laptop is a property loss; the files on it are not.
The CISA guide’s first preparation step is to “Maintain offline, encrypted backups of critical data”. Whether to pay a ransom is not a question this page answers. CISA lists the “cyber insurance company” among the stakeholders to notify, so call yours, and counsel, before anyone decides.
When crew records are exposed: who must be told, and who pays
A paving office holds more sensitive data than it looks: crew Social Security numbers, bank details for direct deposit, driver’s license and CDL copies, employment eligibility files, and the payroll records your workers compensation audit is built from. If they are exposed, notice duties can follow.
The CISA guide tells businesses to “Ensure that data breach notification procedures adhere to applicable state laws.” It also says to “notify affected individuals so they can take steps to reduce the chance that their information will be misused.” Those laws differ, and the ones that apply are the laws covering the people whose data it was.
The crime form leaves this cost out entirely. It excludes “The disclosure or use of another person’s or organization’s confidential or personal information” and “Fees, costs, fines, penalties and other expenses incurred by you which are related to the access to or disclosure of another person’s or organization’s confidential or personal information”. Nor is it an employment practices question; that policy answers how people were hired, treated and let go.
Cyber insurance: first-party costs, third-party suits and the package-policy version
A cyber policy is written for these losses, and with no standard form, each carrier’s grants are read on their own. The DC Department of Insurance, Securities and Banking’s small business insurance guide describes it as insurance that “protects businesses from the financial impact of cyberattacks and data breaches.”
The guide separates the claims by whose loss they are. “First-party claims are for losses directly experienced by the policyholder due to a cyber incident, such as data recovery costs or business interruption.” And “Third-party claims are for losses that the policyholder is liable for, such as lawsuits from customers due to a data breach”. It adds that the coverage “may cover costs like legal fees, fines, notifications to affected customers, and potentially ransom payments.” The same guide warns that its terms “may be known by different names or applied differently depending on the entity providing coverage.”
The Connecticut Insurance Department, in a notice on claims-made cyber liability insurance, described such coverage as covering “cyber, data and identity exposures often as endorsements to commercial general liability or businessowners’ policies.” Treat that as one department’s description, not a market survey, and find out whether you hold a standalone policy or an endorsement, whether it is claims-made, and whether it adds a grant for payments sent on fraudulent instructions. Whichever shape you hold, it is an office-side policy bought alongside your paving contractor insurance program, and none of the job-side policies in that program stands in for it.
Verify by phone before you pay, and move fast when you did not
The cheapest control is a phone call. The complaint center’s advice is to “Use secondary channels and/or two-factor authentication to verify requests for changes in account information.” In a paving office, that means a change in anyone’s bank details is confirmed by calling a number already on file, never a number in the email, before the next invoice or draw is paid. A second person approves any new payee, and a change request that arrives just before a draw date is treated as a warning, not a routine update. SBA adds, “It’s best to isolate payment systems from less secure programs.”
When a payment has gone out, speed matters. The announcement says “If you discover a fraudulent transfer, time is of the essence.” and “Immediately contact your financial institution and request a recall of the funds along with any necessary indemnification documents.” File a complaint with the Internet Crime Complaint Center and tell your insurers the same day. The crime form expects it: where a loss involves a violation of law, “you must also notify the local law enforcement authorities”, and you must “Secure all of your rights of recovery against any person or organization responsible for the loss and do nothing to impair those rights.”
Underwriters ask about the same controls: multi-factor authentication on email and banking, offline backups, who can release a payment, and whether the call-back rule is written down.
Send us your crime declarations, any cyber quote or endorsement you already hold and a short note on how your office approves payments, and request a quote; we will show you which of these losses your program would answer today.