The treasurer is on the phone with the church’s insurance agent, and the question is simple enough. Two weeks ago the office administrator wired a payment to what turned out to be a fraudulent account — a convincing email, a changed set of bank details, a Friday afternoon. The money is gone, and the board wants to know whether the church is covered.
There is a pause on the line, and then the sentence so many church treasurers have heard: Let me pull the policy and call you back.
He calls the next morning. The church has property, general liability, directors and officers, and a crime policy with an employee dishonesty limit. None of them clearly respond — the employee dishonesty limit was written for theft by an employee, not for a payment an employee was tricked into authorizing, and nothing else in the file plainly addresses it. There is no cyber policy at all, because nobody ever asked and nobody ever offered.
MissionDefend is not an insurer, a broker, or an agent. We do not sell, place, or recommend coverage, and no insurer or broker paid for, commissioned, or reviewed this article. If we ever list insurance partners on this site, those listings will be labelled as such and kept separate from editorial posts like this one. What follows is how these policies are generally structured, so you can have a better conversation with the person who does advise you. It is general information, not insurance or legal advice, and it is not a statement of what any particular policy or insurer covers.
Why the policies you already have probably don’t respond
Most churches carry a package built around buildings, injuries, and the conduct of leadership. Those policies were designed for physical loss and bodily harm, and their language usually reflects it. A property policy is generally written around damage to tangible property, and data generally isn’t tangible property. A general liability policy is generally written around bodily injury and property damage, and a member’s exposed giving history is typically neither. Whether that holds in your case is a question about your wording, not a rule — which is why the answer has to come from the policy in your file.
For years there was real ambiguity here — the industry called it “silent cyber,” risk that a traditional policy neither clearly granted nor clearly excluded. Insurers didn’t like it either. The Government Accountability Office documented the response: insurers have been “adding exclusions to traditional lines of coverage and package policies with cyber endorsements to avoid any ambiguity that coverages would overlap with cyber policies.” Read that in the direction that matters to you — the trend has been toward removing the accidental coverage some organizations were relying on.
The second reason churches believe they’re covered is a small cyber endorsement sitting on the package, a bolt-on with a modest limit, often added at renewal without discussion. It exists, so the answer to “do we have cyber?” is technically yes. Whether it responds to the loss you actually suffered, and for how much, only reading it will settle.
The only reliable way to know what you have is to read your own policy with your broker, out loud, asking what each part would pay in a specific scenario.
What a cyber policy actually contains
Cyber coverage is not one thing. It’s a bundle of separately-limited parts in two families.
First-party covers your own costs — what it takes to deal with the incident. Typically:
Incident response and forensics. Specialists who work out what happened and shut it down. For a church with no IT department this is often the most valuable part, because it converts an unmanageable crisis into a phone number you call.
Breach counsel — a lawyer who does this constantly, usually from a panel the insurer maintains.
Notification costs — printing, mailing, a call center — for telling affected people, which state law may require, plus credit monitoring where it’s offered.
Business interruption. Lost income while you can’t operate: a giving platform or church management system unavailable across two Sundays.
Data restoration, the cost of rebuilding records, which is real work even when your backups are good.
Cyber extortion, which in some policies includes a ransom payment and in others covers only negotiation and recovery. Ask which.
Third-party liability covers what you owe other people — claims and lawsuits brought by members, donors, employees, or vendors whose information you held, plus regulatory proceedings and defense costs.
The clause that matters most to churches
The attacks in this series — the fake invoice, the changed vendor bank details, the payroll diversion, the urgent request that appears to come from the pastor — are not hacking in the technical sense. Nobody breaks anything. Somebody is persuaded to send money to the wrong account. In insurance language that’s social engineering fraud or funds transfer fraud, sometimes called deception fraud or fraudulent instruction.
Coverage for it is very often a separate endorsement, and it very often carries a much lower sublimit than the rest of the policy. A sublimit is a cap inside a cap — a maximum for one specific type of loss, sitting below your overall policy limit.
GAO’s 2021 review of the market illustrates the pattern, noting that risk factors “can result in lower coverage limits for certain perils, such as $250,000 for social engineering and wire transfer attacks on a policy with a $1 million total limit.” That’s one illustration from one report, not a standard, and your numbers may look nothing like it. The shape is the point: an organization that thinks of itself as holding a million-dollar policy may have a quarter of that available for the loss type it is most likely to experience.
The endorsement usually carries conditions too, and they tend to look like the money rule this blog keeps returning to — the insurer may require that you verified the payment instruction by call-back to a number you already had, before the funds went out. If your own written procedure says you do that and you didn’t, the claim gets difficult.
For scale, the FBI recorded 24,768 business email compromise complaints in 2025, with reported losses of $3,046,598,558 — which works out to roughly $123,000 per complaint.
So the question for your broker is not “do we have cyber insurance?” It is: do we have social engineering and funds transfer fraud coverage, what is its sublimit, and what does the policy require us to have done before the money went out?
Exclusions, conditions, and the application you sign
Prior known circumstances. Policies commonly exclude incidents you knew about, or reasonably should have known about, before the policy started. Discovering a compromise and then buying coverage is not a way to get that incident paid for.
War and infrastructure exclusions. Insurers have been tightening here to limit exposure to events that could hit thousands of policyholders at once. GAO notes that in November 2021 the Lloyd’s Market Association introduced specific exclusions for cyber war, and that some policies exclude “losses from outages of critical infrastructure services that are not under the control of the policyholder.” Worth a question, not a panic.
Warranties and application representations. This is the one that quietly matters most. Applications commonly ask whether you have specific controls: multi-factor authentication on email and remote access, backups tested and kept separate from your main systems, procedures for verifying payment changes, endpoint protection, patching. Some policies convert those answers into conditions of coverage. An inaccurate answer — even one given in good faith by a volunteer treasurer who assumed MFA was on because someone once mentioned it — can give an insurer grounds to reduce or deny a claim, or to void the policy. So: whoever signs must confirm each answer with the person who actually administers the system, and keep a copy of exactly what the church attested to.
How underwriting changed, and why that’s good news
The market went through a hard correction. Insurers responded by raising rates, reducing limits for sectors they considered riskier, adding sublimits, and — most relevantly for you — looking much harder at applicants. GAO’s 2021 review reported that, according to industry representatives and reports, “underwriters have been more carefully scrutinizing the risks posed by all entities, regardless of size or sector.”
From your side of the table, that means an application that asks real questions instead of taking your word for it — which sounds like an obstacle and is closer to an opportunity. Controls appear to be priced: reporting to GAO in 2021 put premiums “at about $1,400 to about $3,000 per million of limit for small entities that have strong cyber controls and are in low-risk industries,” and one broker expected renewal increases “more in the range of 5–10 percent for those with strong cyber controls” than for higher-risk entities. Those are 2021 figures from one market survey, not a quote for your church. Turning on multi-factor authentication is included at no extra cost on Microsoft 365 and Google Workspace and blocks, by Microsoft’s own measurement, more than 99.2% of account compromise attacks. Doing it before you apply may affect both what you pay and whether you’re offered terms at all — your broker can tell you how your carriers weigh it. And the questionnaire itself is a free gap analysis — whatever it asks about is, by definition, what the market has decided matters.
One caution. Depth varies enormously; GAO found “no standard cybersecurity risk assessment across providers,” with smaller organizations sometimes answering as few as four questions. A short application doesn’t mean you’ve been assessed, and a clean one doesn’t mean you’re secure.
The deadline nobody reads until it’s too late
Cyber policies typically require prompt notice of a claim or circumstance, often within a specific and short window — sometimes measured in days. Late notice is a common reason for a claim to fail, and it collides badly with human nature: the instinct after discovering a loss is to spend a few days working out what happened before making calls. Those are frequently the days the policy expected you to use for notifying.
So find your notice provision and write the deadline and the claims number on the front of the policy folder — and notify early, because most policies contemplate reporting a circumstance that might give rise to a claim, not only a confirmed loss.
None of this changes the first call. If money has moved, you call the bank’s fraud line first and report to the FBI at ic3.gov the same day — the Bureau’s Recovery Asset Team froze $507,042,623 across 3,574 domestic cases in 2025, and that process depends almost entirely on speed. The insurer comes immediately after, not instead.
Questions to ask your broker
Take this to the meeting. There are no wrong answers — you’re gathering facts about your own policy.
- Do our current policies exclude cyber events, and has that language changed at recent renewals?
- Standalone cyber policy or an endorsement on the package, and what’s the total limit?
- Do we have social engineering or funds transfer fraud coverage? Separate endorsement? What sublimit?
- What must we have done before a payment for that coverage to respond — is call-back verification required?
- Does it respond if a volunteer, rather than an employee, was the one deceived?
- Which of these are covered, and at what sublimit: incident response and forensics, breach counsel, notification, credit monitoring, business interruption, data restoration, extortion?
- Does business interruption respond if our giving platform or church management vendor goes down?
- What controls does the policy warrant we maintain, and what did our last application say we had?
- What’s the notification deadline, what number do we call, and who is authorized to call it?
- What are the war and critical infrastructure exclusions, and what’s our deductible?
Ask for the answers in writing, and file that email with the policy and the application.
What to do this week
Pull your current policies — all of them — and spend twenty minutes on the declarations pages looking for two things: the word cyber, and the words social engineering or fraudulent instruction.
Then email your broker three of the questions above: whether you have social engineering or funds transfer fraud coverage, what its sublimit is, and what the policy requires you to have done before a payment went out. Ask for the reply in writing.
Half an hour, no cost, and you’ll know whether your board’s assumption about being covered is accurate.
Terms vary enormously between carriers, and two policies with the same name can behave completely differently. Nothing here is advice to buy a particular product, and none of it is legal advice. The only reliable answer comes from reading your own policy alongside your broker or attorney.
MissionDefend’s free assessment covers many of the same control questions insurers now ask — how you handle email, donations, member data, and accounts — and returns a baseline score and a ranked list of what to fix first. Useful preparation for a renewal conversation.
No spam and no sales calls — just one email when it’s live.
Related reading
- the fraudulent payment request most claims come from
- the legal notification costs a policy may absorb
- the controls underwriters now ask you to have
MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.
Sources: U.S. Government Accountability Office, Cyber Insurance: Insurers and Policyholders Face Challenges in an Evolving Market (GAO-21-477); U.S. Government Accountability Office, Cyber Insurance: Action Needed to Assess Potential Federal Response to Catastrophic Attacks (GAO-22-104256); FBI Internet Crime Complaint Center, 2025 Internet Crime Report; Microsoft, mandatory multifactor authentication guidance.