Insurance · checked 16 October 2026
The call-back proof your insurer will ask for
Many commercial crime and cyber policies cover "social engineering" or "fraudulent instruction" losses, but often only if you verified the payment instruction through a different channel before paying. If you can't show it, the claim can be reduced or refused.
This page explains the common pattern. Your own policy wording is what counts: read it, or ask your broker.
What these conditions typically require
- Out-of-band verification: confirming a change to bank details by a method other than the one it arrived by, usually a phone call.
- A pre-existing contact: the number must come from your records from before the request, not from the request itself.
- Documented procedure: a written policy, and evidence it was followed for this payment.
- Sometimes a second approval or a limit above which extra checks apply.
Law firm Lowenstein Sandler has written about how this cover has become harder to rely on and why recovery without proof can be "incredibly challenging" ("Call Me Maybe").
Records worth keeping for every bank change
| Record | Example |
|---|---|
| How the request arrived | Email from billing@acme.com, 14 Oct 2026 09:12 |
| Number called and where it came from | +1 555 0100, from the supplier record created 2024 |
| Who called, when, who answered | Olivia, 14 Oct 10:42, spoke to Sam in accounts |
| What was confirmed | Sam read the new routing and account number; matched |
| Who approved | Max, 14 Oct 11:05 |
| Evidence the record wasn't edited later | Hash-chained log entry |
How PayeeGuard helps
Each verification produces a certificate with all of the above, and the log behind it is hash-chained so later edits show up. It won't change what your policy covers, but it means the evidence exists when you need it.
Start recording verifications Set up call-backs and approvals