Business Email Compromise Drives Half of Travelers’ Cyber Claims

Financial fraud is reshaping cyber claims

Cyber losses are increasingly tied to operational disruption and payment fraud, extending beyond the ransomware and data breaches that have long dominated attention. At the recent NetDiligence Cyber Risk Summit in Philadelphia, insurance and incident response executives described financial fraud and business email compromise (BEC) as a growing share of claims. That shift matters because fraud can turn on a payment instruction or a change in access, without the visible system outage that often defines a ransomware incident. For businesses, the loss may arrive through ordinary-looking processes that are difficult to distinguish from legitimate work.

At Travelers, these incidents now account for about 50% of cyber claims. Christine Mapes, the insurer’s cyber managing director and counsel, said their frequency rose 57% between the first halves of 2025 and 2026. Severity has climbed about 30% since 2023. Those figures describe one insurer’s claims experience, rather than the whole market, but they point to a category insurers and clients can’t treat as a sideshow. Frequency and severity tell different parts of the story: more incidents mean more opportunities for loss, while rising severity suggests each event can carry a heavier cost.

“The thing that surprises people the most when I talk to them about claims recently versus three years ago or five years ago is the sheer volume of financial fraud and business email compromise (BEC) that we’re seeing,” Mapes said. The surprise may reflect how firmly ransomware has shaped public expectations of cyber risk. Payment fraud is less dramatic in appearance, yet a transfer authorized through a trusted channel can create a direct financial loss and trigger a complicated response involving employees, banks, insurers and investigators. This is more significant than it looks: the claim can begin with a routine business decision.

The methods have also shifted. Criminals increasingly manipulate IT systems, banking processes and authentication tokens, rather than relying on a victim to click a phishing link. Mapes said victims are sometimes persuaded to hand over access credentials themselves. That change complicates the familiar distinction between a technical breach and a human mistake; in practice, the two can reinforce each other. A convincing request may help an attacker obtain access, while control of an account or process can make later instructions appear credible. Businesses therefore face a problem that spans both technology and internal procedures.

Related: Industry Panel Highlights Challenges in Selling Cyber Insurance to SMEs

AI raises the credibility of impersonation

Artificial intelligence is supporting both cyber defenses and criminal operations. Blake Feldman, head of carrier channel cyber incident response at Integreon, described the dynamic as “an arms race.” He said threat actors use AI to gain access to systems more easily, research targets, assess the value of stolen data and overcome language barriers that might once have signaled fraud. The range matters: AI can support preparation and targeting as well as the message or interaction that persuades someone to act. It doesn't need to create an entirely new kind of fraud to raise the risk; making familiar tactics faster or more convincing can be enough.

“It’s taken limitations that the threat actor had, [and] it’s accelerated their bandwidth,” Feldman said. The claim is about capacity, not proof that every fraud attempt has become more effective. Automation can help criminals work across more targets and refine their approach, while an organization still has to judge whether a particular request is genuine. That imbalance puts pressure on processes built around recognizing obvious errors or suspicious wording. A polished message can pass a quick glance.

Sara Trokan, Westfield Specialty’s senior vice president of professional and cyber claims, said AI “makes impersonation more convincing.” She described fraud schemes that combine social media with email, text, audio and video to create believable scenarios. In some cases, employees thought they were discussing highly confidential business matters with senior executives before authorizing large fraudulent payments. The combination of channels can make a request feel corroborated, even when those signals trace back to the same deception (and this is the part most people overlook). A familiar voice or convincing video may increase confidence, but it doesn't independently verify the payment instruction.

It’s a problem of trust under time pressure. If you’re working in this space, the practical question is whether employees can pause a sensitive transaction and confirm it through a known channel, even when a request appears to come from someone senior. A process that depends on spotting a flawless imitation is a weak safeguard. People can be careful and still be misled.

Verification remains a practical control

For Lindsay Nickle, vice chair of the cyber team at Constangy and moderator of the panel, the response includes a familiar measure: raise awareness and verify sensitive requests through a separate, low-tech process. She said the industry should renew the kind of education used to address social engineering five or six years ago. The value of that advice is its clarity: when a request involves money, credentials or access, a second check can break the chain between persuasion and action. The check needs to use a route the requester didn’t supply as part of the same conversation.

That advice reflects a central challenge for businesses and insurers: as fraud becomes more tailored and convincing, controls still need to interrupt payment and access requests before they become losses. Travelers’ claim figures suggest the financial impact of those schemes is already material. Training can help employees recognize pressure and verify unusual requests, but organizations also need procedures that make verification possible during normal work. Otherwise, a safeguard that exists on paper may be skipped when a request feels urgent.

There’s no single control implied by the panel’s comments that will prevent every loss. Businesses have to consider how staff handle payment changes, credential requests and sensitive approvals, then check whether those routines leave room for independent confirmation. Insurers, in turn, are seeing claims that connect employee decisions with technical access and business processes. That makes the risk harder to describe as a simple matter of awareness or cybersecurity software alone.

What the claims shift signals

The reported increase in financial fraud puts pressure on how organizations define cyber readiness. A company may have tools aimed at ransomware and data theft while leaving payment approvals dependent on trust in email, a familiar voice or apparent authority. Similar fraud schemes typically exploit the gap between a legitimate process and the information employees use to decide whether a request belongs inside it. Closing that gap requires attention to workflow as well as technology.

For insurers, the figures raise questions about how frequently these events occur and how costly they become, while the panel’s examples show why the answer may depend on more than a technical review. A fraud claim can involve an employee’s actions, compromised access, banking procedures and the organization’s ability to detect or challenge a transfer. The speakers didn’t offer a forecast for future claim trends, and the figures from Travelers shouldn’t be read as one. They do show that financial fraud has become a substantial part of the claims picture described at the summit.

And yet, the remedy discussed was deliberately plain: awareness and separate verification. That may sound modest beside AI-enabled impersonation, but the control is aimed at the moment when a convincing story becomes an irreversible business action. The hard part is making that pause routine enough to survive urgency, hierarchy and a credible performance. A second check.