2 emails a week: rate moves, regulation and money-saving tips. Unsubscribe anytime.
You are subscribed right away — we send a short notice you can unsubscribe from at any time.
What a real card-fraud case revealed about coverage limits — and what risk control has to do instead
Short answer: commercial insurance usually does not cover this. What a real card-fraud case taught us about where the coverage line sits — and why risk control, not insurance, is the control that matters.
We ship furniture. The first signal was dimensional: parcels 8" wide by 4" high, varying only in length, almost always filed under furniture item names. Filtering on that pattern returned 70-plus parcels — and only two of them turned out to be legitimate.
Four accounts were linked by three things: two accounts sharing the same phone and email, one account using four different names to place orders, and — the link that actually closed the loop — one card sitting active on two accounts at once. Names were useless here; the card was not.
The loss pattern was worse than the order value: on one order the carrier billed $2,464.81 against $42.64 collected. And because carrier costs on most orders had not been imported yet, what we could count was only a fraction of the total.
Commercial crime (fidelity) coverage is built around employee dishonesty — someone inside the business. Some policies add a social engineering endorsement, but that responds to money you were tricked into transferring out.
Goods shipped against a stolen card and never paid for are a goods loss — closer in nature to bad debt than to theft. Most commercial policies do not respond to it. Cyber coverage is written for data breach and ransomware; whether it stretches this far depends entirely on wording and endorsements.
So the honest answer to "does commercial insurance cover fraud?" is: it depends on the shape of the loss. Money transferred out — possibly. Goods taken — usually not.
Not identity checks. Behaviour rules. Four of them did the work, and the first was the most valuable because it needs no identity data at all.
Density ≥ 40 lb/ft³ combined with furniture item names returned 70-plus parcels with only two false positives. A card appearing on more than one account tied all four accounts together. Three or more cards bound within seven days — or a card unbound right after use — flagged both high-activity accounts. Shared phone or email with a known bad account flagged the other two.
Close the accounts, and block the cards by brand, last four digits and expiry so they cannot simply open a new account. Contact the carrier about parcels still in transit — re-weighing them may recover part of the loss.
Check whether the payment methods are truly detached on the processor side — an in-app "unbind" may only be a soft delete. Then report: the amount here was enough for a Canadian Anti-Fraud Centre report plus notification to the payment processor.
Primarily employee dishonesty — theft, forgery or fraud committed by someone inside the business. Many policies can be extended with a social engineering endorsement covering funds you were tricked into transferring. Neither responds to goods shipped on a stolen card.
Cyber policies are written around data breach, ransomware and system interruption. Some include a social engineering sub-limit. Whether any of it reaches a goods loss depends on the wording and endorsements — only a licensed broker can give you a firm answer on a specific policy.
Sometimes. Intercept parcels still in transit and ask the carrier to re-weigh and re-bill at actual dimensions; check whether the payment method is still attached on the processor side. For delivered parcels, treat the loss as bad debt and focus on the rule that stops the next attempt.