HOA Social Engineering Fraud Insurance: Who Pays for a Spoofed Wire in 2026

Business email compromise cost victims $3.05 billion in losses reported to the FBI in 2025. HOA social engineering fraud insurance pays when an impostor tricks your manager into wiring money, if the crime policy lists that insuring agreement (the clause naming one covered loss). Fidelity and computer fraud wording usually won't respond, so we cover which agreement applies, whose account paid, and which steps keep the claim payable.

If our manager wires money to a fake vendor, does our crime policy pay?

Only if the policy includes social engineering or fraudulent impersonation coverage. A fake vendor email that convinces an authorized person to send a wire produces a voluntary payment. Standard crime wording places that payment outside both employee theft and computer fraud. So check the declarations page, the summary sheet listing each coverage and its limit, because the deciding line is either printed there or missing.

The numbers explain why insurers split this risk out. The FBI's Internet Crime Complaint Center (IC3) logged 24,768 business email compromise complaints in its 2025 annual report, second only to investment fraud by dollar loss.

An association's crime policy usually starts with fidelity coverage for insider theft. Our fidelity guide explains who requires a fidelity bond and at what limit. Outsider fraud sits in other insuring agreements, and HOA wire fraud coverage exists only where the policy lists one by name.

Funds transfer fraud vs social engineering: which one covers our wire?

The funds transfer fraud vs social engineering split turns on who gave the instruction. Funds transfer fraud coverage answers a fake instruction sent straight to your bank by someone outside the association, without anyone inside knowing. Social engineering covers your own person being tricked. A spoofed board-president email to your manager belongs there.

What the ISO crime form actually says

The 2015 crime forms from the Insurance Services Office (ISO) define a "fraudulent instruction" as one "fraudulently issued by someone else without your knowledge or consent" and pay funds transfer claims only for that kind. The government edition then adds an exclusion to its combined computer and funds transfer agreement. It removes loss from an "employee" acting upon any instruction that "proves to be fraudulent" unless the funds transfer provision covers it. Ohio's state risk office publishes the government edition of this ISO crime form with the same language.

The premises and in-transit theft agreements carry the voluntary parting exclusion. It removes loss when anyone acting for you is "induced by any dishonest act to voluntarily part with" property. Social engineering coverage exists to pay that loss back, which is why it's sold separately.

Courts have read older computer fraud and funds transfer wording both ways. In the 2016 Apache case, the Fifth Circuit called a fraudulent email "merely incidental" to an authorized payment and denied coverage. Six years later the Ninth Circuit revived a management company's computer fraud and funds transfer fraud claims on spoofed-email wires in the Ernst & Haas decision. Waiting out an appeal is a poor plan, so buy the named agreement.

How much will HOA social engineering fraud insurance actually pay?

Only up to its own limit, which can sit far below the crime limit your lender sees. Each insuring agreement carries a separate limit on the declarations page. A social engineering line can be written as a sublimit, a smaller cap inside the overall policy limit.

ISO's 2022 forms turned fraudulent impersonation into an optional insuring agreement inside the crime form, according to the International Risk Management Institute (IRMI). That agreement replaced the 2015-era endorsement (a form that adds or changes coverage). Some insurers still sell it as a social engineering fraud endorsement. Cyber policies offer versions too, and IRMI's glossary says those are "typically limited to $100,000" and apply only as excess over any commercial crime policy.

The Fannie Mae fidelity limit calculation sizes protection against people who handle funds. Surprisingly, it says nothing about impostors, so a board can satisfy its lender and still carry a thin limit for this loss.

Worked example (hypothetical)

For example, take a 150-unit association with a $500,000 crime limit, a $50,000 social engineering sublimit, and a $5,000 deductible. A spoofed "president" email asks the manager to wire a $120,000 roofing deposit to a new account. If the claim meets every condition, the policy would pay $50,000, leaving $70,000 that the association must cover from operating funds or reserves.

What happens if the money sits in the management company's accounts?

When management firm staff send a social engineering wire, the association's crime policy might not respond. ISO's employee definition leaves out independent contractors, and its funds transfer fraud agreement reaches only a "transfer account" the insured maintains. Look at the firm's crime policy first.

ISO defines a transfer account as "an account maintained by you at a 'financial institution'" that you can transfer from. Its employee definition excludes "any agent, independent contractor or representative of the same general character" not specified. A management company is an outside firm, though ISO's designated agents endorsement (CR 25 02) can treat its staff as employees for employee theft. That doesn't by itself extend social engineering coverage to them.

Association account or firm trust account

Whose account sent the wire matters. When the association's own account pays, its policy can respond if the impostor fooled someone the policy covers. A firm trust account may point the claim at the manager's policy. In Ernst & Haas, the management company claimed on its own crime policy after its clerk wired $200,000 on spoofed emails.

Put the answer in the management agreement. It should say which party carries social engineering coverage, who verifies payment changes, and who repays a loss. For the policy side, read about naming the management company as an insured, and see insurance for community association managers for the firm's own program.

Which payment controls keep our social engineering coverage valid?

Verify every new payment request or bank-detail change by calling a number already on file, never one in the email, and record that call before money moves. ISO's fraudulent impersonation wording requires a reasonable attempt to verify the request. Some insurers add stricter written conditions, so don't assume a quick reply email counts.

An IC3 public service announcement tells businesses to use "previously known numbers, not the numbers provided in the e-mail request" when they confirm transfers by phone. Apache shows the cost of skipping that step. Its staff called the number printed on the fraudulent letter and reached the criminals.

Callback and approval checklist

• Confirm any new vendor, changed bank details, or unusual wire by phone, using the number in the vendor file or board roster.
• Require a second board officer to approve wires above a set dollar amount.
• Log who called, which number, and when, before the transfer. An optional 2023 ISO endorsement requires documented verification and bars relying on contact details inside the request.
• Hold payments to a vendor's new account for a few business days. The pause gives the bank, or the real vendor, enough time to flag an account change that nobody at the vendor ever requested.
• Never reply to confirm.
• Turn on multi-factor authentication for board and manager email accounts.
• Ask the bank for callback or dual-approval features on outgoing wires.

The written procedure should match the policy's verification condition word for word, because an adjuster will compare the two after a loss. Coverwatch compares the verification condition on the crime form with the manager's payment procedure and flags gaps before renewal, along with the rest of the HOA insurance program.

What should our board do in the first hours after a fake wire?

After an HOA social engineering wire fraud loss, call the bank and request a recall, file at ic3.gov with full transaction details, and give the crime insurer written notice. Hours count here. In 2025 the IC3's Financial Fraud Kill Chain froze $679 million across 3,900 incidents, a 58% success rate, according to the same report.

"If you discover a fraudulent transfer, time is of the essence," the report warns. It also tells victims to file a complaint "regardless of the amount lost" with the IC3. ISO crime forms also require notice to the insurer as soon as possible and a sworn proof of loss within 120 days.

First-hours response steps

1. Call the bank's fraud line and request a wire recall.
2. File a complaint at ic3.gov with the transaction details.
3. Send the crime insurer written notice of the loss.
4. Save the spoofed emails with full headers, the invoice, and the bank confirmation.
5. Put the 120-day proof-of-loss deadline on the board calendar.

Owners may later question the board's controls, and that complaint can become a breach of fiduciary duty claim. Directors and officers (D&O) coverage handles that claim, not the crime policy.