Commercial crime insurance: what it covers, what it doesn't, and what it costs
Commercial crime insurance pays your business back when its own money, securities or property are stolen: by an employee, through a forged or altered check, in a robbery, or by someone moving money out of your accounts with a fraudulent instruction. It is first-party cover, so it pays you, not people who sue you. Any business where staff take payments, run payroll, sign checks or can send wires should price it. Insureon's small-business customers pay a median of $75 a month, or $900 a year (Insureon, updated August 12, 2026). It is one of the specialty coverages in our business insurance guide.
The losses are bigger than most owners guess. The Association of Certified Fraud Examiners' 2026 study of 2,402 occupational fraud cases found a median loss of $126,000 at organizations with fewer than 100 employees, the highest of any size group, and the typical scheme ran 12 months before it was caught (ACFE, Occupational Fraud 2026). That is why a trusted bookkeeper is the classic claim.
What does commercial crime insurance cover?
A crime policy is a set of separate coverage parts (insurers call them insuring agreements). You choose which ones to buy, and each has its own limit on the declarations page. A part with no limit shown isn't covered. The parts below come from a Hiscox crime form (CRI P001, which includes ISO wording) and ISO's crime form as used in the State of Washington's 2024–25 policy; other insurers group and name them a little differently.
| Coverage part | What it pays for | Example |
|---|---|---|
| Employee theft | Money, securities and property your employees steal, whether or not you can identify which one | A bookkeeper pays a fake vendor she set up |
| Forgery or alteration | Checks and similar payment orders forged or altered in your name | Someone forges your signature on company checks |
| Inside the premises | Money and securities stolen, destroyed or gone missing at your premises; robbery or safe burglary of other property | A break-in at the safe in the back office |
| Outside the premises | Money and securities lost while an employee carries them, for example to the bank | The daily deposit is stolen on the way to the bank |
| Computer fraud | Property moved out of your premises or bank by someone fraudulently using a computer | A hacker gets into your bank portal and sends wires |
| Funds transfer fraud | Money your bank pays out on a fraudulent instruction you didn't send | A criminal calls your bank pretending to be you |
| Money orders and counterfeit money | Money orders that aren't paid and counterfeit currency you accepted in good faith | A customer pays with fake $100 bills |
Optional parts that matter for small businesses:
- Clients' property: pays your client when your employee steals from them. In the Hiscox form, the employee must be identified. This is the cover a cleaning, bookkeeping or home-service client is really asking about when they say "are you bonded?"
- ERISA: covers your employee benefit plan against dishonest acts by people who handle plan money (see the ERISA bond rule below).
- Social engineering fraud: covers an employee who is tricked into sending money. Covered separately in the next section, because it is where most crime claims go wrong.
What does crime insurance not cover?
Read the exclusions before you buy. In the two forms above:
- Theft by you, your partners or members: owners can't insure against themselves.
- An employee you already knew was dishonest: cover for an employee ends as soon as you (or a manager not involved) learn of theft or dishonesty by that person. Keep a known thief on the payroll and the policy stops covering them.
- Being tricked into handing money over: the Hiscox form excludes loss from being "induced by any dishonest act to voluntarily part with" money or property. That clause is why a fake-invoice payment usually isn't covered by a base policy.
- Indirect loss: income you would have earned, damages you owe others, and the cost of proving the size of the loss (ISO's form; some forms add limited claim-expense cover).
- Shortages you can only prove from the books: ISO's form won't pay a loss whose existence or size depends only on an inventory count or a profit and loss calculation. If you suspect staff theft, you need evidence of the loss apart from the stock count; the form then lets you use inventory records to support the amount.
- Confidential information: losses from stolen trade secrets or leaked customer data (ISO's form). That is a cyber insurance problem.
Social engineering: the gap that catches most owners
A typical case: your bookkeeper gets an email that looks like it's from a regular supplier, with new bank details, and pays the next invoice to the fraudster. Your employee sent the money willingly, so computer fraud and funds transfer fraud cover usually don't apply. Travelers says traditional crime policies "often limit losses" to schemes the business didn't knowingly take part in, which is why it sells a separate social engineering fraud endorsement (Travelers).
The endorsement's limit can be much lower than the rest of the policy. In a 2022 Minnesota federal case, SJ Computers lost $593,555 to a fraudulent wire request. Travelers paid the $100,000 social engineering limit, and the court ruled the $1 million computer fraud cover didn't apply (Business Insurance). The scale is large: the FBI's Internet Crime Complaint Center logged $3.05 billion in business email compromise losses in 2025, up from $2.77 billion in 2024 (IC3 2025 report).
Ask any insurer three things: is social engineering included, what is its limit, and does it require a callback to verify changed bank details before a claim will pay.
Crime insurance vs fidelity bond vs cyber insurance
These three overlap in name and leave gaps in practice.
| Commercial crime insurance | Fidelity bond (janitorial, business services) | Cyber insurance | |
|---|---|---|---|
| Who it pays | Your business | Usually your client | Your business, plus claims against you |
| Typical loss | Employee steals from you; forged check; fraudulent transfer | Your employee steals from a client's home or office | Data breach, ransomware, notifying customers |
| Do you repay the insurer? | No | No (Insureon) | No |
The Surety & Fidelity Association of America says fidelity bonds today are two-party insurance policies, and it uses "commercial crime policy" and "employee dishonesty insurance" as other names for them. Insureon draws the line by who is protected: first-party crime cover protects your business, and third-party crime cover (the fidelity bond) protects your clients (Insureon). These are different from the surety bonds a license or construction contract requires, which you must repay after a claim; see surety bonds.
Insureon also notes that crime and cyber policies often cover different losses, and social engineering can sit in either one. If you carry both, ask each insurer which policy answers a fake payment request so you don't find out after the money is gone.
Does my business owner's policy cover employee theft?
Only if you added it. ISO's standard business owner's policy offers employee dishonesty as an optional coverage, paid up to the limit you choose on the declarations (Verisk ISO overview, 2025). Insureon says first-party employee dishonesty can also be endorsed onto a commercial property or package policy. Check the limit against the ACFE figures above: a small add-on limit can be used up by one long-running scheme. General liability doesn't cover theft from your own business at all.
Who needs commercial crime insurance?
Price it if any of these apply:
- Staff handle cash, checks or payments: retail, restaurants, auto shops and anyone with a register or daily deposit. See retail store insurance.
- One person runs the books: ACFE found only about a quarter of small businesses have a fraud hotline, against 85% of larger ones, and tips catch more frauds (43%) than any other method.
- You hold client money or property: bookkeepers and accountants, property managers, law firms, and cleaning companies whose crews work in clients' premises. See also insurance for accountants.
- You send wires or ACH payments to suppliers: that is the social engineering exposure.
- You sponsor a retirement plan: federal law (ERISA §412) requires anyone who handles plan funds to be bonded for at least 10% of the funds they handle, with a minimum of $1,000 and a maximum of $500,000, or $1,000,000 if the plan holds employer securities (29 U.S.C. 1112). Some crime policies include an ERISA part that meets this.
- You run a nonprofit: Travelers lists nonprofits among the organizations its crime cover is built for; see nonprofit insurance.
How much does commercial crime insurance cost?
Insureon's small-business customers pay a median of $75 a month ($900 a year). 56% pay under $100 a month and another 23% pay $100 to $200; across all customers, premiums run from about $150 to more than $6,000 a year. Most of those customers have fewer than five employees (Insureon, updated August 12, 2026).
| Business type | Median monthly premium |
|---|---|
| All Insureon small-business customers | $75 |
| Healthcare professionals | $27 |
| Professional services | $109 |
| Finance and accounting | $307 |
These are Insureon's figures for its own customers. Insureon calls them averages; its method note says they are medians of policies sold.
What moves the price, per Insureon: the limit (or bond amount) and deductible, your industry, how many employees can touch money, accounts or client property, your controls (background checks, audits, separating duties) and credit. Adding social engineering or client-property cover raises it.
What the insurer will ask
Expect a crime application with questions like these. Answering them well lowers the price, and the controls are worth having anyway:
- Who can sign checks, approve payments and send wires, and does any payment need two people?
- Does someone other than the person who makes deposits reconcile the bank account?
- Do you call a known number to confirm any change to a vendor's bank details?
- Do you run background checks, and do bookkeeping staff take vacations? (ACFE lists refusal to take vacations among the red flags with the highest median losses.)
- Have you had a theft or fraud loss before, and what changed afterwards?
Ready to price it? Ask the insurer or broker that writes your business owner's policy or general liability, since many sell crime cover as an add-on or a separate policy, and tell them which parts you need: employee theft, client property, social engineering.
Frequently Asked Questions
What does commercial crime insurance cover? It pays your business for its own money, securities and property lost to employee theft, forgery or alteration, robbery and burglary, computer fraud, funds transfer fraud and counterfeit money, depending on which parts you buy. Optional parts cover theft from your clients by your employees, ERISA plan losses, and social engineering scams.
Is a fidelity bond the same as crime insurance? Close. The Surety & Fidelity Association of America treats "fidelity bond" and "commercial crime policy" as names for the same kind of employee dishonesty insurance. In everyday use, a "fidelity bond" or "janitorial bond" usually means cover that protects your clients from your employees, while a crime policy protects your own business and can include client cover as an add-on.
Does crime insurance cover wire fraud and fake invoices? A fraudulent transfer that someone else sends from your account falls under funds transfer fraud or computer fraud. A payment your own employee sends after being tricked usually doesn't, because of the voluntary parting exclusion. You need a social engineering endorsement for that, and check its limit, which can be lower than the rest of the policy.
Is crime insurance written on a discovery or loss-sustained basis? Either, depending on the insurer's form. A discovery form covers losses you discover during the policy period, even if the theft started earlier. A loss-sustained form covers losses that happen while the policy is in force, so ask how long after it ends you have to find them. If you switch from one to the other, ask about the form's "policy bridge" condition so older thefts aren't left uncovered.
How much does commercial crime insurance cost? Insureon's small-business customers pay a median of $75 a month ($900 a year), and 56% pay under $100 a month. Finance and accounting firms pay a median of $307 a month and healthcare practices $27.
Do I need an ERISA bond? If your business sponsors a retirement or other benefit plan covered by ERISA, everyone who handles plan funds must be bonded for at least 10% of the funds they handle (minimum $1,000, maximum $500,000, or $1,000,000 if the plan holds employer securities). Some crime policies include an ERISA part that does this; otherwise it is bought as a separate bond.
Related Terms
- Business Owner's Policy (BOP) – can carry an employee dishonesty add-on, at the limit you choose
- Cyber Liability Insurance – covers data breaches and ransomware; ask how it splits fake-payment losses with your crime policy
- Directors & Officers (D&O) Liability – often sold with crime in a management liability package; see our D&O guide
- Surety bonds – license and contract bonds you repay after a claim, unlike crime insurance
