The callback warranty trap: why funds transfer fraud claims get denied
The most expensive sentence in a commercial crime policy is usually not an exclusion. It is a condition the insured agreed to at binding, described in a questionnaire nobody in accounts payable has read.
Why do funds transfer fraud claims get denied on the warranty?
Because the policy conditioned cover on a verification procedure the insured warranted it would follow, and the insured cannot prove it followed it for the payment in question. The denial is on the warranty, not on the loss — which is why the fraud being undisputed does not help.
- Coverage for funds transfer fraud is frequently conditioned on a verification procedure the insured warrants it performs. The condition is agreed by a risk manager and executed by an AP clerk.
- The gap between warranted procedure and actual practice is measurable inside the organisation and invisible to the insurer until a claim.
- Verifiable authorisation records convert a warranty assertion into something an insured can evidence and an underwriter can sample.
Part of Payment release authorization
The structure of the problem
Commercial crime and cyber policies commonly provide funds transfer fraud coverage subject to conditions. A representative condition requires the insured to verify, by a method other than the one used to receive the request, any instruction to change payment details or to transfer funds above a stated amount.
That condition is negotiated by a risk manager, recorded in an application or an endorsement, and then operationalised — or not — by accounts payable staff processing volume under deadline.
Three parties, three different understandings of what was agreed.
Where the gap opens
| Warranted | Actually performed | Why |
|---|---|---|
| Call every change above $10,000 | Calls made for large or unfamiliar vendors | Volume; the threshold catches more than expected |
| Call a number from your own records | Number taken from the request | The record is stale or absent |
| Verbal confirmation by an authorised contact | Email confirmation | Faster; the contact did not answer |
| Document the verification | Noted in a spreadsheet, sometimes | No field exists in the AP system |
None of those substitutions is misconduct. Each is a reasonable operational accommodation made by someone who was not in the room when the warranty was agreed.
The claim conversation
After a loss, the insurer's investigation asks a narrow question: was the warranted procedure performed for this transaction?
The insured produces what it has — a spreadsheet entry, an email thread, a recollection. The adjuster evaluates whether that demonstrates the warranted verification. Where the documentation is thin, the outcome turns on interpretation rather than on the fraud.
This is why the warranty is more consequential than the exclusions. Exclusions are argued about; warranties are checked.
Measuring your own gap before renewal
An exercise worth doing before the questionnaire arrives, not after a claim.
- Extract the verification conditions from your current policy. Read the endorsement, not the summary.
- Sample thirty transactions from the last year that fell within the condition's scope.
- For each, determine what evidence exists that the procedure was performed, and whether the contact used came from your own records.
- Compute the share with adequate evidence. That number is your warranty compliance rate, and it is the number an adjuster would compute.
- If it is below what you warranted, you have a decision to make before renewal rather than after a loss.
What an underwriter can actually verify
Underwriters price what they can assess. Today, funds transfer fraud controls are assessed by questionnaire, which means every applicant answers identically and the answers carry no pricing information.
An insured that can produce verifiable authorisation records — signed by a named human, covering the full payment detail, checkable by the underwriter using open-source tooling without access to the insured's systems — offers something the questionnaire cannot.
Whether that earns a premium credit is a matter for the market. What it does with certainty is remove the warranty dispute from a future claim, because the evidence exists and is not a recollection.
A digital equivalent to the callback
The warranted procedure is usually described in terms of a telephone call, because that was the available out-of-band channel when the wording was drafted.
An out-of-band, cryptographically bound confirmation from the counterparty's enrolled credential satisfies the intent of the condition — verification through a channel independent of the one carrying the request — more strongly than a call to a number that may itself have come from the request.
That equivalence is worth raising with your broker at renewal and having recorded in the endorsement, rather than assuming it. Warranties are read literally when they matter.
A note on trust and escrow funds
If your organisation holds funds for others — a law firm, a title agency, a fund administrator, a settlement administrator — check separately whether those funds are within the policy's definition of covered property.
Policies frequently exclude funds held in a fiduciary capacity from funds transfer fraud coverage, which means the money most likely to be targeted may be the money least likely to be covered.
The number question adjusters press hardest
Which number was called, and where did it come from. If it came from the email containing the changed instructions, the verification went back to the attacker and was not out of band in any meaningful sense. Demonstrating that the number came from a previously established record is a separate evidentiary burden most organisations cannot meet.
| Evidence | Weakness |
|---|---|
| A note in the payment file | Says a call occurred; not what was verified |
| Call recording | Often not retained, or does not cover the relevant exchange |
| Phone system records | Show a call to a number, not the content |
| Employee recollection | Months later, across many similar payments |
| Email confirming the call | Same channel the fraud may have travelled on |
Objections and honest limits
“The fraud is obvious, so they must pay.” Condition precedent wording does not work that way. Where the condition is drafted as precedent, failing to prove it can defeat the claim independently of how the loss occurred.
“Our procedure is documented.” Documentation proves design. The adjuster is testing operation, for one specific payment, months after the fact.
Two questions for your broker before the loss
- What exactly will the insurer accept as proof? Get the answer in writing.
- If we can produce a signed confirmation, does the sub-limit or deductible change? It may be no today. Asking is how the market learns there is demand.
- Which trigger conditions apply? Banking changes, new payees, threshold amounts, urgent requests.
- Instrument the urgent path first. Urgency is the attacker's tool and the exception path is where controls are waived.
Terms used here
- Condition precedent
- A requirement that must be satisfied for cover to respond. Failure to prove it can defeat a claim regardless of the loss.
- Reservation of rights
- An insurer's notice that it is investigating while reserving the right to deny, typically accompanied by a detailed questionnaire.
- Out-of-band verification
- Confirming instructions through a channel independent of the one that delivered them.
Frequently asked questions
Is this legal advice about coverage? No. Policy wordings vary by carrier and endorsement, and coverage questions should go to your broker and counsel. This describes a structural pattern, not your policy.
Would an insurer accept a digital equivalent to the callback? That is a negotiation at renewal and should be recorded in the endorsement rather than assumed. Warranties are read literally when a claim arises.
What is the single most useful thing to do before renewal? Sample thirty in-scope transactions and compute your actual warranty compliance rate. It is the number the adjuster would compute, and knowing it beforehand changes the conversation.
Does this apply to funds we hold for clients? Check the policy specifically. Fiduciary and escrow funds are frequently excluded from funds transfer fraud coverage, which is a separate and larger exposure.
Why can a verification requirement defeat a claim? Where drafted as a condition precedent, failing to demonstrate it defeats cover even where the fraud is undisputed.
What is the number question? Which number was called and where it came from. A number taken from the fraudulent message is not out of band.
What should we instrument first? The urgent or expedited path, where exceptions are invoked and where the attacker applies pressure.
Where this fits in Manav
Manav produces one signed file per verification: what changed, who confirmed it, through which channel, when, and who accepted it. That is the artefact the forty-question letter is asking for.
Sources and further reading
- NAIC — cyber insurance market report
- FBI IC3 2025 Internet Crime Report
- Federal Acquisition Regulation
- Insurance broker guidance on social engineering endorsements and sub-limits.