What is social engineering fraud?

Social engineering fraud is a loss caused by deceiving a person into authorising a payment or handing over access, rather than by any technical compromise of a system.

On social media it usually runs through an impersonating account. A profile presenting itself as the brand, or as a named executive, instructs a customer or a supplier to pay a different account, change bank details, or send credentials to a support handle that does not belong to the company.

In insurance terms this is the exposure that sits outside the insured's own network, which is why cyber policies typically write it as a separate endorsement at a sublimit well below the policy limit rather than covering it in full.

It is also why impersonation monitoring has a loss-prevention argument and not only a brand one: the accounts that drive these claims are visible and removable before the payment is made.

Related terms

Brand impersonationBrand impersonation is the use of a brand's name, logo or imagery on an account, page or profile that the brand does not own, in a way that presents it as official or affiliated.
Account takeoverAccount takeover is an attacker gaining control of a legitimate account, and on corporate social accounts it almost always happens through people and process rather than through the platform itself.
Digital risk protectionDigital risk protection is the practice of finding and removing the threats to a brand that sit outside its own network — on social platforms, in app stores, on look-alike domains and across the open web.