What is social engineering and can insurance help?

Social engineering is when criminals trick people, rather than hack systems, into sending money, sharing passwords or opening harmful links. Common examples are phishing emails, fake supplier invoices and calls from someone pretending to be your bank.

Some crime insurance policies and some extensions to cyber insurance may help with the costs, subject to the policy terms. This guide explains the attack types, warning signs, prevention steps for small businesses and how insurance may respond.

Cover depends on the policy and insurer you choose. Check the policy wording and its terms and conditions for what is and isn't included.

What is social engineering?

Social engineering is a method of manipulating people into doing something that helps a criminal. The attacker plays on trust, urgency or fear so the target acts before they stop to check. upcover's glossary has a short definition of social engineering.

In one line: a scammer pretends to be someone you trust, such as a supplier, your bank or a colleague. They then ask you to pay, log in or share information.

Because the attack targets a person's judgement, strong passwords and antivirus software alone may not stop it.

How common are social engineering scams in Australia?

Combined reported scam losses reached $2.18 billion in 2025, according to the National Anti-Scam Centre's Targeting scams report. The figure combines data from Scamwatch, ReportCyber, IDCARE, the Australian Financial Crimes Exchange and ASIC.

The same 2025 report lists payment redirection scams at $166.8 million and phishing at $97.6 million among the top five scams by loss.

The Australian Cyber Security Centre (ACSC) publishes an Annual Cyber Threat Report 2024-25 fact sheet. It lists business email compromise fraud resulting in financial loss as 15% of the top cybercrimes reported by businesses in 2024-25. The average self-reported cost of cybercrime per report for small businesses was $56,600.

What are the main types of social engineering attacks?

The main types of social engineering attacks are phishing, spear phishing, business email compromise, pretexting, baiting, vishing and smishing.

Phishing

The ACSC describes phishing as "a method of stealing confidential information by sending fraudulent messages to a victim". Messages can arrive by email, SMS, social media, messaging apps or phone, and a fake login page is a common example. upcover's glossary also defines phishing.

Spear phishing

Spear phishing is phishing aimed at a particular person or organisation. The ACSC's scams guidance says these messages may contain true information to seem more authentic and "can be extremely difficult to detect". Attackers often research staff names, roles and suppliers first.

Business email compromise and invoice redirection

The ACSC describes business email compromise as "a form of targeted phishing, or spear phishing". Criminals pretend to be business representatives or use a real employee's compromised email account. The email may ask for payment of an invoice or a change to bank account details.

Scamwatch says scammers may send an invoice with new payee information and can copy business logos and ABNs. For how insurers may treat these losses, see upcover's guide to business email compromise insurance.

Pretexting

Pretexting is when the attacker invents a believable story, or pretext, to get information or a payment. Examples include a caller claiming to be your IT provider, or a "new accounts contact" at a supplier.

Baiting

Baiting offers something tempting so the target opens a harmful file or link. Common bait includes a USB drive left in a car park, a software giveaway or an unexpected invoice attachment. Opening it can install malicious software that gives the attacker access to systems or email.

Vishing

Vishing is voice phishing, done by phone call or voicemail. Scamwatch's phishing guidance notes that callers may claim to be from your bank, and government impersonators may threaten immediate arrest. Some callers ask for a one-time code "to stop a fraud" on your account.

Smishing

Smishing is phishing by SMS, and Scamwatch warns that scam texts can appear to come from your bank, even inside a genuine thread. From 1 July 2026, organisations sending branded SMS must register their sender IDs with the ACMA, the ACSC's scams guidance notes. Otherwise their messages may show as "Unverified".

What are the warning signs of a social engineering attack?

The clearest warning sign is an unexpected request to pay, log in or share details, combined with pressure to act fast. Scamwatch and the ACSC list these common signs:

• a supplier's payment details change without notice
• a request demands urgent action or secrecy
• the message doesn't use your proper name
• the sender's email address or website has a spelling error or is slightly different to usual
• you receive bills for products or services you haven't ordered
• a caller asks for a password or one-time code
• colleagues receive emails from "you" that you didn't send, or you see unexpected password resets

How can small businesses prevent social engineering attacks?

Small businesses can reduce the risk by combining a payment checking process with account security and staff training. The ACSC's guide to protecting against business email compromise recommends steps including:

• A payment verification process: a clear and consistent process for staff to verify and validate requests for payment, including any change of bank details.
• Call-back checks: phone the business on a number you have sourced independently, as Scamwatch advises, not the number in the email.
• Multi-factor authentication: a second check, such as an app code, when someone logs in to email and banking.
• Spam and message scanning: the filtering services offered by your email, SMS or social media providers.
• Domain checks: checking the spelling of a sender's domain name and setting up email verification records known as SPF and DMARC.
• Fewer public contact details: limiting staff contact details shared publicly, which attackers can use to target people.
• The Essential Eight: the ACSC's baseline security strategies for organisations.

Some businesses also ask for two-person approval of payments above a set amount.

What should you do after a social engineering attack?

Act quickly after an attack, because the chance of stopping a payment drops over time. Scamwatch's what to do if you've been scammed page sets out these steps:

• contact your bank or card provider immediately and ask them to stop any transactions
• change passwords on affected devices and accounts, starting with email and banking
• contact IDCARE on 1800 595 160 for help making a recovery plan
• report the scam to Scamwatch, and make a police report online through the ACSC

Keep the emails, call logs and payment records, as your bank, the police and your insurer may ask for them.

Telling your insurer

If you hold cyber or crime insurance, tell your insurer early.

If you're concerned about a particular customer service or experience, you can always consider telling your insurer as soon as you become aware of an incident, complaint or circumstance that could lead to a claim. Importantly, this doesn't impact your premiums or cost of insurance until a claim arises, and it means that any future claim is triggered from the original date you notified the insurer, so it helps spread the risk of claims across policy periods too. You don't need to wait for a formal demand. Also keep in mind that notifying of a claim late may affect your claim.

You can start a claim through the make a claim page. Admitting liability, incurring costs or agreeing to a settlement before you notify your insurer may affect your claim. Starting a claim does not confirm that your claim is covered; your insurer assesses it under the policy terms, conditions, exclusions and limits.

Does insurance cover social engineering fraud?

Insurance may respond to some social engineering fraud, but it is often excluded or sub-limited. Where cover is available, it may sit under a crime policy, a crime section of management liability or an extension to a cyber policy. Whether a policy responds to this type of fraud varies between policy wordings, so always check with your broker or the team at upcover.

Cyber insurance

Cyber insurance is designed to cover costs after a data breach or cyber attack. First-party costs may include incident response, forensics, notifying affected people, data recovery and business interruption. Third-party cover may respond to claims from customers or regulators.

Money that staff are tricked into transferring is a different kind of loss. Some cyber policies offer a social engineering or funds transfer fraud extension, commonly with a sub-limit. A sub-limit is a lower limit for one type of loss within the overall limit.

Crime insurance

Crime insurance is designed to cover direct financial loss from theft, fraud or dishonesty, whether by employees (employee theft, embezzlement) or outsiders (funds transfer fraud, forgery, social engineering). Some crime policies exclude scams where you are tricked into authorising a payment, while others offer cover as an option. Crime insurance excludes indirect losses such as lost profit.

Management liability insurance

Management liability insurance is designed to help protect a business and its directors, officers and managers against claims about how the business is run. Management liability may include crime cover as an optional section with its own limit. upcover's guide to commercial crime insurance explains crime cover in more detail.

Questions to raise about your policy

These questions help show where this type of loss may sit in a policy or quote:

• Does the policy mention social engineering, funds transfer fraud or invoice redirection by name?
• Is it part of the policy, an optional extension or not available?
• What sub-limit and excess apply?
• Does the wording set any conditions on how payment changes are checked?
• Does the cyber policy or the crime policy respond, and do they overlap?

An upcover representative or a broker can talk through what those limits mean for your business.

What do policies commonly exclude for social engineering losses?

Cyber and crime policies carry exclusions that limit how they may respond. Exclusions commonly include, but are not limited to:

• payments you were tricked into authorising, where the policy has no social engineering extension
• losses above the sub-limit that applies to that type of loss
• indirect losses, such as lost profit or future lost revenue
• dishonest or fraudulent acts by you or a senior executive (employee dishonesty may sit under a crime section, where the policy includes one)
• incidents you knew about before the policy started
• loss of intellectual property value

Important: This list is not exhaustive. Exclusions vary between insurers. Always refer to the policy wording and its terms and conditions for the exclusions that apply to you.

How upcover can help

upcover arranges cyber insurance and crime insurance for Australian small businesses. upcover works with 80+ insurance partners and can arrange quotes from a range of insurers.

• 70,000+ businesses covered
• 4.9/5 customer rating
• Certificate of currency available once your policy is confirmed

You can request a cyber insurance quote or a crime insurance quote online.

Frequently asked questions

What is social engineering in plain terms?

Social engineering is a scam where someone pretends to be a person or business you trust. They aim to get you to pay them, log in or share information. Phishing emails, fake invoices and bank impersonation calls are common examples.

What is the difference between phishing and social engineering?

Social engineering is the broad term for manipulating people. Phishing is one type that uses fraudulent messages to steal information. Spear phishing, vishing and smishing are forms of phishing aimed at a person, a phone or a text inbox.

Is business email compromise a type of social engineering?

Business email compromise is a form of social engineering. The ACSC describes it as targeted phishing, where criminals use email to request payments or change bank details.

Does cyber insurance cover social engineering?

Cyber insurance policies vary on this point. Money staff are tricked into paying is often excluded or sub-limited under cyber insurance. Cover may depend on a social engineering extension or a separate crime policy, so check the policy wording with your broker.

Does crime insurance cover social engineering fraud?

Crime insurance is designed to cover direct financial loss from theft, fraud or dishonesty. Some crime policies offer this cover and others exclude it. Where it is offered, a sub-limit commonly applies.

How can I tell if an invoice is a scam?

A scam invoice often shows new bank details, an urgent deadline or a sender address that differs slightly from usual. Scamwatch suggests phoning the supplier on a number you have sourced independently before paying.

‍

_{The information in this article is general information only and does not take into account your objectives, financial situation or needs. Scam and cyber security guidance from Scamwatch and the Australian Cyber Security Centre can change, so check those sources for current advice. Before deciding whether a product is right for you, read the policy wording and its terms and conditions. upcover Pty Ltd ABN 17 628 197 437 is a Corporate Authorised Representative (CAR 1299211) of Experience Insurance Services Pty Ltd ABN 41 657 596 506, AFSL 539078. upcover arranges insurance products with selected insurers and underwriters and does not compare all general insurers or insurance products available in the market.}