THE ESSENTIALS
Before you start
- Identify who received the request and who made the payment.
- Look for the definition addressing deception of an insured person.
- Separate transferred money from incident response services.
The loss mechanism changes the question
In Henrique’s exercise, Clara draws two routes. In one, a third party sends a fraudulent instruction to the financial institution. In the other, someone at the company receives the false request and makes the payment. Writing only “a fraudulent transfer occurred” omits that difference. The account should describe who did what, without turning an action in online banking into a legal conclusion about consent.
A definition may expressly address deception
Generali’s Cyber Risks condition (form 541.031, October 2024) lists Electronic Crime as optional. It distinguishes instructions deceiving an insured into paying in good faith from third-party instructions addressed to the financial institution. The former excludes requests without authentication through a method different from the original request; in the latter, the knowledge or consent wording refers to the financial institution. These are different definitions with their own exclusions; they do not establish cover for this example.
Restoring data does not necessarily restore the balance
In MAPFRE’s Cyber ON terms (form 60020240600), the opening special conditions exclude financial losses from computer fraud and reimbursement of money obtained by deception. The same document provides for certain data recovery costs. This example shows why IT support and replacement of funds require separate readings; it does not describe every Cyber product.
Henrique therefore leaves two lines in the exercise: the money that left the account and the services needed to investigate or restore systems. Clara does not treat the existence of a support line as evidence that the first is payable.
Match the sequence to the contracted version
As a reading method, Clara suggests placing the payment sequence alongside the clause identified in the quotation or policy: who received the instruction, who qualifies as insured, and what verification actually occurred. Note the difference between authenticating access and checking a payment request; retain the method used and the observed result.
The analysis must also locate the benefit actually purchased, remaining exclusions, time scope, limits, excess and notification procedure. The two public documents illustrate wording; they do not decide a claim, the validity of banking consent or a bank’s reimbursement duty. They are not a product recommendation.
KEEP THESE QUESTIONS
Your checklist for the next conversation
- Record the received message separately from the payment instruction that was executed.
- Locate the fraudulent instruction definition and any benefit for loss of funds.
- Identify the request verification method and preserve evidence through the appropriate channel.
- Check purchase, exclusions, limits and procedure in the same document version.
FROM THE ARTICLE TO YOUR SITUATION
Let us discuss your situation
Tell us what you want to protect. We review your request and help compare relevant terms. Requesting a quotation does not activate insurance.
Sources and transparency
Content updated on .
Consultation dates are stated in individual references when available.
Numerical examples are fictional and explain concepts. Editorial interpretations are identified in the text.
- Generali — Multirrisco Empresas, form 541.031 (10/2024), Cyber Risks: cls. 2(4), 3(r)/(dd), 4(1)(n), 16. Checked 2 November 2026 ↗
- MAPFRE — Cyber ON, terms 60020240600, p. 27: special conditions and data recovery. Checked 2 November 2026 ↗
Information from RMACHADO GROUP. This is not an insurance offer or individual advice. Covers, acceptance, exclusions, sums insured and costs depend on the policy. The intermediary does not underwrite the risks.