Would your policy actually pay for a deepfake?

First, the thing most people get wrong

When someone is tricked by a fake voice or video into sending money, no computer was hacked. A person was fooled. Because no system was broken into, a cyber policy often does not treat it as a covered event. This kind of loss usually belongs to a crime (also called fidelity) policy, or to a special add-on. Where the coverage sits, and how it is worded, decides whether you get paid.

• "We have cyber insurance, so we are covered." Cyber is built for hacks and breaches. A tricked payment is a fraud loss, often handled elsewhere and capped low.
• "The limit is $2M, so we can claim $2M." Fraud coverage is usually a small sub-limit inside that, often $250,000 or less.
• "The fake was so convincing, they have to pay." Many policies deny because the employee chose to send the money. How convincing the fake was does not matter to that clause.

Where this applies

This check is about business insurance in markets that split coverage between a cyber policy and a crime or fidelity policy: mainly the United States, United Kingdom, Canada, Australia, and parts of Europe. The exact wording, sub-limits and law vary by country and by insurer.

The policy types in play: cyber liability, commercial crime or fidelity, social engineering fraud add-ons, funds transfer fraud, computer fraud, and sometimes professional liability (also called E&O). Treat this as general education, not advice for your own policy or country.