Deepfake fraud: what insurance covers and what it does not

What is deepfake fraud?

Deepfake fraud uses AI-generated audio, video or images to impersonate someone a business trusts. The usual aim is a payment: a call, video meeting or message that seems to come from an executive or supplier asks staff to send money or change bank details.

It is an old fraud with a new tool. Tricking an employee into sending money has long been handled by insurers as social engineering or funds transfer fraud; a cloned voice or face makes the impersonation harder to spot.

There is a second risk that has nothing to do with payments. Fake media can show your company or staff saying or doing things they never did, and the cost is reputational: investigation, takedowns and crisis communications.

Which insurance covers deepfake payment fraud?

Usually a cyber or crime policy, under a funds transfer fraud or social engineering insuring agreement. Whether it pays depends on the wording: does it cover an employee who was tricked into sending money, and does it name AI-generated instructions?

Coalition's 2024 release offered the endorsement as an add-on for eligible US surplus and Canadian cyber policies¹. Its current page says AI events were added to key policy definitions, so it is unclear whether the 2024 endorsement still exists as a separate form². Neither page states a limit.

Social engineering cover can come with its own sublimit, lower than the main policy limit, and with conditions such as confirming a payment request by calling back on a known number. A deepfake loss that skipped a required check may be refused even where the cover exists.

What is a deepfake response endorsement?

It is cover for the cost of responding when fake media damages your reputation, rather than for money sent to a fraudster. Coalition sells a Deepfake Response Endorsement as part of its Active Cyber offering².

Coalition's page describes forensic analysis, legal help removing the content and crisis communications². The same page lists an Enhanced Privacy Endorsement for AI-related web privacy claims, such as data shared through an AI chatbot, which Coalition says is typically sublimited².

The page is undated, its examples reference the US, and Coalition says policies vary by geography, so ask what is available where you operate².

Which insurers name deepfake risk?

4 listings in our register name deepfake risk. Each is confirmed on the issuer's own pages, and none publishes a limit for it.

• CCoalitionAffirmative AI EndorsementLimit not publishedThrough brokers
• CCoalitionDeepfake Response EndorsementLimit not publishedThrough brokers
• RRelm InsuranceNOVAAILimit not publishedLicensed brokers
• CCorgiModular AI coverage on tech E&OLimit not publishedOnline, direct

Relm's NOVAAI, a cyber and tech E&O policy for companies that develop and sell AI software, includes a deepfake-related crime grant⁴. Relm is a Bermuda insurer and deals only through licensed brokers⁴.

Corgi lists synthetic media among the AI scenarios its modules address, alongside adversarial attacks on models⁵. It sells online to startups, growth-stage tech companies and enterprises deploying AI⁵.

If your cyber insurer has added general AI wording, ask whether it reaches a deepfake payment request. Beazley, for example, states that AI-related risks sit within its Full Spectrum cyber cover, but our register does not tag that wording for deepfake risk⁶.

Trade press read Beazley's wording as confirming cover when an attack uses AI, while Beazley's own pages do not limit it that way^{7, 8}. Either reading leaves the funds transfer and social engineering terms of the policy to decide a deepfake payment loss.

How much deepfake fraud cover can you get?

The listings do not say. None of the deepfake listings publishes a limit, and no insurer we track publishes a price.

If a policy sublimits social engineering, that sublimit, not the headline limit, is what a deepfake payment loss can draw on. If you hold both cyber and crime cover, ask which responds first and whether either excludes what the other covers.

Four questions to put to your broker or insurer:

• Does the policy cover an employee who was deceived into paying, or only fraud by hacking?
• Are deepfake or AI-generated instructions named, or at least not excluded?
• What is the social engineering sublimit, and what verification does the policy require before a payment?
• Does any part of the program pay to respond to fake media about the company, such as forensics and takedowns?

AI Insurance Tracker does not sell insurance. A licensed broker can check how your cyber and crime policies would treat a deepfake payment request before you need to claim.

How can a business protect itself from deepfake fraud?

Insurance pays after a loss; controls stop the payment. The controls that apply to social engineering fraud apply directly to deepfakes:

• Confirm payment requests and bank-detail changes by calling a number already on file, never one given in the request.
• Require two people to approve payments above a set amount.
• Agree a code word or a second channel for urgent requests from executives.
• Train finance staff, support teams and executive assistants on voice and video impersonation.
• Keep a record of how each request was verified, since a policy may ask for proof.

The coverage checker lists what to look for in a cyber policy. For the wider market, see AI liability insurance; startups can see where cyber fits in the AI startup insurance guide.