Commercial Crime Insurance: Why Your BOP Doesn’t Cover Employee Theft

Maria opened a small CPA firm in 2018 with one part-time bookkeeper, Karen, who had ten years of experience and glowing references. Karen handled deposits, ran payroll, and reconciled the firm’s operating account. Last April, Maria’s bank flagged an unusual wire transfer. Within a week an external audit traced $47,300 in fraudulent vendor payments back to Karen, spread across 21 months. Maria called her insurance broker the same afternoon. The answer came back fast: her business owners policy did not cover employee dishonesty. She had no commercial crime insurance. The $47,300 was hers to absorb.

What a BOP actually excludes

A business owners policy bundles property coverage, general liability, and business interruption into one package. It pays when a customer slips, when a fire damages the building, when vandalism breaks a storefront window. What it does not pay for is theft committed by the people you trust to run the business. Employee dishonesty, forgery, fund transfer fraud, and computer fraud sit outside the BOP entirely. Carriers exclude these because they price internal-control risk separately from external-event risk, and because the loss patterns are completely different.

The Association of Certified Fraud Examiners reports that the median loss from occupational fraud at small businesses with fewer than 100 employees is roughly $150,000, and a meaningful share of cases run past $1 million. Schemes hide for a median of 12 months before discovery. By the time the loss surfaces, the money is rarely recoverable.

What commercial crime insurance covers

Commercial crime policies pay for direct financial loss caused by criminal acts, whether the perpetrator is an employee, an outside party, or a vendor. The standard ISO commercial crime form contains seven insuring agreements, and most small businesses select four.

Employee theft pays when staff steal money, securities, or other property from the business. The coverage applies to a single act or to a multi-year scheme. It includes payroll fraud, expense fraud, and inventory shrinkage tied to a specific employee.

Forgery or alteration covers losses from forged signatures on checks, drafts, and similar negotiable instruments drawn against the company’s accounts. If a former employee uses an old check to pull funds, this insuring agreement responds.

Computer fraud pays when a third party uses your computer systems to fraudulently transfer money or property. This includes social engineering attacks where an outsider impersonates a vendor or executive.

Funds transfer fraud covers losses from fraudulent wire instructions sent to your bank by someone impersonating you or an authorized employee.

A standalone commercial crime policy for a small business with under $5 million in revenue runs $500 to $1,500 a year for $100,000 in coverage, and $1,500 to $3,500 for $500,000 in coverage. The premium is a small percentage of the typical loss.

How to size the limit

Most small business owners pick a limit too low because they price against what feels affordable instead of what a real fraud scheme would consume. The right sizing exercise is straightforward: look at the largest amount of cash, securities, or vendor payments a single employee can move in a 24-month window without anyone else catching it. That number is your minimum.

Add ERISA fidelity bonding requirements if you sponsor a retirement plan, then check the deductible. Many BOPs include a $5,000 or $10,000 employee dishonesty endorsement as a giveaway, but the limit is too small to matter and the deductible eats most claims. A real commercial crime policy starts at $100,000 in coverage and pairs with a $1,000 to $2,500 deductible.

Underwriting questions you will need to answer

Carriers price commercial crime based on internal controls. Expect to answer questions about who has check-signing authority, whether you separate accounts payable from bank reconciliation, whether you require dual signatures over a threshold, and whether bank statements are reviewed by someone who cannot post entries. If you are a one-person shop with no segregation of duties, expect a higher rate or a coverage exclusion for losses where you were the only person with access. Strengthening basic controls before applying lowers the premium meaningfully.

What it does not cover

Commercial crime policies pay for proven direct financial loss. They do not pay for indirect losses like lost revenue while the fraud was being uncovered, the cost of forensic accountants, or reputational damage. They also do not cover losses where the only evidence of fraud is an inventory shortage with no traceable connection to a specific employee. If you cannot point to a person and a transaction, the carrier denies the claim. Most policies require a contractual right to subrogate, meaning the carrier can pursue the employee for recovery after paying you.

For a fuller picture of how commercial crime fits alongside the rest of your policy stack, see our guide to the different types of business insurance and how to review business insurance coverage before renewal.

FAQ Section

Does my BOP include any employee theft coverage at all? Some BOPs include a $5,000 to $25,000 employee dishonesty endorsement as a basic add-on. The limit sits far below a real fraud loss and the deductible consumes the smaller claims. Treat the endorsement as a starting point, not real coverage.

How fast can a fraud claim get paid? Once the insured submits proof of loss with documented transactions, most carriers settle within 60 to 120 days. Carriers require a sworn proof of loss, supporting documentation, and cooperation in any criminal investigation. Stalled investigations slow the payout.

What if the employee already left the company? Coverage applies if the loss occurred while the person was an employee, even when discovery happens after they leave. Most policies give a 12-month discovery window after termination of employment.

Is a fidelity bond the same as commercial crime insurance? Fidelity bonds are a narrower form of employee dishonesty coverage required by ERISA for retirement plan trustees. They cover plan assets only. A commercial crime policy covers business operations and is broader.

Do I need crime coverage if I have cyber liability? Yes. Cyber liability covers data breach response, network damage, and customer notification costs. It does not pay for stolen funds. Computer fraud and funds transfer fraud sit on the crime policy, not the cyber policy. For more on the cyber side, see how cyber liability insurance protects small businesses.

Closing

Maria added a $250,000 commercial crime policy two months after the audit closed. The annual premium was $1,400. The fraud, if it had been covered, would have paid out $42,300 after deductible. The economics on this coverage are blunt: the limit you buy is the floor on your worst possible internal-fraud year. The policy you do not have is the loss you eat.

FAQ Schema