Crime/Fidelity vs. Cyber

Crime, fidelity, and cyber policies all deal with loss caused by bad actors, but they protect different kinds of value. This page explains how theft-focused crime coverage differs from data-and-network-focused cyber coverage, and where the two can leave a gap.

At a glance

Crime/Fidelity vs. Cyber — At a glance
	Crime / Fidelity Crime	Cyber Cyber
Main risk covered	Theft or dishonesty involving money, securities, or property	Data breaches, network attacks, and privacy liability
Who causes the loss	Usually employees, or outside criminals stealing funds or property	Hackers, malware, or human error that exposes data
Typical losses paid	Stolen cash, forged checks, and employee embezzlement	Breach response, extortion payments, notification, and legal costs
First vs. third party	Mostly first-party — your own money and property	Both first-party costs and third-party liability to others
Common gaps	Cyber-driven data loss and social engineering may need an endorsement	Physical theft of cash or tangible property

How Crime and Cyber Divide the Risk

Crime and Fidelity coverage is built around the theft of tangible value — money, securities, and property — most often by a dishonest employee but also by outside criminals. Cyber coverage is built around information and networks: what happens when data is exposed, systems are locked, or a business is held responsible for a privacy failure.

The overlap is social engineering fraud, where a criminal tricks an employee into wiring funds. Depending on how each policy is written, this loss may fall under a crime endorsement, a cyber policy, both, or neither, which is why the specific wording matters.

First-Party vs. Third-Party

Crime coverage is largely first-party — it reimburses your own loss. Cyber blends first-party costs, such as breach response, with third-party liability to customers or partners whose data was exposed.

Where to find it in your policy

Insuring Agreements List

Crime policies list separate insuring agreements such as Employee Theft, Forgery or Alteration, and Funds Transfer Fraud; confirm which are selected.

Social Engineering Endorsement

Look for a specific social engineering or deception fraud endorsement and its sublimit on either the crime or the cyber policy.

Cyber Coverage Schedule

The cyber declarations break out limits for breach response, extortion or ransomware, and network security and privacy liability.

What it looks like on a real claim

Example 1 — Employee embezzlement

A bookkeeper diverts about $75,000 in company funds to a personal account over two years before an audit uncovers it.

Crime / Fidelity

Responds — employee theft is a core crime/fidelity insuring agreement

Cyber

Does not respond — no network breach or data event occurred

Example 2 — Ransomware attack

Malware locks the company's servers, and recovery, notification, and legal costs reach roughly $120,000.

Crime / Fidelity

Generally does not respond — no theft of money or property is involved

Cyber

Responds — extortion and breach-response costs fall under cyber coverage

The bottom line

Crime and cyber policies answer different questions. Crime asks who stole your money or property; cyber asks what happens when your data or systems are compromised. Many businesses need both, because a single incident can involve stolen funds and exposed data at the same time.

The riskiest assumption is that one policy quietly covers the other. Social engineering and funds-transfer losses in particular can fall into a gap between them, so the endorsements and sublimits on each policy deserve a close read, especially given California's data-breach notification requirements.

Back to Business Insurance Hub