From Wire Fraud to Deepfake

Payment-fraud coverage has been rewritten repeatedly as scams have evolved: a forged bank instruction, to a deceived employee, to a cloned voice and now to a fake video call.

Commercial forms are adding deepfake and synthetic media to existing fraudulent-instruction definitions. Personal lines are going further, with new homeowners and personal cyber endorsements that cover online scams, listing deepfake scams beside virtual kidnapping and romance scams.

We identified 96 forms first filed from October 2022 through September 2, 2026 that expressly use deepfake, deep fake, or synthetic media in payment-fraud, cyber-suite, media, or online-scam coverage.

Wire fraud starts with the bank

What businesses call wire fraud appears in policy forms as funds transfer fraud or fraudulent instruction. By 2012, forms described electronic or voice-initiated instructions that purported to come from the insured or a customer but were sent by someone else. The structure was bank-centered: the definition focused on the false instruction, not on how the criminal faked the sender's identity.

Fraud moves inside the business

The scam then shifted from the bank to the employee. By 2014, fraudulently induced payment forms addressed fake changes to a vendor's bank-account information. By 2017, forms were titled Impersonation Fraud Coverage (116956 (1/17)) and covered instructions relied on by the insured or an employee that purported to come from an executive, another employee, or a vendor. This is the classic business-email-compromise scenario.

The difference is who acts on the false instruction. The older model assumed an outsider sending an unauthorized instruction to a bank. The newer model recognized that a legitimate employee could be deceived into making an authorized payment. Labels multiplied with the scenarios: social engineering fraud, wrongful transfer event, executive impersonation fraud.

Cyber suites absorb payment fraud

Payment fraud then appeared in cyber forms as well as commercial crime. In 2020, Hartford Steam Boiler's Cyber Suite Coverage (HSB CS 12 2020) defined a wrongful transfer event as intentional criminal deception using email, facsimile, or telephone communications to induce the insured or its financial institution to send or divert money, securities, or tangible property. It sat beside data compromise, computer attack, and cyber extortion.

That wording is technology-neutral, so a cloned voice or synthetic video might already fall within it. The absence of the word deepfake does not settle the question. The full form and the facts of the transfer do.

Deepfake enters the forms in 2022

The earliest express use we found was not a payment-fraud form. Zurich American Insurance Company's Media Wrongful Act Amended Endorsement (Website Hacking) (U-ZCIP-1039-A CW (01/23)), first submitted October 25, 2022, adds third-party deep fake Content disseminated through the insured's website or social-media accounts to the definition of a media wrongful act. That covers misuse of the insured's channels, not a payment induced by a fake instruction.

The earliest explicit payment-fraud language followed three weeks later. Coalition Insurance Company's Coalition Cyber Policy 3.0 (CYUSP-00PF-1022-01) defined funds-transfer fraud to include an instruction that impersonates the insured, a vendor, business partner, or client, including through the use of deepfakes.

A widely reported loss shows the scenario these forms address. In January 2024, an employee of the engineering firm Arup received a message purporting to come from a senior executive, followed by a video conference assembled from prerecorded, publicly available footage of apparent colleagues¹. The employee authorized transfers totaling HK$200 million, about US$25 million, to five accounts².

Carriers amend the definition rather than add a new coverage

Beazley's 2024 endorsement states the approach in its title: Amend Definition of Fraudulent Instruction (E16544, 042024 ed.). It expressly includes instructions resulting from deep fake technology, synthetic media, or other technology enabled by artificial intelligence. It creates no new coverage grant. It adds a new method of deception to an existing definition.

HSB's Cyber Suite forms show the same shift between two editions:

Form	Fraud definition	Treatment of synthetic media
Cyber Suite Coverage (HSB CS 12 2020)	Intentional criminal deception using email, fax, or telephone to induce a transfer	Not expressly addressed
Cyber Suite Coverage (HSB CS3 END 09 25)	A fraudulent written, electronic, or telephonic payment instruction that impersonates the insured, a client, vendor, or business associate	Expressly includes synthetic media, deep fake technology, and similar AI-enabled technology

The newer definition names the technology and specifies who may be impersonated. Naming the technology makes its inclusion explicit, but the rest of the wording still determines which transfers qualify.

Personal lines get their own coverage

Commercial carriers amended payment-fraud definitions. Personal-lines carriers built something different: affirmative online-scam coverage, sold through home and personal cyber endorsements. The trigger is a criminal deception that induces the insured to voluntarily part with money, securities, cryptocurrency, loyalty points, digital collectibles, or tangible property, rather than a business payment instruction.

The first online-scam coverage in our review to name deepfakes was filed on March 21, 2025. Great American Insurance Company's Home Cyber Protection Coverage (PM 71 24 02 25), filed under Other Personal Inland Marine, placed deepfake scams inside its definition of online scams, alongside virtual kidnapping, romance scams, social engineering, and spoofing or phishing.

The harms are well documented. The FTC warned in 2023 that a short audio clip is enough to imitate a family member's voice in an emergency scam³. It reported that consumers lost $3.5 billion to imposter scams in 2025, nearly triple the 2020 amount⁴, though that figure covers imposter scams broadly, not only those using deepfakes. In December 2025, the FBI warned that criminals were altering photos and videos into fake proof-of-life media for virtual-kidnapping schemes⁵, the scenario these forms name.

The wording is spreading across carriers

The online-scam forms share language. Of the 50 observed through September 2, 2026, 47 expressly credit Hartford Steam Boiler, Insurance Services Office, or both, and the filers include farm and county mutuals. Reusable wording explains how similar coverage can appear across so many companies.

From January 1 through September 2, 2025, the database shows 14 newly observed forms using explicit deepfake or synthetic-media language. The same 2026 period shows 47, and 34 of those define online-scam coverage, 31 of them deployed under Homeowners Sub-TOIs.

The larger change is participation. Over those same periods, the number of filing companies submitting forms from the explicit-language corpus grew from 6 to 27, while distinct filings increased more modestly, from 149 to 179. Both periods include filings in 48 states, so geographic reach was already broad in 2025. In 2026, more companies are filing the wording. These counts measure filing activity, not policies sold or premium.

By filing product family, Cyber Liability has the most forms at 43, followed by Homeowners at 37 and Personal Inland Marine at 10. A form can appear in more than one family when the same wording is deployed across products.

Naming deepfakes does not settle coverage

Both the commercial and consumer forms put conditions around the loss. Spinnaker's December 2025 funds-transfer-fraud endorsements come in paired variants, with and without a condition precedent requiring verification through independently sourced contact information and a second confirmation method before money moves or payee details change. Where that condition applies, expressly including deepfakes does not remove it.

Earlier spoofed-email disputes show why such details matter. In Principle Solutions v. Ironshore, the Eleventh Circuit found that a transfer induced by coordinated fake communications satisfied the policy's direct-loss requirement⁶. In Mississippi Silicon v. AXIS, the Fifth Circuit rejected computer-transfer-fraud coverage for an employee-authorized transfer, leaving the insured with the $100,000 already paid under its social-engineering coverage⁷. Neither involved a deepfake, but both turn on questions a more convincing impersonation will still raise: who authorized the transfer, which coverage applies, and what limit governs.

The consumer forms have conditions too. All 50 online-scam forms contain police-reporting language, and 38 treat related transfers as a single scam event.

What the history shows

Each rewrite of payment-fraud coverage followed a change in the scam. Bank wire fraud became employee impersonation, which became cyber-suite social engineering, which now names synthetic media. In personal lines, the same technology is being packaged into online-scam coverage, which accounts for most newly observed explicit-language forms in 2026.

The useful question is not whether a policy offers "deepfake insurance," but who was deceived, what they lost, and which coverage responds. A false instruction to a bank, a payment authorized by a deceived employee, a consumer scam, and unauthorized content on a company's website are different insured events. Naming deepfakes clarifies the method of deception. The coverage grant, covered property, verification and reporting conditions, exclusions, and limits determine the protection.

---

Data sourced from FilingFocus, with a September 2, 2026 cutoff. Forms are counted by distinct PDF file; state, edition, and branding variants may share wording. “New” refers to the earliest filing date found in the reviewed database, not necessarily the wording's first use in the market. Product-family counts overlap. The explicit-language review does not count every policy that might respond to a deepfake loss.

Footnotes

1. Hong Kong SAR Government, press release describing the prerecorded deepfake video conference (June 2024) ↩

2. The Guardian, report confirming Arup as the company targeted in the HK$200m deepfake fraud (May 2024) ↩

3. FTC Consumer Alert, "Scammers use AI to enhance their family emergency schemes" (March 2023) ↩

4. FTC, "FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025" (June 2026) ↩

5. FBI Alert, "Criminals Using Altered Proof-of-Life Media to Extort Victims in Virtual Kidnapping for Ransom Scams" (December 2025) ↩

6. Principle Solutions Group, LLC v. Ironshore Indemnity, Inc., 944 F.3d 886 (11th Cir. 2019) ↩

7. Mississippi Silicon Holdings, LLC v. AXIS Insurance Co., 843 F. App'x 581 (5th Cir. 2021) (unpublished) ↩