A break in or a stolen laptop is obvious. The losses that hurt most often look legitimate on day one. A fake vendor invoice. A payroll change request. A wire transfer that seemed routine. For Ontario small businesses, commercial crime insurance is one of the few coverages designed for theft and fraud that comes from people, process, and email.
Fraud is not rare. The Canadian Anti Fraud Centre reported over $704 million in reported fraud losses in 2025. Online fraud losses are also rising. The FBI IC3 reported over $16 billion in reported losses in its latest annual report. Even if you never file a claim, insurers underwrite fraud risk as part of your overall commercial insurance program.
Who this applies to
This article is for small and midsize businesses in Ontario and across Canada that handle money, inventory, payments, payroll, or customer property. It is especially relevant if you:
-
Pay suppliers by EFT or wire
-
Use email approvals for invoices or banking changes
-
Have staff who handle cash, refunds, or gift cards
-
Store higher value inventory, tools, or client property
-
Run AP and AR with lean staffing
-
Rely on third party bookkeepers or outsourced finance
Common industries include contractors, distributors, retailers, professional services, manufacturers, property managers, and clinics.
What commercial crime insurance is
Commercial Crime Insurance: Coverage designed to respond to theft and fraud losses that most property and liability policies do not address well, including employee theft and certain third party fraud.
Commercial crime insurance is usually purchased as a standalone policy or as a crime coverage section within a package. Many insurers offer a menu of crime insuring agreements like employee dishonesty, funds transfer fraud, forgery, and computer fraud.
What is covered and not covered
Crime policies differ by insurer and wording, but these are practical examples of what is typically insurable versus what often falls outside the coverage intent.
Often covered in a commercial crime policy
-
Employee theft of money, securities, or other property
-
Forged cheques or altered cheques
-
Forgery or alteration of financial instruments
-
Computer fraud that results in a direct financial loss
-
Fraudulent funds transfer when policy conditions are met
-
Theft of customer property in your care when included by wording
Insurers describe these exposures clearly in their crime coverage overviews, including employee theft, computer fraud, forgery, and fraudulent funds transfer.
Common situations that may not be covered without the right endorsement
-
Social engineering losses where a staff member was tricked into sending funds, unless specifically included
-
Losses discovered too late for the policy discovery period
-
Poor segregation of duties, missing approvals, or weak controls that violate policy conditions
-
Contract disputes, pricing disputes, or normal credit losses from non payment
-
Indirect losses like reputational damage or future lost sales
This is why a plain language coverage review matters. Two policies can both say crime insurance and still respond very differently.
Common claim scenarios for small businesses
These are the scenarios we see most often when evaluating commercial crime insurance in Ontario.
Business email compromise and fake vendor changes
An email arrives that looks like your supplier. It asks for updated banking details. Accounts payable updates the file and pays the next invoice. Business email compromise is widely recognized as one of the most financially damaging online crimes.
Employee theft over time
Small thefts that stay below attention thresholds. Refund abuse. Skimming cash. Gift card manipulation. Inventory shrink tied to internal access. Crime coverage is commonly positioned as protection against employee dishonesty and theft.
Forged cheques and altered payees
Cheques are intercepted and altered. Payees are changed. Signatures are forged. For businesses that still use cheques for certain suppliers, this is still a live exposure.
Payroll diversion
A fraudster changes direct deposit details or adds a fake employee. The first sign is often a missing pay stub complaint.
Theft of customer property
You hold client property at your premises, in your vehicle, or on site. An employee steals it or it disappears under suspicious circumstances. Some crime policies can address this when written for client property theft exposure.
Cyber insurance in Ontario
Commercial general liability insurance
Cost drivers and underwriting questions brokers actually ask
Underwriters price crime insurance differently than property or liability. Expect questions like:
-
Who can initiate and approve payments
-
What is your dual approval process for banking changes
-
Do you verify vendor changes by phone using a known number
-
How many people have access to online banking and payroll
-
Do you use EFT, wires, cheques, or all three
-
Do you reconcile bank statements daily, weekly, or monthly
-
Are duties split between AP, approvals, and reconciliations
-
Do you have limits on who can release inventory or issue refunds
-
Any prior fraud events, even if you did not claim
The clearer your controls, the easier it is to obtain broader terms and stable pricing.
How to reduce premium without reducing protection
Insurers reward controls that make fraud harder and losses easier to detect. These steps usually improve underwriting outcomes while reducing real risk.
Payment controls that matter most
-
Two person approval for any new payee or bank change
-
Call back verification using a known number, not the email signature
-
Separate roles for invoice entry, approval, and release of funds
-
Daily or near daily bank reconciliation for higher volume businesses
-
Positive pay and payee match services where available
-
Locked down access to banking and accounting admin permissions
People and process controls
-
Written delegation of authority for payments and refunds
-
Mandatory vacation policy for key finance roles where possible
-
Background checks for staff handling cash or banking access
-
Inventory counts with variance follow up
-
Clear incident escalation plan the moment something looks off
These controls are usually cheaper than the deductible you would pay on one event.
Mistakes that cause coverage gaps
Most denied crime claims are not about fraud being excluded in principle. They are about how the loss happened and what the policy requires.
-
Buying crime coverage but excluding social engineering and fraudulent instruction losses
-
No written verification process for vendor banking changes
-
One person controls AP, approvals, and reconciliation
-
Not notifying the insurer quickly when fraud is suspected
-
Limits that do not match your largest plausible loss, such as one full payroll run or one large supplier payment
-
Leaving crime coverage out of a package because you assume cyber insurance covers theft
Definitions you can use internally
Employee Dishonesty: Coverage that can respond when an employee steals money, securities, or property from the business, usually subject to discovery timing and policy conditions.
Funds Transfer Fraud: Coverage that can respond to fraudulent electronic transfer losses, depending on how the transfer was initiated and what controls were in place.
Computer Fraud: Coverage focused on direct financial loss from certain types of computer based theft, not general cyber incidents.
Forgery or Alteration: Coverage that can respond to forged signatures or altered financial instruments such as cheques.
Social Engineering Fraud: Coverage that may respond when a legitimate employee is deceived into sending funds, often requiring a specific endorsement.
Quick checklist for Ontario small businesses
Use this to self assess whether commercial crime insurance should be part of your program.
-
We pay suppliers by EFT or wire
-
A staff member can change vendor banking details
-
One person can both approve and release payments
-
We handle cash, refunds, or gift cards
-
We store inventory, tools, or client property
-
We would struggle to absorb a five figure fraud loss
-
We have not reviewed crime coverage in the last year
If you checked two or more, it is worth pricing commercial crime insurance.
FAQs
Is commercial crime insurance the same as cyber insurance?
No. Cyber insurance focuses on breaches, ransomware, and system interruption. Commercial crime insurance focuses on theft and fraud losses, including employee theft and certain types of fraud.
Does my property policy cover employee theft?
Usually not well. Many property policies treat crime as a separate coverage area. Crime protection is often described as its own category, including employee dishonesty and theft.
What is the difference between employee dishonesty and third party fraud?
Employee dishonesty relates to theft by your staff. Third party fraud is external, such as forged cheques or fraudulent instructions.
Do I need crime insurance if I do not handle cash?
Yes. Many of the largest losses come from funds transfer fraud and invoice diversion, not cash.
Can crime insurance cover fake invoices and email scams?
Sometimes, depending on whether the policy includes social engineering or fraudulent instruction coverage and whether verification conditions were met.
How much crime insurance limit should a small business buy?
Start with the largest single payment you could send, plus one full payroll run, plus a realistic legal and investigation cost buffer. Your contracts and payment habits should drive the limit.
Does crime insurance help with investigations?
Some forms can include claim expenses tied to investigating and documenting the loss. The wording matters.
Talk to Boardwalk
If you want to know whether commercial crime insurance makes sense for your Ontario business, we can review your payment flows and recommend a clean structure that matches your real exposure.
Request a Quote or Book a Meeting with us.
What we need from you:
-
Legal business name and Ontario operating address
-
Industry and a short description of operations
-
Annual revenue and number of employees
-
How you pay suppliers, including wires and EFT volume
-
Who has access to banking and accounting admin roles
-
Any prior fraud events or suspicious incidents
-
Your current insurance policies, if available
