What fraud training do cyber insurance forms expect for staff who send payments?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

Are employees who are responsible for disbursing or transmitting funds provided anti-fraud training, including detection of social engineering, phishing, business email compromise and other scams, on at least an annual basis?

Does the Applicant conduct, at least annually, awareness training to all employees to recognize and prevent email or phone manipulation techniques that trick users into transferring money or property to fraudsters?

Do you provide training on phishing/social engineering scams for all employees involved in transferring funds on behalf of your organization on at least an annual basis?

What does it mean for a small firm?

These questions sit in the crime or money transfer part of the form. Some forms ask about every employee, some about the people who send money.

How do I answer it truthfully?

Name the people who can send or approve payments. Check each has had the training in the last year, and keep the record. Read whether the form asks about all employees or only those people.

What can an outside reading show, and what can it not?

An outside reading can see registered domain names that differ from yours by a letter or two, the names used to send a forged invoice or a change of bank details.

Your DMARC and SPF records are public. Anyone can read whether mail servers are told to refuse mail forged in your domain's name.

It cannot see training or how payments are approved.

Which questions sit next to this one?

• Supplier bank detail changes
• Payments to a new account
• Wire authorization and sign-offs