Your Cyber or Crime Insurance Claim Was Denied: What a California Business Can Do Next

Last updated: November 2026. Reviewed by Pavel Kolmogorov, California business litigation attorney (State Bar No. 321018).

No. When a cyber insurance claim is denied, the letter states the insurer's position, and that position can be tested against the policy. California courts read coverage clauses broadly and exclusions narrowly, and the insurer must prove that an exclusion applies. The federal appeals court that covers California has held that money wired on a fraudulent email instruction can be a loss resulting directly from computer fraud. Kolmogorov Law, P.C. litigates insurance coverage disputes for businesses.

Call (909) 235-6116 or contact us online to discuss a denied cyber or crime insurance claim.

What the denial letter does and does not decide

A denial letter is one side's reading of a contract.

Collect the full policy as issued for the period of the loss: the declarations, every form, and every endorsement. Then read the letter against it. Check whether the clause the insurer quotes is the one in your policy, and whether another insuring agreement reaches the same loss. A business may hold a cyber policy and a separate crime policy, and one loss can touch both.

A policy may require a sworn proof of loss within a set number of days, and it may set its own deadline for suing the insurer. California allows four years to sue on a written contract. (Code Civ. Proc., § 337, subd. (a).) The policy's suit clause may be shorter, so read it the day the letter arrives.

The grounds to look for after a fake vendor email

An accounts payable employee receives an email that appears to come from a known vendor and gives new bank details. The next invoices are paid to the new account, and the money is gone.

A denial of that claim rests on policy wording, which differs from one policy to the next. Look for these grounds in the letter.

The loss was not "direct." The insurer treats the employee's decision to pay as an intervening step.
The transfer was "authorized," because an employee knowingly initiated it.
A social engineering endorsement applies in place of the main coverage, with a lower limit.
A condition was not met, such as a call back to a known number before payment instructions were changed.

A breach or ransomware claim draws different grounds: late notice, a waiting period, or the answers given on the application.

How courts read exclusions and the word "direct"

The California Supreme Court has stated the ground rules. Coverage is interpreted broadly to protect the insured. Exclusions are interpreted narrowly against the insurer and must be conspicuous, plain, and clear. The insured shows that the claim falls within the basic coverage, and the insurer then has the burden of proving that the claim is specifically excluded. To prevail on the meaning of an exclusion, the insurer must show that its reading is the only reasonable one. (MacKinnon v. Truck Ins. Exchange (2003) 31 Cal.4th 635.)

In 2022 the Ninth Circuit decided an email fraud case under a commercial crime policy. An accounts payable clerk had wired funds after receiving emails that purported to come from her superior. On the facts alleged, the court held that the loss resulted directly from the fraud, because the funds were lost when they were sent as the email directed. (Ernst & Haas Management Co. v. Hiscox, Inc. (9th Cir. 2022) 23 F.4th 1195, 1202.) Initiating a wire, the court added, is not the same as authorizing the payment. (Id. at p. 1200.)

That decision reversed a dismissal and sent the case back. It did not decide who finally won, and it does not say which state's law it applied to the policy. Policies written since may use different words. Even so, a denial that rests only on the fact that your own employee sent the wire deserves a second look.

An insurer is liable for a loss when a covered peril was the proximate cause, even if a peril the policy did not contemplate was a remote cause. (Ins. Code, § 530.)

When the insurer blames your application

The insurer may say an answer on the application was wrong, such as a statement about multifactor authentication, and that it may rescind the policy.

Each party must communicate in good faith the facts within its knowledge that are material to the contract and that the other side has no means of finding out. (Ins. Code, § 332.) Concealment entitles the injured party to rescind, whether it was intentional or unintentional. (Ins. Code, § 331.) So does a representation that is false in a material point. (Ins. Code, § 359.) Materiality is judged by the probable and reasonable influence of the facts on the party entitled to them. (Ins. Code, § 334.)

The code says such a right to rescind may be exercised at any time before an action on the contract is commenced. (Ins. Code, § 650.) The dispute then turns on evidence: what the question asked, what was true on the date it was answered, and whether the answer mattered to the decision to issue the policy.

What to do after a cyber insurance claim is denied, and what to avoid

Ask the insurer in writing for the complete policy and every ground it relies on.
Calendar the proof of loss date and the suit deadline from the policy itself.
Give written notice under every other policy that might respond.
Send the facts the letter overlooked and ask for reconsideration.
Preserve the emails with full headers, the bank records, and any forensic report.

Avoid three mistakes. Do not let the insurance claim sit while you pursue the bank or the vendor. Those recoveries run on a separate track, described on our page about wire transfer fraud and business email compromise. Do not sign a release in exchange for a partial payment without reading what it gives up. Do not alter or recreate records.

What to bring to the first meeting

The denial letter and all correspondence with the insurer and the broker.
Every policy in force on the date of loss, with endorsements.
The application and any security questionnaire.
The fraudulent emails with headers, the wire confirmations, and any forensic report.

Frequently asked questions

We lost money to a fake vendor email and our cyber insurer denied the claim. Is that the end of it?

No. In California a denial is the insurer's reading of the policy, and a court may read it differently. Exclusions are construed narrowly, and the insurer carries the burden of proving that one applies. A federal appeals court has treated a wire induced by a fraudulent email as a possible direct loss from computer fraud.

Our insurer says we answered a security question wrong on the application and wants to rescind the policy. Can it do that?

Possibly. Under the California Insurance Code, concealment entitles the injured party to rescind, whether intentional or unintentional, and so does a representation that is false in a material point. The dispute is over whether the answer was false when given and material to the risk. What the question asked, and how your systems were configured that day, are the evidence to gather.

Does cyber insurance cover social engineering fraud?

It depends on the policy. Some cyber and crime policies address fraudulent payment instructions in a separate endorsement with its own limit. Others reach the loss through computer fraud or funds transfer fraud wording. In California the policy language controls, and an exclusion that can reasonably be read two ways is read in favor of coverage.

How long do I have to sue after a cyber insurance claim is denied?

Check the policy first. California's general period for suing on a written contract is four years, but a policy may set a shorter contractual deadline and may require a sworn proof of loss within a fixed number of days. Missing either date can end a claim that was otherwise sound, so calendar both from the policy text.

Who has to prove that an exclusion applies?

The insurer. Under California Supreme Court authority, the policyholder shows that the loss falls within the basic scope of coverage, and the insurer must then establish that the claim is specifically excluded. The exclusion must be stated in conspicuous, plain, and clear terms.

Talk to a California insurance coverage attorney

If your insurer has denied or underpaid a cyber or crime claim, call (909) 235-6116 or contact us online. Kolmogorov Law, P.C. is in Irvine, California.

Related reading: insurance litigation and our business litigation practice.

This page provides general information about California and federal law and is not legal advice. Outcomes depend on the policy, the facts, and the court.