A distributor of household and personal goods attempted to wire a $2.1 million payment to its landlord for a new lease, but unknowingly sent the funds to a bank account controlled by a threat actor.

Soon after wiring the money, the business realized the money never made it to the landlord and notified Coalition. In under one hour, Coalition made contact with the business, gathered the transfer details, and notified our government contacts for assistance in freezing the assets. Less than 24 hours later, all but roughly $100 of the funds were frozen and held for return to the distributor.

After recovering the stolen money, the distributor still sought answers to how the fraud occurred and engaged Coalition Incident Response (CIR).¹ After a thorough forensic investigation, CIR determined no unauthorized access to the business’ email account occurred: The fraudulent transfer was triggered by a spoofed email. The distributor’s lawyer called the “landlord” to verify the transfer but dialed the phone number that was provided in the spoofed email, which routed to the threat actor that verified the transaction.

After paying its $100,000 self-insured retention, the business’ Breach Response coverage covered $7,200 for CIR services and another $4,500 in breach counsel fees. Because nearly all of the stolen funds were recovered and returned to the business, its Funds Transfer Fraud coverage wasn’t triggered.

1. Coalition Incident Response services provided through Coalition’s affiliate are offered to policyholders as an option via our incident response firm panel.

The claim scenarios described here are intended to show the types of situations that may result in claims. These scenarios should not be compared to any other claim. Whether or to what extent a particular loss is covered depends on the facts and circumstances of the loss, the terms and conditions of the policy as issued and applicable law. Facts may have been changed to protect the privacy of the parties involved.

Insurance products are offered in the U.S. by Coalition Insurance Solutions Inc. (“CIS”), a licensed insurance producer and surplus lines broker, (Cal. license # 0L76155) acting on behalf of a number of unaffiliated insurance companies, and on an admitted basis through Coalition Insurance Company (“CIC”) a licensed insurance underwriter (NAIC # 29530). See licenses and disclaimers. Copyright © 2025. All rights reserved. Coalition and the Coalition logo are trademarks of Coalition, Inc