Fraud and phishing are driving 44% of Gallagher New Zealand’s cyber insurance claims, with business email compromise and phishing making up 23% of attack types and payment and funds transfer fraud accounting for an additional 21%. The ministry said the National Cyber Security Centre recorded 1,129 incidents in the second quarter of 2026, with scams and fraud being the most common category, according to officials.
Background And History
The shift from system-wide attacks to human-centric fraud has led to an increase in cyber insurance claims related to social engineering and payment fraud. Analysts note that cyber incidents often stem from everyday processes rather than major system breaches, as Mark Jones of Gallagher said. The World Economic Forum’s 2026 outlook identifies cyber-enabled fraud as a top concern for CEOs, surpassing ransomware, the ministry said.
How It Works
Business email compromise and payment fraud operate by exploiting human vulnerabilities, such as phishing attacks and compromised accounts, often through everyday interactions and processes. Social engineering coverage is not standardized and often exists as an optional extension with its own sublimits, according to the National Cyber Security Centre. Insurers frequently require specific internal controls to be in place before covering losses from fraudulent bank detail changes, analysts note.
Numbers And Implications
The numbers show that combined, fraud and phishing represent 44% of all cyber insurance claims handled by Gallagher in New Zealand. Reported direct financial losses fell to $2.7 million, down 52% from the $5.6 million recorded in the first quarter, the ministry said. The critical gap between headline policy limits and social engineering coverage means that clients may have far less protection for fraud losses than the policy’s headline limit suggests, according to officials.
What It Means Now
The implications of this trend are that businesses need to strengthen their resilience and review their cyber insurance policies to ensure they have adequate coverage for social engineering and payment fraud. As Mark Jones of Gallagher said, cyber incidents don’t always start with a major system attack, and businesses can actively mitigate cyber risk through resilience and policy review. The World Economic Forum’s 2026 outlook highlights the importance of addressing cyber-enabled fraud, and businesses should take steps to protect themselves from these types of attacks, analysts note. Our clients are being affected by payment fraud, phishing attacks and compromised accounts, often through everyday interactions and processes,” said Jones.
Sources
- Fraud and phishing behind 44% of Gallagher NZ cyber claims
- Computer security
- Binance $6.3 Billion Heist Prompting Closer Scrutiny By Insurers
- Eddie Gallagher: Paedophile priest brought boy under 18 back from mission in Belize to live in rectory
Photo: Clifford / Unsplash (Unsplash License)
