A bookkeeper at a restaurant group in Coral Gables receives an email from the owner’s address asking her to change the account details for a produce supplier and release that week’s payment.
The email reads exactly like the owner. The supplier is real. The invoice matches one she has paid before.
She sends $34,000 to an account that is not the supplier’s, and nobody notices for eleven days.
That is not theft in the way a restaurant owner usually pictures it, and it is not covered by general liability, property, or a standard business owner’s policy. It is a crime loss, and whether anything responds depends on a form most restaurants do not carry.
Restaurants Are Built for This Exposure
Three characteristics make this class different from most retail.
Cash volume. Even with card dominance, restaurants handle cash daily — at the register, in tips, and on the nightly deposit run.
Inventory with resale value. Liquor, proteins, and equipment move easily and are difficult to reconcile precisely.
Turnover and access. High staff turnover, shifts covered by people who do not normally work them, and a level of access — to registers, to stockrooms, to the safe — that a small office never grants.
None of that makes a restaurant’s employees dishonest. It means the opportunity exists, the volume is large, and the losses are frequently small and repeated rather than dramatic and single.
What General Liability and Property Do Not Do
This is the gap, and it is consistent across forms.
General liability covers bodily injury and property damage to third parties. It does not address theft of your own money or inventory.
Property coverage responds to theft by outsiders — a burglary, a break-in — and most forms exclude theft by employees. That exclusion is deliberate and it is nearly universal.
So a restaurant with a comprehensive property and liability program can have no coverage at all for the most likely theft it will experience.
What a Crime Policy Actually Covers
Crime coverage is built from separate insuring agreements, and a restaurant does not need all of them. The ones that matter here:
Employee theft. Theft of money, securities, or property by an employee. This is the core coverage and the reason most restaurants buy the policy.
Money and securities, inside and outside the premises. Cash at the restaurant and cash in transit — the deposit run, which is an exposure almost nobody prices until something happens on it.
Forgery or alteration. Checks drawn on your account, altered or forged.
Money orders and counterfeit currency, which is a small item and a real one in a cash business.
Computer fraud and funds transfer fraud, covering unauthorized electronic transfers.
Social engineering fraud, which is the scenario at the top of this page — and which is frequently a separate endorsement rather than part of the base form. That distinction matters enormously, because the standard computer fraud agreement typically responds to unauthorized access, not to an authorized employee who was deceived into sending the money voluntarily.
If you take one thing from this article: ask specifically whether social engineering fraud is on your policy, and at what sublimit. It is often written at a fraction of the main limit.
Where Restaurant Losses Actually Occur
The register. Voids, refunds to a personal card, no-sale drawer opens, and unrecorded cash sales. POS reporting catches most of it if someone reviews the reports.
Inventory. Liquor and proteins leaving through the back door, over time, in quantities that read as waste.
The deposit. Cash between the restaurant and the bank, with one person handling it.
Vendor payments. Fictitious vendors, inflated invoices, and altered payment instructions. This grows with the size of the operation and with remote bookkeeping.
Payroll. Ghost employees and manipulated hours, more common in multi-location groups than single restaurants.
Gift cards and comps. Issued without a sale, or comped and pocketed.
Multi-Location Groups Carry More of It
A single restaurant with an owner on site most days has natural controls. A group with three or four locations and a central bookkeeper has a different structure, and the exposures scale faster than the revenue does.
Distance is the issue. The person authorizing payments may never see the invoices, the owner may not review reports weekly, and the same email that fooled the bookkeeper above works better when the owner is genuinely unreachable.
For any operation past two locations, crime coverage stops being optional and the limit should reflect the volume moving through the accounts rather than a default figure.
The Controls That Matter More Than the Policy
Crime coverage pays for the loss. These prevent it, and underwriters ask about them.
Separate the functions. The person who authorizes a payment should not be the person who enters the vendor, and neither should be the only person reconciling the account.
Verify changed payment instructions by phone, using a number you already had, not one in the email requesting the change. This single habit prevents nearly every social engineering loss.
Review POS exception reports weekly. Voids, refunds, no-sales, and discounts by employee. The pattern shows up long before the total does.
Count inventory on a schedule, particularly liquor, and investigate variances rather than absorbing them.
Reconcile bank accounts monthly, by someone who does not write the checks.
Require two people on the deposit, or use a service.
Run background checks on anyone handling money, and keep the records.
What Restaurant Owners Should Confirm
-
Do you carry a crime policy, or only property and liability?
-
Does your property policy exclude theft by employees?
-
Is employee theft coverage included, and at what limit?
-
Is money and securities coverage in place, inside and in transit?
-
Is social engineering fraud on the policy, or only computer fraud?
-
If social engineering is included, what is the sublimit?
-
Does the coverage extend to all locations if you operate more than one?
-
Who authorizes vendor payments, and who enters new vendors?
-
Do you verify changed payment instructions by phone?
-
Who reviews POS exception reports, and how often?
Restaurant Insurance in Florida
Prestige Insurance Group works with restaurants and restaurant groups across Miami, Coral Gables, Hialeah, Doral, Fort Lauderdale, Orlando, and Tampa — single locations through multi-unit operations.
Crime coverage is one of the least expensive lines on a restaurant program and one of the most commonly missing. Send your declarations page and we will tell you whether employee theft and social engineering are on it, and at what limits.
Call the office nearest you. Se habla español.
Miami: 305-969-8776 Orlando: 407-993-2331 Stuart: 772-247-3788
General information only, not legal advice. Crime coverage forms, insuring agreements, sublimits, endorsements, and carrier appetite vary substantially and change over time, and whether a specific loss is covered depends on the facts and the policy in force. Refer to your actual policies for the terms that apply to your business.
