The owner of an online boutique in Hialeah sells clothing and accessories through her own website and an Instagram shop. One Monday, her payment processor emailed to say that several customers had reported fraudulent charges on cards used on her site, and the processor wanted a forensic investigation. Over the next weeks she learned that malicious code had been inserted into her checkout page through a plugin she had not updated, quietly copying card details as customers typed them. She had to notify customers, pay an investigator approved by the card brands, respond to her processor and answer questions from an attorney representing a group of affected buyers. Her business owners policy, she discovered, did not cover any of it.
For most businesses, cyber liability is one coverage among several. For an online store, it sits close to the center of the insurance program, because collecting payments and customer information is not a side activity. It is the business.
Why Online Payments Carry Their Own Risk
Every online sale is a card-not-present transaction. There is no chip to read and no signature to compare, so the merchant relies on the information the customer enters. That makes online stores a natural target for stolen card numbers, and it makes their checkout pages a target for attackers who want to collect fresh card data. A store does not need to be large to be attacked. Automated tools scan thousands of small sites for outdated software, weak passwords and vulnerable plugins, which is why small businesses are frequent victims, as we explain in why small businesses are real cyberattack targets.
The attack on the Hialeah boutique is a well-known type. Malicious script is added to a checkout page, often through a compromised plugin or third-party service, and it sends card details to the attacker as customers enter them. The site works normally, so the merchant may not notice until the processor or a card brand traces the fraud back to it.
PCI Compliance and the Merchant’s Responsibilities
Any business that accepts card payments agrees, through its processor and merchant agreement, to follow the Payment Card Industry Data Security Standard. The requirements depend on how payments are handled. A merchant that sends customers to a hosted payment page run by the processor has a smaller compliance burden than one that collects card data on its own server, but outsourcing payment processing does not eliminate the merchant’s responsibilities entirely. The current version of the standard specifically addresses scripts running on payment pages, because of the attacks described above.
When a breach happens, the merchant agreement usually allows the processor to pass along assessments from the card brands, require a forensic investigation and, in serious cases, terminate the merchant account. These costs can arrive quickly and can be substantial for a small business.
What Cyber Liability Insurance Typically Covers
A cyber policy is usually built from two parts. First-party coverage pays the business’s own costs after an incident: forensic investigation, legal advice on notification requirements, notifying customers, credit monitoring, restoring data and systems, ransomware response and lost income while the website or systems are down because of a covered attack. Third-party coverage responds when others make claims against the business, such as customers whose data was exposed, payment card industry assessments where the policy includes them, and regulatory investigations.
Many policies also include access to a breach response team, which can be as valuable as the money. A small business owner facing a breach for the first time rarely knows which lawyer, investigator or notification vendor to call, and the order of those calls matters.
Payment Fraud, Chargebacks and Social Engineering
Online sellers deal with a steady flow of chargebacks, including disputes from customers who received their orders but claim otherwise. These losses are generally treated as a cost of doing business. Cyber policies typically do not pay for ordinary chargebacks, fraudulent orders placed with stolen cards or refunds the merchant chooses to issue. The best defenses are operational: fraud screening tools from the processor, address and security code verification, delivery confirmation and clear documentation for disputes.
A different kind of fraud deserves its own question. When a criminal impersonates a supplier or employee and persuades the business to wire money or change payment instructions, the loss may fall under social engineering or funds transfer fraud coverage. Some cyber policies include it with a sublimit, some crime policies cover it, and some businesses have neither. If your business pays suppliers electronically, it is worth confirming where that coverage sits.
What Cyber Policies Usually Leave Out
Cyber policies vary widely, so the exclusions deserve a careful read. Common limits include losses from known vulnerabilities the business failed to fix, contractual penalties the business agreed to outside the policy’s coverage, the cost of upgrading systems after a breach, and bodily injury or property damage, which belong under other policies. Many carriers also require security controls as a condition of coverage, such as multifactor authentication on email and administrative accounts, regular backups and current software. A business that says it has these controls on the application and does not have them in practice can face a disputed claim.
Where Cyber Fits With the Rest of the Program
A business owners policy remains the foundation for an online seller’s property and general liability coverage, and our overview of e-commerce insurance in Florida explains how the pieces fit together. Some business owners policies offer a small data breach endorsement, which can be a useful starting point but is usually far narrower than a standalone cyber policy. For a store that processes payments every day, the standalone policy is typically the better fit.
Worth Confirming With Your Agent
-
Whether you carry a standalone cyber policy or only a limited endorsement on a business owners policy
-
Whether the policy covers payment card industry assessments and forensic costs required by your processor
-
Whether business income from a website outage caused by an attack is covered, and the waiting period
-
Whether social engineering and funds transfer fraud are covered, and at what limit
-
Which security controls the carrier requires, and whether your business actually has them in place
-
Who handles your checkout and payment page, and what your merchant agreement makes you responsible for
This article is general information and is not legal advice.
Talk to Prestige Insurance Group
Prestige Insurance Group helps Florida online sellers compare cyber liability options and place coverage that fits how they take payments and store customer data. If your current insurance consists only of a business owners policy, or you are not sure what your cyber coverage would do after a breach, we can review it with you.
Call the office nearest you. Se habla español.
Orlando: 407-993-2331
Miami: 305-969-8776
Stuart: 772-247-3788
Prestige Insurance Group, License L057894
