What the insurance actually is
The product that covers payroll fraud is commercial crime insurance, or its small-business form, an employee dishonestyadd-on to a business owner's policy. It reimburses direct losses from employee theft — embezzlement, ghost-employee payments, padded hours, forged checks. For a small business, standalone coverage typically runs a few hundred to low four figures a year depending on limits, headcount, and your controls — insurers price weak oversight the way health insurers price smoking.
Read against the actual numbers, basic coverage holds up reasonably well: the median payroll scheme costs $63,000, well inside common limits. The quarter of cases that run past $230,000 are why limits deserve more thought than the premium does (the full distribution is here).
The fine print that surprises people
- Social engineering is usually a separate endorsement. The scam where someone tricks your staff into sending money — a fake employee email rerouting a direct deposit, a spoofed CEO requesting a transfer — is typically excluded from base employee-dishonesty coverage, because no employee was dishonest. The endorsement that covers it commonly carries a sublimit in the $100,000–$250,000 range even on policies with much higher headline limits. Given that reported email-compromise incidents average around $123,000 apiece, a $100,000 sublimit is thinner than it looks.
- Coverage comes with homework attached. Social engineering endorsements routinely require callback verification — confirming any payment-change request through a second channel — or dual approval before coverage applies. Skip the callback, and the claim can be denied for exactly the loss you bought the endorsement for.
- Claims demand proof.Expect to document the loss in detail, provide a police report, and answer for your own controls. “Money is missing and we think it was Dave” is not a claim; the records from a payroll audit are.
- Notice deadlines are unforgiving — report late and an otherwise valid claim can die on procedure. (Where reporting fits in the first-week sequence: how to report payroll fraud.)
The ERISA bond is not what you think it is
Businesses with a 401(k) already carry something called a fidelity bond and often assume it covers employee theft generally. It doesn't. The ERISA fidelity bond — required at 10% of plan assets, minimum $1,000, capped at $500,000 — protects the retirement plan's participants from someone stealing plan funds. If your bookkeeper invents a ghost employee and pays them from the operating account, the ERISA bond owes you nothing. Company money needs its own coverage.
What insurance can't give back
Even a claim that pays in full doesn't make you whole. The median payroll scheme runs 13 months before detection — insurance reimburses (some of) the money afterward, but it can't find the fraud, and it doesn't refund the year of distorted job costing, the deductible, the premium jump at renewal, or the weeks of management attention the investigation eats. Insurance is a shock absorber for the loss you failed to prevent. It has no effect on whether the loss happens, or how long it compounds first.
Prevention attacks the duration directly. Controls like segregation of duties make schemes hard to start; continuous monitoring and periodic audits shrink the window from a median 13 months toward weeks — and detection speed is the single biggest lever on loss size. Frauds caught within six months had a median loss of $40,000; schemes that ran five-plus years, over $1.1 million.
The verdict
Both, in this order. Controls first, because they're cheap and the insurer effectively requires them anyway — callback rules, dual approval, documented processes. Insurance second, sized for the tail risk rather than the median: the long-tenured manager with a half-million-dollar scheme, not the $18,000 one an audit would have caught. What insurance shouldn't be is a substitute for looking — an unwatched payroll with a good policy attached is still an unwatched payroll, just one with slightly better paperwork at the end.
If the prevention side of the ledger is where you're thin, start with the best payroll fraud detection software or the no-software version, how to detect payroll fraud.