Analyzing fintech cyber risks through insurance claims: A data-driven perspective

Insights

1. 01

   Cyber claims dominate

   The WTW Claims Database shows that fintech companies report a significantly higher percentage of cyber-related insurance claims compared to traditional financial institutions.

   • Cyber claims constitute 41% of all insurance claims filed by fintech firms.
   • In contrast, cyber claims account for only 5% in banking, 4% in wealth management, 2% in asset management, and 28% in insurance companies.

   ---

1. Given their tech-centric nature, this result is not surprising. Fintechs are inherently more exposed to cyber risks as their reliance on digital platforms, cloud services, and online customer interactions makes them prime targets for cyber threats. This high percentage of claims underscores the need for robust cybersecurity measures tailored to the specific vulnerabilities of fintech operations.

   ---

2. Social engineering and hacking damage

   Both fintech companies and traditional FI’s identify malicious data breaches as the primary cause of cyber claims, with 30% of fintechs' and 36% of traditional FIs' cyber claims attributed to this threat. These are the sort of classic hacking attacks where wrongdoers exploit holes in a firm’s cyber security perimeter to gain access to systems and data. While this is in and of itself not surprising, compared to traditional FIs, fintech firms face a unique mix of secondary and tertiary cyber risks, notably social engineering, and hacking damage, at higher rates than traditional FIs.

   ---

1. • Social engineering: Accounts for 24% of fintech cyber claims versus 10% for traditional FIs.
   • Hacking damage: Makes up 12% of fintech cyber claims compared to 6% for traditional FIs.

   ---

1. Fintech platforms, often dealing with innovative tech-first solutions, may present new vulnerabilities which cybercriminals may try to exploit. Social engineering attacks exploit human psychology, tricking employees or customers into divulging sensitive information or performing actions that compromise security. The higher incidence of hacking damage suggests that fintech platforms are targeted for their technological assets. Compare this to traditional FIs, who are more likely to be targeted for their large troves of customer data.

   ---

2. Overlap between cyber risks and crime

   Cyber risks in fintech firms often bleed into traditional crime, highlighting the blurred lines between cyber incidents and criminal activities.

   • Platform attacks and social engineering not only compromise data but can also lead to direct financial theft and fraud.

   ---

1. The digital nature of fintech operations also means that cyberattacks can serve as a vector for direct financial loss – theft of firm or customer funds via unauthorized transactions. This is a critical risk management issue to address, as cybercrime can seriously damage a firm’s hard-earned consumer trust. Firms should take great care then to ensure close coordination between their cyber insurance and crime, as the two policies must be considered in tandem when addressing this significant exposure.

   ---

2. Fintechs face fewer accidental data breach claims

   Fintech firms report fewer accidental data breach claims compared to traditional FIs.

   • Accidental data breaches account for 9% of fintech cyber claims versus 19% for traditional FIs.

   This discrepancy may be due to fintechs having newer, more secure systems built with modern security standards, or smaller sensitive record counts. Alternatively, it could indicate underreporting, or a lack of awareness that certain seemingly immaterial events are, in fact, reportable insurance claims. From our experience, late reporting of claims unfortunately remains a leading cause of claim denials, and fintech firms should lean heavily on their insurance broker for advice concerning potential incidents as early in the process as possible.

   ---

3. Lower incidence of ransomware claims in Fintechs

   Fintech companies report fewer ransomware claims than traditional FIs.

   ---

1. • Ransomware constitutes 5% of reported fintech cyber claims compared to 13% for traditional FIs.

   This may suggest that fintechs are better prepared for ransomware attacks, possibly due to more advanced cybersecurity measures or greater agility in responding to threats. However, it could also mean that ransomware attacks are underrepresented in the data because firms neglect to file claims, or that attackers focus more on traditional institutions perceived as more vulnerable when it comes to their generally larger troves of personally identifiable information (PII) or protected health information (PHI).

   ---

Contacts

---

Jordan Siegman

U.S. Head of FINEX Financial Institutions & Professional Services

emailEmailphone+1 212 309 0941

---