Firms face rising costs from employee risks
Employee risk has risen on corporate priority lists as losses from staff behavior reach substantial levels, Charles Bush, head of commercial claims at Zurich Insurance, stated.
In an interview, Bush explained that cost-of-living pressures, increased artificial intelligence use, and geopolitical cyber threats have formed a combination driving financial and reputational harm tied to workforce practices. While employees remain vital to organizations, they also represent a major vulnerability.
Five trends driving losses
Zurich’s claims records highlight five areas where employee-related risks are causing problems:
- Social engineering scams tricking staff into revealing sensitive data or transferring funds.
- Theft of money, intellectual property, or customer information by employees.
- Cyber incidents, including ransomware and data breaches.
- Employment practices liability claims, such as discrimination or wrongful termination.
- AI adoption, which overlaps with all four other risks and creates new security gaps.
Social engineering stands out among these, Bush noted. Though the number of cases remains steady, the financial damage is severe. Zurich has handled two losses over £10 million this year, along with several smaller claims.
One growing tactic is “fake president fraud.” Criminals impersonate a CEO or senior executive, often through WhatsApp, and direct a high-ranking employee to make urgent payments—usually framed as part of a confidential merger or legal deal. The scams are increasingly convincing, with fraudsters using voice synthesis to mimic an executive’s tone if the victim calls the provided number.
Bush explained that targeted employees are typically pressed for time. After verifying the first payment, they assume subsequent requests are legitimate.
Related: Insurance Times unveils 2026 Talent Report with Intact
AI is making phishing emails more difficult to spot. Attackers now use the technology to eliminate errors, replicate company branding, and personalize messages using public information from platforms like LinkedIn. A single click on a malicious link can compromise an entire network, Bush warned.
Prevention over cleanup
Bush described steps companies can take to limit exposure. The most important is building a culture where employees feel safe verifying unusual requests—such as calling a known contact number instead of responding to a suspicious message.
Other suggestions include:
- Multi-level payment verification to counter fake president fraud.
- Clear policies for AI use to ensure secure and ethical deployment.
- Thorough onboarding for new hires.
- Regular phishing simulations to train staff in recognizing fraudulent emails.
Preventing these risks is a smart investment compared to managing the aftermath, Bush said. A single incident can cause financial and reputational damage far exceeding the cost of proactive measures.
He also highlighted the value of claims data in shaping risk strategies. Many incidents stem from simple process failures or gaps, he noted. Identifying these patterns helps all customers, not just those who have already experienced losses.
Insurance receipts reached £2.12 billion in May, signaling heightened demand for coverage as organizations seek to mitigate these risks.
