Personal cyber insurance still new but rising in demand as digital crimes increase
When it comes to protecting against cyberattacks, identity theft and other digital crimes, Canadians have been hearing the same advice for years: vary your passwords, use two-factor authentication and consider a virtual private network to mask your location.
Yet tens of thousands of Canadians fall prey to cybercrime every year, so some are adding a new tool to their arsenal: personal cyber insurance.
Depending on the provider and plan, such coverage may include everything from the unauthorized use of bank accounts or credit cards to counselling and social media monitoring in the event one is cyber bullied. Some plans help with restoring data and access to computers or digital home systems. Others give customers professional help if someone is trying to extort them online.
While insurance covering these kinds of incidents is still relatively new, interest in it is growing in tandem with the number of cybercrimes, insurance and online crime experts say.
Statistics Canada data shows the number of police-reported cybercrimes hit 74,073 in 2022, up from 71,727 in 2021 and 33,893 in 2018. (Experts have long said cybercrime is under-reported because of the stigma and embarrassment that can be associated with being duped.)
“You can be the most careful person in terms of online security, you can be doing everything right ... but the fact remains that as careful you may be, you can fall victim to a cyberattack through no fault of your own,” said Carolyn Boris, VP and product developer manager of insurer Chubb’s personal risk services.
In a 2022 survey of 1,605 Canadians and Americans, Chubb found 39 per cent, or two in five respondents, had purchased a personal cyber insurance policy.
Chubb has been offering such insurance since 2017. Through the company, Canadians can purchase insurance that will replace lost or stolen digital property or money from attacks and ensure customers have a place to go, if their home is made uninhabitable. Chubb also has coverage that pays expenses related to hiring public relations, legal, and digital forensic firms to aid in the recovery from cybercrimes.
Customers can opt for as little as $25,000 in coverage or as much as $500,000. They pay as little as $127 per year “and it goes up from there,” Boris said.
The number of people opting for the insurance has steadily ticked up and Boris expects that trajectory to continue as cyberattacks show no signs of slowing down and begin to make use of advances in generative artificial intelligence.
Molly Reynolds, a partner at the Torys LLP law firm, first heard about cyber insurance about two years ago and noticed it was predominantly in the U.S. and in some cases, offered as part of a home ownership policy.
The coverage is “definitely nascent” and the bulk of attacks target businesses rather than individuals, but she still foresees more people taking out personal cyber insurance policies.
“I don’t know if it will be wildly popular across the whole population, but you can imagine people in particular industries or, for example, people who are very high net worth, running family companies, where they have almost business-level cybersecurity risks, (would sign up for it),” she said.
Social media influencers may also benefit from such insurance products, especially if it covers loss of income or interrupted access to accounts or devices, Reynolds added.
But she warns people interested in the insurance that “a lot of the really serious consequences of cybercrime aren’t compensable through insurance.”
“A lot of the harm is really around reputational, emotional and sort of intangible categories, where the insurance isn’t going to help that much,” she said.
Still, Nesha Baggan-Belasco says personal cyber insurance can be worth it, especially when you compare “the amount you’re paying every month compared to what you could possibly lose.”
“You see the examples on the news every single day of people being taken advantage of just for simply logging on to the wrong website,” said the senior manager of product development at Aviva Canada’s personal insurance.
“They thought they logged on to their bank website and it’s actually not a bank website, and their account has been wiped. This is becoming more and more common, unfortunately.”