Nov 9, 2026 @Paul Rentz
Why small, hands-on businesses get picked
Criminals don’t need to know much about your trade. They need to know that your business moves large payments on tight deadlines and that nobody is double-checking.
That describes a lot of contractors and farms. One person, often a bookkeeper, an office manager, or a spouse, handles the money. There’s no IT department. The owner is on a jobsite or in a tractor cab, answering email from a phone and approving things between other tasks. Payments are big and seasonal, so a $40,000 transfer doesn’t look unusual. And when a supplier says “pay by Friday or we can’t deliver,” it’s easy to move fast.
The two examples below are illustrations, not real accounts. But the pattern behind each one is common, and so are the controls that would have helped.
Example 1: The contractor and the “new” account
A mid-size contractor is three weeks into a commercial build. The office manager gets an email from the framing lumber supplier, in the same thread as the last three invoices. The supplier has “moved to a new bank” and wants the $62,000 materials payment sent there. She sends the wire Thursday afternoon so the next delivery isn’t held up.
The supplier’s real email account had been taken over weeks earlier. The criminal read the invoice threads, waited for a big one, and replied from inside the real conversation. The contractor finds out the following Tuesday when the supplier’s accounts receivable department calls about the past-due balance.
The same trick runs in the other direction. A criminal who’s inside a contractor’s mailbox can send the owner or general contractor a pay application or draw request with changed payment details, so the progress payment goes to the wrong account instead.
What would have stopped it: a call to the supplier at a phone number already on file, before any payment details changed. A second person approving wires over a set dollar amount. And multi-factor authentication on every email account, which would likely have blocked the takeover to begin with.
Example 2: The farm and the locked office computer
It’s the second week of harvest. The farm’s bookkeeper comes in Monday morning and finds a message on the office computer: the files are encrypted, and the only way to get them back is to pay in cryptocurrency. The accounting software, payroll records, grain contracts, input purchase records, and lender paperwork all live on that machine. The backup is an external drive plugged into the same computer, and it’s locked too.
Payroll for the crew is due Friday. A buyer is waiting on paperwork to settle a load. The farm’s lender wants records the farm can’t pull up. Nobody can say how it got in, which is a common outcome: a phishing email, a reused password, or a remote access tool left open. The farm is losing days at the busiest time of the year, and now has to decide who to call first.
It’s also worth noting that employee records on that computer, including Social Security numbers for the crew, may trigger notification obligations. That’s a question for the farm’s attorney.
What would have helped: a backup kept off the network or in a cloud service, and tested so someone knows it restores. Multi-factor authentication on email and any remote access. Software updates kept current. And a plan that’s already written down for the first call: your IT person, your agent, and your attorney, in that order or whichever makes sense for you.
Where insurance fits for each trade
Coverage differs by carrier and form, so treat this as a map of what to ask about, not a promise of what any policy does.
For contractors, cyber coverage often shows up as a small endorsement on a business owners policy or package, with low limits. A general liability policy isn’t designed to respond to a fraudulent wire. The part to look at closely is social engineering or funds transfer fraud coverage, which may sit in a cyber policy or in a separate commercial crime policy, and often carries its own sublimit and conditions. A $62,000 payment redirect is the kind of loss where the difference between a $25,000 sublimit and a higher one matters.
For farms, many farm policies don’t include cyber coverage at all, and a farm may not have a standalone policy either. Ransomware is where a full cyber policy tends to matter: forensic investigators to find out what happened, legal help with notification, support dealing with the extortion demand, and, depending on the policy, coverage for lost income and the cost to restore data while you’re down.
In both cases, it’s worth asking four questions. What’s the limit for social engineering or fraudulent payment instructions? Is there a verification requirement, like a call-back? Does the policy cover ransomware response and business interruption, and for how long? And does it provide a claims hotline and approved vendors, so you aren’t searching for help during an incident?
Get a second set of eyes on your coverage
As an independent agency, we can compare cyber and crime coverage from several carriers, and we know how contractors and farms actually operate. We’ll go through what you have now, show you where the gaps are, and get you quotes.
For a quick review, have these on hand: your current policies, your annual revenue and payroll, who hosts your email, whether multi-factor authentication is turned on, how you handle payment changes today, and where your business data is backed up.
Call Rentz & Rentz Insurance in Baxley for a cyber and crime coverage review. They can be reached at (912)367-1479 or service@rribaxley.com.
This article is for general information only and is not a description of any specific policy or a guarantee of coverage. The examples are illustrations, not real accounts. Coverage is subject to the terms, conditions, and exclusions of the policy as issued. Consult your attorney about notification or reporting obligations.