Cyber Insurance for Online Sellers
Your store lives in logins: Seller Central, email, the bank, ad accounts and the apps that connect them. This guide covers the cyber losses online sellers really face and where a cyber policy fits beside your Amazon cover.
What a cyber loss looks like for an online seller
Most sellers picture a cyber claim as a hacker stealing a customer database. For a marketplace business the more common story is quieter. Someone gets into the Seller Central login, swaps the bank account that receives your disbursements, and the next payout lands in an account you have never seen. Sellers who have been through it describe a fake suspicious-activity notice, a lockout, and a payout that had already gone by the time they got back in.
The second story belongs to importers. A supplier’s email is compromised, or a look-alike address appears, and an invoice arrives with new bank details for the deposit on your next production run. The money goes by wire, and wires are hard to claw back. The FBI’s Internet Crime Complaint Center counted 24,768 business email compromise complaints in its 2025 report, with reported losses of just over $3 billion, against roughly $32 million for ransomware.
The third is downtime. A ransomware attack on the laptop that holds your listing files, a compromised inventory or repricing app, or a locked ad account can stop sales for days. None of these involve a product hurting anyone, which is why your product liability policy never comes into the conversation.
Where your Amazon liability cover stops
The policy Amazon asks sellers to carry, set out on our Amazon seller insurance requirements page, is commercial general liability. It responds to bodily injury and property damage caused by your products and your business. Data, diverted payouts and fraudulent wires sit outside that policy’s job.
A cyber policy fills the gap with two kinds of cover. The first-party side pays your own costs: forensic investigators, a breach lawyer, customer notices, restoring data and systems, income lost while systems are down, and an extortion demand with the help of specialists to handle it. The third-party side answers claims and regulatory inquiries from people whose information was exposed, and often covers claims about the content you publish.
Payment fraud needs a careful look at the wording. Funds transfer fraud and social engineering cover, which deals with a fake invoice or a tricked employee, often comes as a sublimit inside the cyber policy or through a crime policy instead. Ask where it sits, how large the sublimit is, and whether the policy requires a callback to verify any change in bank details before it responds.
Customer data you hold, even as a marketplace seller
Amazon keeps most buyer information to itself, but many sellers still touch it. Order reports, shipping labels, customer-service tools and any software that connects to Seller Central through Amazon’s Selling Partner API can all pull names and addresses. Amazon’s security guidance for those connections is strict: delete personally identifiable information 30 days after order delivery, turn on multifactor authentication, keep security logs for at least 12 months, and email security@amazon.com no later than 24 hours after detecting a security incident.
Your own store adds more. If you sell on Shopify or another platform with a hosted checkout, card numbers are typed into the payment processor’s page and never reach your servers, which keeps most card data out of your hands. The scripts and apps on your storefront still need watching, because a skimming script placed on a checkout page is a well-known route for card data to leak.
Email lists, loyalty programs and warranty registrations are customer data too. California’s breach notice law reaches any business that holds California residents’ personal information, wherever the records are kept, and it calls for notice when unencrypted data is taken. Notification and the legal work around it are among the first costs a cyber policy pays.
What underwriters ask an online seller
Cyber applications for small online brands are short, but they are specific. Expect questions on multifactor authentication for Seller Central, email, banking and your store admin; how many people and outside agencies have access; whether each person has their own login or a shared password; and how you back up product data, listing files and accounting records.
Payment controls come next. Underwriters want to know whether someone confirms a supplier’s new bank details by phone, using a number already on file, before money moves, and whether two people sign off on large wires. A seller who does both looks very different on paper from one who pays whatever invoice arrives.
Our cyber insurance readiness checklist walks through these controls in order. Working through it before you apply makes the application quicker to answer and gives you clear answers when an underwriter follows up.
Choosing limits and cover for a store
Limits for a small online seller are set by a few numbers you already know: how much sales you would lose for each day the store or Seller Central account is down, how many customer records you hold, and the size of a typical supplier payment. The supplier payment figure matters most for importers, because a single diverted deposit on a production order is a large, immediate loss that sits outside every other policy you carry.
Ask how the policy treats an outage at a platform you depend on. Some cyber forms cover income lost when a vendor or marketplace you rely on goes down; others cover only your own systems. Check the waiting period before business income cover starts, since a short outage can fall inside it.
Agencies and software tools that work inside your account bring their own exposure. Our guide to insurance for Amazon agencies explains what to ask the partners you give access to, including whether they carry cyber cover of their own.
Putting cyber next to your Amazon program
We look at cyber alongside the product liability, inventory and certificate questions on our Amazon seller insurance hub, so the policies divide the work cleanly. For a quote, bring your annual sales by channel, the number of customer records you hold, the tools connected to Seller Central and your store, and the security controls you have in place today.
If you have had a payout diverted, a fake invoice paid or an account locked, tell us. A past incident does not end the conversation; insurers want to see what changed afterward.
Revisit the numbers at each renewal. A seller who adds its own storefront, a wholesale portal, a new marketplace or another agency partner during the year has a different exposure from the one described on the first application, and the cyber limit and the funds transfer sublimit should keep pace with how much money and data now move through the business.
A few useful answers
Common questions
Does Amazon require cyber insurance from sellers?
Amazon’s insurance rule for sellers asks for commercial liability cover, not cyber. Software and services that connect through Amazon’s Selling Partner API must follow Amazon’s data protection rules, and a cyber policy helps with the cost of an incident under them.
Is a hacked Seller Central account covered by cyber insurance?
Ask how the policy treats it. Incident response and restoring access sit in the core cyber cover, while a payout diverted to a criminal’s bank account falls under funds transfer or social engineering cover, which carries its own sublimit.
My payment processor handles card data. Do I still need cyber cover?
A hosted checkout keeps card numbers off your servers, but you still hold customer names, addresses and emails, logins to your store and marketplaces, and the money moving through your bank. Those are the exposures cyber cover is built around.
What if I pay a fake invoice from a supplier whose email was hacked?
That is social engineering fraud. Cover for it sits in a cyber policy’s funds transfer section or in a crime policy, usually with a sublimit and a requirement to verify bank-detail changes by phone.