The January rescue by Navy Seals of U.S. aid worker Jessica Buchanan and her Danish co-worker in Somalia highlighted the problem of kidnapping for ransom in Third World nations. Upon hearing that story, many risk managers probably breathed a sigh of relief that they have kidnap and ransom coverage. That would be a mistake. "Most companies are doing a 'B' job in this area," says Matt McKinley, principal at McKinley International Risk Management, a Malvern, Pa., broker. "Risk managers know there is some kind of K&R rider in their policy, but they don't know what it does or what it covers. When they send people abroad, do those people even know what number to call if they get a note under the office door threatening to blow their office up if they don't make some extortion payment?"

That gets to another key point: kidnapping is changing. Classic kidnapping, with a person snatched and held for ransom, has evolved into "express kidnapping," says Greg Bangs, product manager for crime, kidnap and ransom insurance at Chubb, "where people are grabbed, robbed and taken to an ATM, where they're forced to withdraw money, and then get dumped, often stripped and beaten."

Also increasingly common, Bangs says, is cyber extortion—criminals hack into a company computer, take down one component and threaten to bring down the whole system if they aren't paid off. In product contamination extortion, crooks inject contaminant into a pharmaceutical or beauty product in a store, then report it and threaten to poison more of the company's products if they aren't paid a ransom.