# Crime and fidelity claims in Estonia: payment and employee fraud URL: https://insurancelawestonia.ee/guides/crime-fidelity-claims-estonia/ Author: Dr Olavi-Jüri Luik, Partner, Head of Insurance Law, attorney at law (Advokaadibüroo WIDEN OÜ) Last updated: 2026-11-05 > Invoice fraud, CEO fraud, social engineering and employee theft under Estonian law: bank liability for payments, recovery. Crime and fidelity policies (commercial crime, fidelity guarantee, bankers' blanket bond, social-engineering extensions) respond to some of the most frequent financial losses suffered by Estonian companies: fake invoice and supplier-change fraud, CEO fraud, authorised push-payment scams, compromised e-mail accounts and theft or embezzlement by employees. This guide explains the Estonian legal framework that determines (i) whether the loss can be shifted to a bank or another third party, (ii) how the insurer can recover, and (iii) how Estonian insurance contract law affects the policy conditions typically found in crime wordings. ## 1. Typical loss scenarios | Scenario | Characteristic legal issue | |---|---| | **Invoice or supplier-change fraud**: a fraudster impersonates a supplier and the company pays to a new account | The payment is *authorised* by the company; bank liability for unauthorised payments does not apply; focus on verification of payee and on recovery from the recipient account | | **CEO fraud**: an employee is instructed by a fake executive to make an urgent transfer | Authorised payment; internal control failures; social-engineering sublimits (*alamlimiidid*) in the policy | | **Account takeover**: a fraudster obtains online banking credentials and initiates payments | Potentially an *unauthorised* payment; bank refund rules and the payer's gross negligence | | **Employee theft or embezzlement** | Fidelity cover; employer's claims against the employee; criminal proceedings; attribution of knowledge | | **Collusion with third parties** | Definitions of "employee" and "third party"; discovery and prior knowledge | ## 2. Shifting the loss to the bank: Estonian payment services law The Estonian rules implementing the Payment Services Directive are in the Law of Obligations Act (*võlaõigusseadus*, VÕS), §§ 709 ff., with the liability rules in §§ 733¹–733¹⁴.[^1] ### 2.1 Unauthorised payments For an unauthorised payment, the payer's payment service provider may not charge fees, and must refund the amount **immediately and at the latest by the end of the following business day** after becoming aware of the unauthorised payment, restoring the account to the position it would have been in had the payment not occurred (VÕS § 733² lg 1–2). The provider may refuse the refund in case of fraud by the payer, but only if it informs the police (§ 733² lg 4).[^1] The payer bears losses from a lost or stolen payment instrument, or its otherwise unauthorised use, only up to the agreed limit and **at most EUR 50** (§ 733⁸ lg 1). The cap does not apply if the payer acted fraudulently or breached, intentionally or through gross negligence, its obligations regarding the payment instrument or the conditions of issue and use (§ 733⁸ lg 2). The payer bears no risk for use after notifying the loss of the instrument, where the provider failed to provide a means of notification, where the loss was caused by the provider or its agent, where the payer could not have detected the loss before the payment, or where the provider does not require **strong customer authentication**, except in case of fraud (§ 733⁸ lg 3–4).[^1] ### 2.2 Authorised payments induced by fraud In invoice and CEO fraud, the company itself authorises the transfer. The refund rules for unauthorised payments therefore do not apply. Moreover, if a payment order is executed in accordance with the unique identifier (IBAN) provided by the client, it is deemed correctly executed with respect to the payee designated by that identifier, and the provider is not liable for non-execution or defective execution if the identifier was wrong; where the client gave additional information (such as the payee's name), the provider is liable only in accordance with the unique identifier (VÕS § 733¹ lg 1–2).[^1] ### 2.3 Verification of payee The EU Instant Payments Regulation introduced a mandatory **verification of payee** service for credit transfers in euro: the payer's provider must, before the payer authorises the transfer, check whether the payee's name matches the account identifier and notify the payer of any discrepancy (Regulation (EU) No 260/2012, art 5c, inserted by Regulation (EU) 2024/886). Providers in the euro area, including Estonia, had to comply by **9 October 2025**.[^2] Article 5c(8) addresses the liability of providers where the verification service is not properly provided and the interaction with the PSD2 rule on incorrect unique identifiers. Business clients may opt out of the service for bulk payments, and providers must inform their clients of the consequences of ignoring a mismatch notification for provider liability and refund rights (art 5c(7)).[^2] In supplier-change fraud since October 2025, the first question is therefore whether a verification-of-payee check was performed and what it showed. ### 2.4 Contracting out for business clients The payment services provisions are mandatory in favour of the client (VÕS § 733¹⁴ lg 1), but if the client is not a consumer, the parties may agree that certain provisions, including the payer's liability rule in § 733⁸, do not apply in whole or in part (§ 733¹⁴ lg 6).[^1] Banks' general terms for business clients often use this option. A recovery analysis must therefore start with the bank's business terms. ### 2.5 Other claims against banks Outside the specific payment rules, claims for damages under VÕS § 115 remain possible (§ 733⁹ lg 1), and liability is excluded only for unusual and unforeseeable circumstances beyond the provider's control or where the provider complied with a statutory obligation (§ 733⁹ lg 2).[^1] Claims against the **recipient's** bank (for example for opening or maintaining a mule account despite red flags) are based on tort and are difficult, but they are not excluded where the bank breached protective rules. ## 3. Recovery from fraudsters and recipients - **Speed.** Immediate recall requests through the paying bank, a criminal complaint to the police and, where funds are still in an Estonian account, a request for seizure in criminal proceedings or an application for civil interim measures are essential within hours. - **Unjustified enrichment.** A recipient who received the funds without legal basis is liable under the rules on unjustified enrichment, which also apply where an avoided or void transaction is unwound.[^3] - **Tort.** The fraudster and those who knowingly assisted are liable under VÕS §§ 1043 ff.; several liable persons are jointly and severally liable (VÕS § 137).[^1] - **Subrogation.** Once the crime insurer pays, the insured's claims against the fraudster, the recipient and any bank pass to the insurer to the extent of the payment (VÕS § 492 lg 1). The insured must not waive or settle these claims without consent (§ 492 lg 2).[^1] See the [subrogation guide](https://insurancelawestonia.ee/guides/subrogation-recovery-estonia). - **Cross-border recovery.** Where the funds have left Estonia, recovery depends on how quickly a freezing order can be obtained where the money now sits. WIDEN's Estonian office is a member of the [International Fraud Group (IFG)](https://www.internationalfraudgroup.com/), a global network of lawyers specialising in tracing, freezing and recovering stolen assets, which allows partner counsel in many jurisdictions to be engaged without delay.[^5] - **Limitation.** Tort claims against fraudsters become time-barred three years from knowledge of the damage and the liable person, with a ten-year long-stop (General Part of the Civil Code Act, *tsiviilseadustiku üldosa seadus*, TsÜS, § 150). Contractual claims against banks: three years, or ten if the breach was intentional (TsÜS § 146).[^3] ## 4. Employee theft: the employer's claims The employer's claims against a dishonest employee are based on the employment contract and on tort, subject to the special rules of Estonian employment law on employees' liability towards the employer, which must be checked in each case. Criminal proceedings (embezzlement, fraud, computer fraud) allow the victim to file a civil claim within the criminal case, which is often the most efficient route to an enforceable title. Fidelity insurers should coordinate with the insured on the civil claim in the criminal case, since that claim passes to the insurer upon payment. ## 5. Crime insurance under Estonian insurance contract law ### 5.1 Nature of the cover Crime and fidelity insurance is indemnity insurance (VÕS §§ 476 ff.). The insurer compensates the insured's actual loss and never more (§ 477), loss of profit only if agreed (§ 476 lg 4), and the subrogation rule of § 492 applies.[^1] Fidelity guarantees issued to a third party may qualify as suretyship insurance and fall outside the mandatory rules if they cover business risks (§ 427 lg 2 p 5). ### 5.2 Applicable law and mandatory rules A crime policy for an Estonian company that does not qualify as a large risk will as a rule be governed by Estonian law, because the laws that may be chosen under Rome I art 7(3) will normally all lead to Estonia where the company and its insured establishments are there. The mandatory rules of VÕS § 427 lg 1 then apply unless the contract falls within a class listed in § 427 lg 3 (for crime cover, typically the financial loss class in § 12 lg 1 p 16 of the Insurance Activities Act (*kindlustustegevuse seadus*, KindlTS)) and the policyholder meets the class and size conditions in § 427 lg 3: at least two of a balance sheet total above EUR 6.6 million, net turnover above EUR 13.6 million and an average of at least 250 employees, assessed on consolidated figures for a group (§ 427 lg 4).[^4] See the [choice of law guide](https://insurancelawestonia.ee/guides/choice-of-law-jurisdiction-insurance-estonia). ### 5.3 Internal control conditions Crime wordings frequently require dual authorisation of payments, call-back verification of changed bank details, segregation of duties and regular reconciliations. Under Estonian law these are obligations to reduce the insured risk. The insurer may not rely on a release clause if the breach was not culpable or had no effect on the occurrence or extent of the loss (VÕS § 452 lg 2 p 1–2).[^1] If the call-back procedure was omitted but the fraudster had also compromised the supplier's telephone line, so that a call-back would not have revealed the fraud, the breach was not causal. Social-engineering cover is often structured as a separate insuring clause with a sublimit (*alamlimiit*) and a specific verification condition. Where the verification procedure is framed as part of the definition of the insured event (cover only for transfers made after a verification call), it may be treated as a risk description outside § 452. The distinction is decided on substance, and ambiguity is construed against the insurer (VÕS § 39 lg 1). ### 5.4 Discovery, notification and proof Most crime policies operate on a **discovery** basis. Estonian law does not prohibit discovery triggers, but notification duties and their consequences are governed by VÕS §§ 448–449: negligent late notification reduces the indemnity only to the extent of the insurer's prejudice, and only intentional breach releases the insurer.[^1] Proof-of-loss deadlines in the wording cannot override these rules where § 427 lg 1 applies. The insurer may require information and evidence that can reasonably be expected from the insured (§ 448 lg 2); forensic accounting reports are usually reasonable for larger losses. ### 5.5 Dishonest employees, alter egos and attribution The intentional causation exclusion in VÕS § 452 lg 1 releases the insurer where the policyholder, the insured person or the beneficiary caused the insured event intentionally. A dishonest ordinary employee is not the policyholder, so his intent does not trigger § 452 lg 1; this is precisely the risk the fidelity cover insures. The position is different where the dishonest person is the owner or sole director of the policyholder, whose intent may be attributed to the company. Where the insured risk relates to a third party, that third party's knowledge and conduct are equated with those of the policyholder (§ 465 lg 1).[^1] Wordings usually exclude losses caused by directors or owners above a shareholding threshold; such exclusions are risk descriptions and are enforceable if transparent. Prior knowledge clauses (cover ends for an employee once a director learns of dishonest acts) are compatible with Estonian law but must be applied with the § 452 lg 2 tests where they are framed as obligations. ### 5.6 Overlaps with cyber and D&O A fraudulent payment instruction delivered through a compromised e-mail account may trigger both crime (social engineering, computer fraud) and cyber (funds transfer fraud) covers. If both cover the same risk, the insurers are jointly and severally liable to the insured up to their respective limits and share internally pro rata to their contractual liability (VÕS § 486 lg 1–3).[^1] Other-insurance clauses must be read against this mandatory rule (§ 486 lg 5). Losses caused by management's failure to implement controls may also lead to D&O claims against the directors (see the [D&O guide](https://insurancelawestonia.ee/guides/d-and-o-claims-estonia)). ## 6. Checklist for crime insurers 1. Within hours: recall request, police report, freezing of recipient accounts. 2. Classify the payment: authorised (fraud-induced) or unauthorised. 3. Obtain the bank's business terms and verification-of-payee records. 4. Test control-condition defences against VÕS § 452 lg 2 causation. 5. Preserve subrogation rights and coordinate the civil claim in criminal proceedings. 6. Check overlaps with cyber and D&O, and apply § 486 between insurers. ## Related pages - [Crime and fidelity claims and investigations (service)](https://insurancelawestonia.ee/services-for-insurers/crime-and-fidelity-investigations) - [Crime insurance in Estonia: real cover or an illusion?](https://insurancelawestonia.ee/blog/2026-08-18-crime-insurance-cover-or-illusion) - [Exclusions vs obligations in Estonian insurance law](https://insurancelawestonia.ee/estonian-insurance-contract-law/exclusions-vs-obligations) - [Cyber claims in Estonia](https://insurancelawestonia.ee/guides/cyber-claims-estonia) - [Subrogation and recovery in Estonia](https://insurancelawestonia.ee/guides/subrogation-recovery-estonia) - [Large risks under Estonian insurance law](https://insurancelawestonia.ee/estonian-insurance-contract-law/large-risks) ## References [^1]: Law of Obligations Act (võlaõigusseadus, VÕS) §§ 39, 115, 137, 427, 448, 449, 452, 465, 476, 477, 486, 492, 733¹, 733², 733⁸, 733⁹, 733¹⁴, 1043. RT I, 20.06.2026, 18 (in force 01.09.2026). Estonian: ; English: . [^2]: Regulation (EU) 2024/886 amending Regulations (EU) No 260/2012 and (EU) 2021/1230 and Directives 98/26/EC and (EU) 2015/2366 as regards instant credit transfers in euro, art 1 (inserting art 5c into Regulation (EU) No 260/2012), art 5c(7)–(9). . [^3]: General Part of the Civil Code Act (tsiviilseadustiku üldosa seadus, TsÜS) §§ 84, 90, 146, 150. RT I, 31.12.2024, 48 (in force 01.01.2025). Estonian: ; English: . [^4]: Regulation (EC) No 593/2008 (Rome I), art 7. ; Law of Obligations Act (võlaõigusseadus, VÕS) § 427 lg 1, 3 and 4, RT I, 20.06.2026, 18 (in force 01.09.2026), ; Insurance Activities Act (kindlustustegevuse seadus, KindlTS) § 12 lg 1, RT I, 11.07.2026, 140 (in force 21.07.2026), . [^5]: WIDEN, Baltic and international collaboration. ; International Fraud Group, members. .