# 14. Crime, cyber risk and social engineering

URL: https://insurancelawestonia.ee/insurance-law-cpd/crime-cyber-and-social-engineering/
Author: Dr Olavi-Jüri Luik, Partner, Head of Insurance Law, attorney at law (Advokaadibüroo WIDEN OÜ)
Last updated: 2026-11-11

> CPD module 14: payment and invoice fraud, the boundary between crime and cyber cover, social engineering sub-limits and multiple policies.

Module 14 of 20 · Theme: Lines of insurance · Level: Advanced · Suggested study time: 90 minutes 

**In short.** This module distinguishes crime and cyber cover for payment and invoice fraud and deals with notification, sub-limits and payment verification conditions.

## Learning outcomes

After completing this module you will be able to:

- distinguish fraud mechanisms and the corresponding covers;
- prepare a notification plan where several policies apply;
- check a sub-limit and a payment verification condition.

## Key points

### The mechanism determines the cover

Use of a computer does not by itself decide whether an event falls under cyber or crime cover. What matters is who committed the act, how the loss arose and which insuring clause fits: computer fraud (unauthorised input into a system), funds transfer fraud (a fraudulent instruction to the bank) or social engineering (an authorised employee makes the payment after being deceived).

### Social engineering extension

If an authorised employee makes a payment on the basis of a forged instruction, classic computer fraud cover may not apply; a separate social engineering extension may be needed. It often has a sub-limit and a payment verification condition, such as confirming the instruction through a second channel.

### Several policies

Several insurers may need to be notified, but the same loss is not paid several times: in double insurance the insurers are jointly and severally liable, but the policyholder may not recover more in total than the loss (VÕS § 486(1)–(2)). An employee's intentional act is not in itself the policyholder's own intentional causing of the insured event (§ 452(1)).

### First steps

Preserve evidence, notify the bank immediately to stop or recall the payment, notify the insurers (VÕS § 448(1)) and, where appropriate, the police. The bank's liability under the payment services rules is a separate question.

## Read before the quiz

Articles on this site:

- [Crime and fidelity claims in Estonia: payment and employee fraud](https://insurancelawestonia.ee/guides/crime-fidelity-claims-estonia)
- [Cyber claims in Estonia: NIS2, GDPR, ransomware and insurance](https://insurancelawestonia.ee/guides/cyber-claims-estonia)
- [Cyber, crime and D&O insurance: interplay and boundaries](https://insurancelawestonia.ee/specialty-lines/handbook/cyber-crime-d-and-o-interaction)
- [The first 24 to 72 hours after a cyber incident or fraud](https://insurancelawestonia.ee/specialty-lines/handbook/first-24-72-hours)

Legal sources:

- [VÕS §§ 448, 452, 476–477, 486](https://www.riigiteataja.ee/akt/V%C3%95S)

## Practical case

*Write down your own answer before opening the suggested approach.*

A bookkeeper makes a payment of EUR 80,000 after a video call in which a deepfake of the chairman of the management board gives the instruction. The company has a crime policy with a EUR 25,000 social engineering sub-limit and a cyber policy. Set out the first steps and compare the covers.

Suggested approach

First steps: notify the bank immediately and try to stop the payment, preserve evidence (call recording, e-mails, payment data, logs), report to the police and notify both insurers. Comparison of covers: the crime policy's social engineering extension (sub-limit EUR 25,000, compliance with the verification condition); whether the cyber policy covers deepfake fraud or only a system breach; whether the covers overlap (VÕS § 486) and which is primary. The part exceeding the sub-limit is not automatically anyone else's liability.

## Self-check quiz

Answer the three questions and press "Check answers". An explanation is shown for each question.

The self-check quiz requires JavaScript in your browser.

[← Previous: 13. Directors' liability and D&O insurance](https://insurancelawestonia.ee/insurance-law-cpd/directors-liability-and-d-and-o) · [All modules](https://insurancelawestonia.ee/insurance-law-cpd) · [Next: 15. Life and health risks and insurance-based investments →](https://insurancelawestonia.ee/insurance-law-cpd/life-health-and-insurance-based-investments)