Crime and fidelity claims and investigations in Estonia

Payment diversion fraud, CEO fraud, fake supplier invoices, account takeover and employee theft are among the most frequent financial lines losses in the Baltic region. A crime or fidelity insurer facing an Estonian loss needs three things quickly: a coverage view, an investigation that preserves evidence and recovery options, and an understanding of whether the loss can be shifted to a bank or payment service provider. I advise crime insurers, their insureds (where there is no conflict) and brokers on all three. The legal background is set out in the crime and fidelity claims guide.

1. First steps after a payment fraud

Speed is decisive. In the first 24–48 hours:

1. Recall and freeze. Instruct the insured's bank to request a recall of the payment and contact the recipient's bank. Many recipient accounts are emptied within hours.
2. Criminal complaint. File a complaint with the police (fraud under § 209 or computer-related fraud under § 213 of the Penal Code (karistusseadustik, KarS)) and request seizure of funds.¹
3. Preserve evidence. E-mail headers, mailbox audit logs, payment approvals, call recordings, invoices, internal communications.
4. Notify the insurer and agree the investigation scope; under Estonian law, late notice reduces the indemnity only by the insurer's prejudice unless the breach was intentional (Law of Obligations Act (võlaõigusseadus, VÕS) § 449).²
5. Assess the bank's position under the payment services rules.

2. Shifting the loss: banks and payment service providers

Estonian payment services law, contained in VÕS §§ 733¹–733¹⁴, distinguishes between unauthorised payments (where the payer's bank generally must refund, subject to the payer's liability for gross negligence or intent) and authorised payments induced by fraud (where the payer bears the loss in principle). For non-consumers, many of these rules can be contracted out of (VÕS § 733¹⁴ lg 6). Since 9 October 2025, payment service providers in the euro area must offer a verification of payee service, and a provider that fails to do so properly may be liable (Regulation (EU) No 260/2012, art 5c, inserted by Regulation (EU) 2024/886).²³

For the crime insurer, these rules matter twice: as a recovery route after payment and as a factor in assessing the insured's loss and its mitigation duties.

3. Coverage analysis under Estonian law

Typical coverage issues in Estonian crime claims:

See also exclusions vs obligations and safety obligations and proportionality.

4. Employee theft and internal investigations

Where an employee is suspected of theft, embezzlement (KarS § 201) or collusion with external fraudsters, an internal investigation must balance speed, employment law and data protection:

• interviews conducted fairly and documented;
• review of e-mail and device data in line with the employer's policies and the GDPR;
• coordination with the police to avoid prejudicing a criminal investigation;
• securing the employer's civil claims against the employee and any accomplices (in tort under VÕS § 1043 and under the employment contract).

Under Estonian law, an insurer that pays the employer acquires the employer's claim against the employee by subrogation (VÕS § 492), but the employee's liability towards the employer may be limited by the Employment Contracts Act (töölepingu seadus, TLS): an employee who breaches the employment contract negligently is liable only to an extent assessed by reference to factors such as duties, degree of fault and pay, whereas an employee who breaches it intentionally is liable for the entire loss (TLS § 74(1)–(2)). The investigation report should be prepared so that it can be used in court and, where needed, shared with the insurer.

5. Tracing and recovery

• Freezing orders in civil proceedings to secure claims against recipients.
• Unjust enrichment claims against account holders who received the funds.
• Cross-border cooperation: WIDEN's Estonian office is a member of the International Fraud Group (IFG), a global network of lawyers specialising in tracing, freezing and recovering stolen assets. Through it, fraud and asset-recovery lawyers in other jurisdictions can be engaged quickly.⁴
• Bank liability claims under the payment services rules and general contract law.

6. Reporting to the insurer

Reports address: facts and timeline; coverage issues with a confidence level; recovery prospects; reserve recommendation; next steps and budget. Documents in Estonian are summarised in English.

Related pages

• Crime and fidelity claims in Estonia
• Breach coach for cyber incidents
• D&O claims
• Enforcement of judgments and recovery
• Coverage opinions

References