Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

A customer paid into the wrong account: who bears the loss?

limited Usually only your own money is insured

If your customer pays into the wrong account because your email account was hacked, only Helvetia expressly covers this among the terms we read (section 3.3.1.8 let. b, with sublimit); Mobiliar and Zurich only replace your own money.

As of

AmukI looked for who replaces your customer’s money. Only one policy says so expressly.
On this page
  1. Terms
  2. Pay again?
  3. Real cases
  4. What helps

What the terms say

  1. Own money only:Mobiliar (B8) and Zurich (Art. 702) reimburse only the insured’s own means of payment. If a customer pays into a wrong account because of the hacked email account, among the GTC reviewed only Helvetia expressly covers this (3.3.1.8 let. b, sub-limit).

    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8 lit. b, S. 12

    «wenn diese finanzielle Transaktion aufgrund einer auf dem IT-System des Versicherungsnehmers vorgenommene Manipulation»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

  2. Call-back obligation:verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.

    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

“Fraud with fake instructions” by insurer

The status applies to the module; only Helvetia states expressly in its terms whether it also covers your customer’s payment.

9 answers: 4 add-on, 1 limited, 4 no information Mobiliar, Cyber insurance for companies (first-party loss, third-party loss, assistance, IT Assistance, legal protection): add-onZurich, Zurich Cyberversicherung (variants Basic, Optimum, Premium): add-onAXA, SME insurance, cyber insurance module (same content: «Cyberversicherung Unternehmen»): add-onAllianz Suisse, Cyber Risk Versicherung: add-onHelvetia, Helvetia Cyber-Versicherung – KMU-Spezial (variants ECO, SMART, TOP): limitedSunrise (AXA), Business Cyber Insurance (option for KMU SecureConnect, Sunrise Ethernet and others): no informationVaudoise, Additional cover «Cyber and data protection» to the Business One contents and business liability insurance: no informationChubb, Cyber Enterprise Risk Management (Cyber ERM) V2.2: no informationAIG, CyberEdge: no information
  • add-on4
  • limited1
  • no information4

  • Helvetia

    Helvetia Cyber-Versicherung – KMU-Spezial (variants ECO, SMART, TOP)

    limited Sublimit CHF 30'000

    Condition and source

    Included in KMU-Spezial (BEC, man-in-the-middle, manipulated invoice). The GTC exclude payments made after a phone call, voice message or video (deepfake) (3.3.1.8); the sample policy KMU-Spezial reinstates them via Special Condition 3.7.6, with proof of basic security measures; only covered if the policy names 3.7.6 (the sample document is marked «DRAFT»). Sub-limit 30'000/50'000/100'000; verify orders from CHF 30'000 securely; criminal complaint.

    Helvetia Schweizerische Versicherungsgesellschaft AG, Ausgabe Juni 2026 (Dokument 01.07.2026, CH00TLV), Ziff. 3.3.1.8 lit. b, S. 12 · Open document

  • Mobiliar

    Cyber insurance for companies (first-party loss, third-party loss, assistance, IT Assistance, legal protection)

    add-on

    Condition and source

    Add-on «Internet fraud and social engineering»: loss of own means of payment through fake online payment orders. Not for recognisably fake or non-personalised invoices.

    Schweizerische Mobiliar Versicherungsgesellschaft AG, Ausgabe 01.2024, Ziff. B8.1, S. 16 · Open document

  • Zurich

    Zurich Cyberversicherung (variants Basic, Optimum, Premium)

    add-on

    Condition and source

    Module G «Cyber-Betrug», according to the brochure only Premium (the product page names Optimum). Verify and document new/changed bank details by call-back or digital signature.

    Zürich Versicherungs-Gesellschaft AG, Ausgabe 01/2024 (ZH9513d-2402), Art. 702.2/704, S. 15 · Open document

  • AXA

    SME insurance, cyber insurance module (same content: «Cyberversicherung Unternehmen»)

    add-on

    Condition and source

    Only if listed in the policy. New or changed payment details must be verified by call-back and documented in writing, otherwise no cover.

    AXA Versicherungen AG, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. A6, S. 9 · Open document

  • Sunrise (AXA)

    Business Cyber Insurance (option for KMU SecureConnect, Sunrise Ethernet and others)

    no information

    Condition and source

    No additional cover for social engineering found in the Sunrise collective contract.

    AXA Versicherungen AG / Sunrise GmbH, Ausgabe 05.2026 (Datei «vsept26»), Inhaltsverzeichnis · Open document

  • Allianz Suisse

    Cyber Risk Versicherung

    add-on

    Condition and source

    According to the product page, only optional (CEO fraud, payment redirection).

    Terms not public, quote via BTAG.

    Allianz Suisse Versicherungs-Gesellschaft AG, abgerufen 06.11.2026 · Open document

  • Vaudoise

    Additional cover «Cyber and data protection» to the Business One contents and business liability insurance

    no information

    Condition and source

    Cyber GTC not public, no information found.

    Terms not public, quote via BTAG.

    Vaudoise Allgemeine Versicherungs-Gesellschaft AG, abgerufen 06.11.2026 · Open document

  • Chubb

    Cyber Enterprise Risk Management (Cyber ERM) V2.2

    no information

    Condition and source

    No cover for deception without a system breach found in wording V2.2.

    Terms not public, quote via BTAG.

    Chubb European Group SE, 01/2022 · Open document

  • AIG

    CyberEdge

    no information

    Condition and source

    GTC not public.

    Terms not public, quote via BTAG.

    AIG Europe S.A., Zweigniederlassung Opfikon, geändert 20.08.2026 · Open document

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

Does the customer have to pay again?

  1. No Swiss case law found:whether the customer has to pay again is an open question; German courts have ruled differently depending on the security of the email transmission and the customer’s diligence.

  2. Legal position:in Germany, the buyer had to pay again because no security deficiency could be proven against the car dealership (OLG Oldenburg); no judgment found for Switzerland.

Court rulings from Germany (abroad, as an example)

  • GermanyAbroad: Germany

    Trade business (anonymous)

    A trade business sent interim and final invoices as PDFs by email; on the final invoice for 15'000 euros, unknown persons changed the account details, and the customer paid third parties. On 18.12.2024, the OLG Schleswig ruled (12 U 9/24) that the customer does not have to pay again: she is entitled to damages under Art. 82 GDPR because the business had sent the invoice without end-to-end encryption. The business is thus left without its payment for the work. Lesson: According to this judgment, anyone who sends invoices with bank details by email can be liable for manipulations; encrypted sending or portals reduce the risk.

    Source

    Unternehmer bleibt auf Schaden sitzen (OLG Schleswig, Urteil vom 18.12.2024 – 12 U 9/24), 2025-02-07, OLG Schleswig, 12 U 9/24

    «Gerade bei sensiblen oder persönlichen Inhalten komme nur eine Ende-zu-Ende-Verschlüsselung in Betracht»

    Open document: Unternehmer bleibt auf Schaden sitzen (OLG Schleswig, Urteil vom 18.12.2024 – 12 U 9/24) (opens in a new window), retrieved 06.11.2026

  • Germany · 07.2022Abroad: Germany

    Fence builder (anonymous)

    Two days after the invoice for 11'000 euros for a garden fence, the customer received new bank details from the tradesperson’s supposed email account and transferred the amount in two instalments to a fraudster. The LG Koblenz (judgment of 26.3.2025, 8 O 271/22) found a data protection breach by the tradesperson, but considerable contributory negligence on the part of the customer, who had not checked back. The tradesperson receives 75% of the payment for the work (8'250 euros), and the customer may offset 2'750 euros. Lesson: When account details are changed, the business and the customer share the loss depending on their diligence; a short call-back would have prevented it entirely.

    Source

    Mailkonto gehackt: Handwerker bekommt Geld nur teilweise (LG Koblenz, 8 O 271/22), 2025-07, LG Koblenz, Urteil vom 26. März 2025, 8 O 271/22

    «Das Risiko der Fehlüberweisung lag somit beim Kunden.»

    Open document: Mailkonto gehackt: Handwerker bekommt Geld nur teilweise (LG Koblenz, 8 O 271/22) (opens in a new window), retrieved 06.11.2026

  • GermanyAbroad: Germany

    Private buyer of a used car (anonymous)

    A buyer’s daughter asked a car dealership by email for its bank details; unknown persons intercepted the exchange and sent a PDF with a changed IBAN. The buyer transferred just under 17'000 euros to the fraudsters. The Regional Court and the OLG Oldenburg ruled with final effect that he has to pay the purchase price again because no security deficiency could be proven against the car dealership. Lesson: Confirm bank details for large payments by telephone with the seller; otherwise, whoever asks by email bears the risk.

    Source

    Fake-Rechnungen: Käufer muss doppelt zahlen, 2026-08-28

    «Der Zahlungsanspruch des Autohauses aus dem Kaufvertrag sei durch die Zahlung an die Unbekannten nicht erfüllt worden.»

    Open document: Fake-Rechnungen: Käufer muss doppelt zahlen (opens in a new window), retrieved 06.11.2026

Real cases

1 more cases

What helps

  • Two-factor login for the email account; check forwarding rules monthly.
  • On every invoice: «Our bank details never change by email», and the IBAN also in the quote and order confirmation.
  • Send invoices via a portal or signed; for large amounts, actively check that payment has been received.

Industries affected

Three ways forward