Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Fiduciary services: what can happen, and who pays?

limited 8 of 16 cost items usually covered

6 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Fake president with a cloned voice” (likelihood medium).

As of

Fiduciary services1. Fake president with a cloned voice13. IT outage during the tax deadline3032. Client data stolen, publication threatened26. The provider’s cloud accounting unavailable64. Client pays fee to fraudsters45. Trojan diverts client funds5

Fake president with a cloned voice

IT outage during the tax deadline

Client data stolen, publication threatened

The provider’s cloud accounting unavailable

Client pays fee to fraudsters

Trojan diverts client funds

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

6 scenarios, 6 receipts

  1. Fake president with a cloned voice
  2. Client data stolen, publication threatened
  3. IT outage during the tax deadline
  4. Client pays fee to fraudsters
  5. Trojan diverts client funds
  6. The provider’s cloud accounting unavailable

1Fake president with a cloned voice

Receipt

Fiduciary services

Tap a line for the reasoning

  • Amount transferred from the client account CHF 50'000–300'000 not covered

    The trigger is a phone call: Helvetia excludes payments after a phone call/deepfake, Zurich and Mobiliar require an order transmitted online in writing. Only the AXA add-on A6 expressly mentions telephone (with a call-back obligation). If there is also an email, the add-on at Zurich/Mobiliar may apply. How we got there: Documented comparable cases: around CHF 300'000 (Valais 2024), several million (Schwyz 2026, AI voice), around CHF 50'000 (Helvetia example, unverified).

  • Liability towards the client (entrusted funds) CHF 50'000–300'000 unclear

    Zurich covers entrusted funds only via the cyber fraud module and in the case of legal liability; check the fiduciary’s professional liability insurance (not evaluated). How we got there: Same amount; the client demands compensation.

  • Clarify whether email accounts are compromised CHF 750–4'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 3–10 h × CHF 250–400/h (market range for incident response)

  • Lawyer: bank recall, criminal complaint, client communication CHF 1'200–7'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 5–20 h × CHF 250–350/h (lawyer’s rate in Switzerland)

Usually stays with the businessCHF 50'000–300'000

Usually paid by the cyber policy
CHF 1'950–11'000
Open or only with an add-on
CHF 50'000–300'000

Likelihood medium

An employee receives a call: it is the voice of the managing director, calling from his holiday. A confidential company acquisition by an important client has to be completed today, and a lawyer will be in touch shortly.

How it unfolds

The employee makes two payments totalling CHF 250'000 from the managed client account. The next day the real boss calls; the money has been passed on.

Entry point: Phone call with an AI-cloned voice, supplemented by an email from a fake lawyer

What AI changes: A voice can be cloned with just a few seconds of audio from videos, voice messages or voicemail. In the canton of Schwyz in 2026, an owner made transfers of several million francs after calls with an AI voice.

Why medium? NCSC: 970 reports of CEO fraud in 2025, 258 in the first half of 2026; Schwyz 2026 with an AI voice and a loss of millions, Valais 2024 around CHF 300'000.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

Where does it say so?

Halbjahresbericht 2026/I (Januar–Juni), 24.08.2026

Open document: Halbjahresbericht 2026/I (Januar–Juni) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Code word for payment orders from the management; never make exceptions because something is «confidential» or «urgent».
  • Always call back on the stored number, never on the number in the call or the email.
  • Payments from client accounts only with a second approval and a written client order.
Pitfalls in the terms
  • Call with a cloned voice: under the GTC, Helvetia does not reimburse payments triggered by phone calls, voice messages or videos (3.3.1.8, p. 12), unless the policy contains special condition 3.7.6 (included in the KMU-Spezial sample policy, with proof of basic security measures). Zurich (Art. 702.2) and Mobiliar (B8.1) require an order transmitted online in writing. Only AXA A6 expressly mentions contact by telephone.
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8, S. 12

    «die durch Telefonanrufe (inkl. IP-Telefonie), Sprachnachrichten oder Videos initiiert werden (z.B. durch Deepfake)»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Call-back obligation: verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

  • Gross negligence (Art. 14 ICA): AXA (A13) and Helvetia (4.6.4) waive the reduction, Mobiliar and Zurich do not. The waiver does not help if an obligation (backup, patch, call-back) has been breached.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. A13, S. 11

    «Die AXA verzichtet auf das Recht der Leistungskürzung»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions, Third-party claims after a data breach, Immediate help in an emergency

2Client data stolen, publication threatened

Receipt

Fiduciary services

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 5'000–24'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 20–60 h × CHF 250–400/h (market range for incident response)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 2'500–10'500 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–30 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of clients by letter (postage only) CHF 200–2'400 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 200–2'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

  • Ransom demand CHF 180'000–200'000 limited

    Ransom: Mobiliar and Sunrise never, AXA only with extension, Zurich within sub-limit 25%, Helvetia CHF 30'000–100'000, Chubb in principle yes; reporting to the police is mandatory. How we got there: Documented: CHF 180'000–200'000 demanded (GRF 2021).

  • Claims by clients no reliable figure covered

    Third-party claims and defence against unfounded claims in the basic cover; Sunrise/AXA collective up to CHF 200'000. How we got there: No amounts found.

Usually paid by the cyber policy
CHF 7'700–36'900, plus 1 item without an amount
Open or only with an add-on
CHF 180'000–200'000
Usually stays with the business
nothing

Likelihood medium

Hackers break into the network of a fiduciary office that works for several municipalities and demand CHF 180'000 to 200'000. They threaten to publish financial and budget data on the darknet and set a 48-hour ultimatum.

How it unfolds

Entry point: Intrusion into the network (route not stated)

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Real case in French-speaking Switzerland in 2021; fiduciaries hold a lot of sensitive data.

What prevents it

  • Client data encrypted, access logged.
  • Monitor outflows of large volumes of data.
  • Crisis plan with communication to clients.
Pitfalls in the terms
  • Ransom: Mobiliar and Sunrise never pay, AXA only with the «Cybererpressung» extension, Zurich within the sub-limit of 25% of the first-party sum insured, Helvetia CHF 30'000–100'000; reporting to the police is mandatory.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 10.1, S. 7

    «Bei sämtlichen Ransomware-Attacken muss eine Strafanzeige bei der Polizei eingereicht werden.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

  • Reporting obligation: a data security breach likely to result in a high risk must be reported to the FDPIC as soon as possible (Art. 24 FADP). Agree notification and PR with the insurer in advance (AXA, Helvetia), otherwise there will be disputes about the costs.
    Where does it say so?

    Bundesgesetz über den Datenschutz (DSG), SR 235.1, geltende Fassung, Art. 24 DSG (Paraphrase)

    Open document: Bundesgesetz über den Datenschutz (DSG), SR 235.1 (opens in a new window), retrieved 06.11.2026

  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Criminal complaint: for ransomware (Zurich Art. 10.1), extortion (Mobiliar, Helvetia) and cyber fraud (Helvetia 3.3.1.8), reporting to the police is a precondition for the benefit.
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8

    «sofern eine Strafanzeige erstattet wird»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Inform affected people, Cyber extortion, Third-party claims after a data breach

3IT outage during the tax deadline

Receipt

Fiduciary services

Tap a line for the reasoning

  • Loss of revenue CHF 15'400–30'900 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 5–10 days × around CHF 6'180 revenue/day × 50% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • Clients’ reminder fees and default interest CHF 1'000–20'000 unclear

    Cyber liability covers claims arising from data protection and network security breaches; claims for missed deadlines belong rather to professional liability. In BI, Helvetia excludes contractual claims due to delay. How we got there: Assumption; not documented.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 16'400–50'900
Usually stays with the business
nothing

Likelihood medium

Ransomware paralyses the office for ten days at the end of March. Several deadlines (tax returns, VAT returns) are missed; clients incur reminder fees and default interest and demand compensation.

How it unfolds

Entry point: Ransomware

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Ransomware outages of 5–10 days are typical (Helvetia case 5 days, Vétroz more than 10 days).

What prevents it

  • Keep the deadline list outside the main systems.
  • Prepare an emergency workstation in the cloud.
  • Have professional liability and cyber insurance checked side by side.
Pitfalls in the terms

Modules: Loss of income after an attack, Third-party claims after a data breach

4Client pays fee to fraudsters

Receipt

Fiduciary services

Tap a line for the reasoning

  • Outstanding fee CHF 2'000–20'000 not covered

    The client’s money: only Helvetia 3.3.1.8 let. b. How we got there: Assumption.

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 750–4'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 3–10 h × CHF 250–400/h (market range for incident response)

Usually stays with the businessCHF 2'000–20'000

Usually paid by the cyber policy
CHF 750–4'000
Open or only with an add-on
nothing

Likelihood medium

From the fiduciary’s hacked mailbox, a client receives an invoice with a new IBAN and pays CHF 9'000 to the perpetrators.

How it unfolds

Entry point: Hacked email account

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? Invoice manipulation documented several times.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

What prevents it

  • Two-factor login.
  • IBAN notice on every invoice.
  • Invoices via the client portal.
Pitfalls in the terms
  • Own money only: Mobiliar (B8) and Zurich (Art. 702) reimburse only the insured’s own means of payment. If a customer pays into a wrong account because of the hacked email account, among the GTC reviewed only Helvetia expressly covers this (3.3.1.8 let. b, sub-limit).
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8 lit. b, S. 12

    «wenn diese finanzielle Transaktion aufgrund einer auf dem IT-System des Versicherungsnehmers vorgenommene Manipulation»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions, Immediate help in an emergency

5Trojan diverts client funds

Receipt

Fiduciary services

Tap a line for the reasoning

  • Clean-up of the systems and forensics CHF 12'000 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: Zurich sample case: CHF 12'000 (IT service provider and forensic specialists).

  • Diverted client funds CHF 130'000 add-on

    At Zurich only in the variant with Cyber-Crime (module F); AXA with a 2FA requirement. How we got there: Zurich sample case: CHF 130'000 from an account managed by the insured.

Usually paid by the cyber policy
CHF 12'000
Open or only with an add-on
CHF 130'000
Usually stays with the business
nothing

Likelihood low

An employee opens a supposed unsolicited job application. When logging in to e-banking, the malware takes over the session and diverts CHF 130'000 from client accounts.

How it unfolds

The IT service provider cleans up the systems in three days, and forensic specialists check whether data has been exfiltrated.

Entry point: Email with an application file

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why low? Zurich sample case; today banks offer better protection with approval via app, but session takeovers do occur.

Where does it say so?

Broschüre Zurich Cyberversicherung, PDF vom 21.03.2023

Open document: Broschüre Zurich Cyberversicherung (opens in a new window), retrieved 06.11.2026

What prevents it

  • E-banking only on a dedicated device.
  • Applications via a portal.
  • Payment approval with the amount displayed in the second factor.
Pitfalls in the terms

Modules: Restore data and systems, Hacked e-banking

6The provider’s cloud accounting unavailable

Receipt

Fiduciary services

Tap a line for the reasoning

  • Outage CHF 1'900–3'700 limited

    Only if the service provider’s system was attacked, and usually with a written contract (Mobiliar, Zurich); purely technical outages and network outages are not covered. How we got there: 1–2 days × around CHF 6'180 revenue/day × 30% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 1'900–3'700
Usually stays with the business
nothing

Likelihood low

The provider of the cloud accounting is unavailable for two days after an attack; payroll runs are delayed.

How it unfolds

Entry point: Attack on the software provider

What AI changes: No direct AI connection.

Why low? No public Swiss case at large accounting platforms.

What prevents it

  • Plan the payroll run early.
  • Weekly data export.
  • Check the contract with the provider.
Pitfalls in the terms

Modules: Outage at the IT provider

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 6'180 Average revenue per day; your business may be smaller.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: good.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

What is connected in the business

  • Accounting and payroll software, often in the cloud (client data) Common in the sector.
  • E-banking with powers of attorney for client accounts Zurich sample case: a fiduciary firm executes payments for clients.
    Source

    Broschüre Zurich Cyberversicherung, PDF vom 21.03.2023

    Open document: Broschüre Zurich Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Deadline management (taxes, VAT, annual accounts)
  • Telephone and video conferencing with clients
  • Data exchange with tax authorities and client portals

Real cases

  • Switzerland · 01.2026

    Company (anonymous)

    Within two weeks, unknown perpetrators called the owner of a company in Schwyz and posed as a well-known business partner using an AI-manipulated voice.

  • Switzerland · 01.2024

    Company (anonymous)

    Fraudsters posed as the boss to a company in Central Valais and demanded a large payment.

  • Switzerland · 04.2024

    Company (anonymous)

    Swiss attempt with an AI video of the boss.

7 more cases and sample cases

  • Switzerland · 10.2021

    GRF Sociétés fiduciaire

    On 10 October 2021, hackers tried to break into the IT of the fiduciary office, which works for around a dozen municipalities in the region.

  • Switzerland · 04.2026

    Municipality of Vétroz

    In April 2026, an attack, presumably by the Akira group, hit an IT service provider of the municipality in Valais.

  • Switzerland · 01.2023

    Company (anonymous)

    Attackers searched a hacked email account for invoices that had been sent and sent a copy to the customer again.

  • Switzerland · 05.2023

    Unico Data AG

    In May 2023, the group «Play» attacked the provider of IT solutions for SMEs; most services were then offline.

  • Hong Kong · 01.2024Abroad: Hong Kong

    Arup (Hong Kong office)

    An employee in Hong Kong received an email from the supposed CFO in London about a confidential transaction.

  • United Kingdom · 03.2019Abroad: United Kingdom

    British energy company (anonymous, subsidiary of a German group)

    The head of the British subsidiary believed he was on the phone with the head of the German parent company, who demanded an urgent payment to a Hungarian supplier.

  • Sample case from an insurer: Zurich

    Fiduciary firm (CHF 6.5 million revenue, 22 employees) executes payments for clients. An employee opens a supposed unsolicited job application containing malware; the hacker takes over the e-banking session at login and diverts money from client accounts. Total according to the insurer: CHF 142'000.

    Sample case («Treuhand-Muster AG»). Cyber-Crime (e-banking hacking) only in the Premium package; forensics found no data outflow.

    Where does it say so?

    Broschüre Zurich Cyberversicherung, PDF vom 21.03.2023, Schadenbeispiel Treuhänder (1/2 und 2/2)

    «Den Kunden vom Treuhandbüro wurden insgesamt 130’000 Schweizer Franken gestohlen, aus einem vom Versicherten verwalteten Konto.»

    Open document: Broschüre Zurich Cyberversicherung (opens in a new window), retrieved 06.11.2026

Three ways forward