CEO fraud with a cloned voice: does cyber insurance pay?
unclear Depends on the policy wording
Whether a transfer after a call with a cloned voice is insured depends on the wording: Only AXA expressly mentions contact by phone (section A6), Zurich (art. 702.2) and Mobiliar (section B8.1) require an instruction sent in writing online, and Helvetia excludes calls unless the policy includes special condition 3.7.6.
As of
On this page
What the terms say
-
Call with a cloned voice:under the GTC, Helvetia does not reimburse payments triggered by phone calls, voice messages or videos (3.3.1.8, p. 12), unless the policy contains special condition 3.7.6 (included in the KMU-Spezial sample policy, with proof of basic security measures). Zurich (Art. 702.2) and Mobiliar (B8.1) require an order transmitted online in writing. Only AXA A6 expressly mentions contact by telephone.
Where does it say so?
Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8, S. 12
«die durch Telefonanrufe (inkl. IP-Telefonie), Sprachnachrichten oder Videos initiiert werden (z.B. durch Deepfake)»
Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026
Fraud with fake instructions by insurer
- add-on4
- limited1
- no information4
-
SME insurance, cyber insurance module (same content: «Cyberversicherung Unternehmen»)
add-on
Condition and source: AXA
Only if listed in the policy. New or changed payment details must be verified by call-back and documented in writing, otherwise no cover.
AXA Versicherungen AG, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. A6, S. 9 · Open document (new window)
-
Helvetia Cyber-Versicherung – KMU-Spezial (variants ECO, SMART, TOP)
limited Sublimit CHF 30'000
Condition and source: Helvetia
Included in KMU-Spezial (BEC, man-in-the-middle, manipulated invoice). The GTC exclude payments made after a phone call, voice message or video (deepfake) (3.3.1.8); the sample policy KMU-Spezial reinstates them via Special Condition 3.7.6, with proof of basic security measures; only covered if the policy names 3.7.6 (the sample document is marked «DRAFT»). Sub-limit 30'000/50'000/100'000; verify orders from CHF 30'000 securely; criminal complaint.
Helvetia Schweizerische Versicherungsgesellschaft AG, Ausgabe Juni 2026 (Dokument 01.07.2026, CH00TLV), Ziff. 3.3.1.8 lit. b, S. 12 · Open document (new window)
-
Zurich Cyberversicherung (variants Basic, Optimum, Premium)
add-on
Condition and source: Zurich
Module G «Cyber-Betrug», according to the brochure only Premium (the product page names Optimum). Verify and document new/changed bank details by call-back or digital signature.
Zürich Versicherungs-Gesellschaft AG, Ausgabe 01/2024 (ZH9513d-2402), Art. 702.2/704, S. 15 · Open document (new window)
-
Cyber insurance for companies (first-party loss, third-party loss, assistance, IT Assistance, legal protection)
add-on
Condition and source: Mobiliar
Add-on «Internet fraud and social engineering»: loss of own means of payment through fake online payment orders. Not for recognisably fake or non-personalised invoices.
Schweizerische Mobiliar Versicherungsgesellschaft AG, Ausgabe 01.2024, Ziff. B8.1, S. 16 · Open document (new window)
-
Business Cyber Insurance (option for KMU SecureConnect, Sunrise Ethernet and others)
no information
Condition and source: Sunrise (AXA)
No additional cover for social engineering found in the Sunrise collective contract.
AXA Versicherungen AG / Sunrise GmbH, Ausgabe 05.2026 (Datei «vsept26»), Inhaltsverzeichnis · Open document (new window)
-
Cyber Risk Versicherung
add-on
Condition and source: Allianz Suisse
According to the product page, only optional (CEO fraud, payment redirection).
Terms not public, quote via BTAG.
Allianz Suisse Versicherungs-Gesellschaft AG, abgerufen 06.11.2026 · Open document (new window)
-
Additional cover «Cyber and data protection» to the Business One contents and business liability insurance
no information
Condition and source: Vaudoise
Cyber GTC not public, no information found.
Terms not public, quote via BTAG.
Vaudoise Allgemeine Versicherungs-Gesellschaft AG, abgerufen 06.11.2026 · Open document (new window)
-
Cyber Enterprise Risk Management (Cyber ERM) V2.2
no information
Condition and source: Chubb
No cover for deception without a system breach found in wording V2.2.
Terms not public, quote via BTAG.
Chubb European Group SE, 01/2022 · Open document (new window)
-
CyberEdge
no information
Condition and source: AIG
GTC not public.
Terms not public, quote via BTAG.
AIG Europe S.A., Zweigniederlassung Opfikon, geändert 20.08.2026 · Open document (new window)
Other pitfalls
-
Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
Where does it say so?
Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1
«Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»
Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026
-
Call-back obligation:verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
Where does it say so?
Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15
«Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»
Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026
-
Gross negligence (Art. 14 ICA):AXA (A13) and Helvetia (4.6.4) waive the reduction, Mobiliar and Zurich do not. The waiver does not help if an obligation (backup, patch, call-back) has been breached.
Where does it say so?
Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. A13, S. 11
«Die AXA verzichtet auf das Recht der Leistungskürzung»
Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
The case from the canton of Schwyz
Canton of Schwyz, 01.2026. Whether the business was insured: unbekannt.
Within two weeks, unknown perpetrators called the owner of a company in Schwyz and posed as a well-known business partner using an AI-manipulated voice. On the pretext of a confidential international deal, the owner made several transfers totalling several million francs to an account in Asia.
Full account
The fraud was only noticed after the payments had been completed.
Lesson: A familiar voice on the phone is no longer proof; confirm confidential major deals via a second, known channel.
Source: Kantonspolizei Schwyz
Kanton Schwyz: Unbekannte erlangen mit CEO-Fraud-Masche Millionen-Betrag, 19.01.2026
«Dabei kam eine mithilfe künstlicher Intelligenz manipulierte Stimme zum Einsatz.»
Open document: Kanton Schwyz: Unbekannte erlangen mit CEO-Fraud-Masche Millionen-Betrag (opens in a new window), retrieved 06.11.2026
Source: Blick
Mit KI-Stimme Firma reingelegt, 2026-01
Open document: Mit KI-Stimme Firma reingelegt (opens in a new window), retrieved 06.11.2026
6 more cases
-
Switzerland · 01.2024
Company (anonymous)Fraudsters posed as the boss to a company in Central Valais and demanded a large payment.
Source
300'000 Franken plötzlich weg: Walliser Polizei warnt vor CEO-Trick, 24.01.2024
Open document: 300'000 Franken plötzlich weg: Walliser Polizei warnt vor CEO-Trick (opens in a new window), retrieved 06.11.2026
-
Switzerland · 09.2025
Private individuals (anonymous)Victims received an email about a supposed tax refund and entered personal details, bank details and credit card data on a deceptively real website.
Source
Wochenrückblick Woche 39: Wenn ein Phishing-Versuch auf den nächsten folgt, 30.09.2025
«Nur wenige Minuten nach der Eingabe der Kreditkartendaten erhielten die Opfer einen Anruf einer angeblichen Sicherheitsabteilung ihrer Bank.»
Open document: Wochenrückblick Woche 39: Wenn ein Phishing-Versuch auf den nächsten folgt (opens in a new window), retrieved 06.11.2026
-
Switzerland · 04.2024
Company (anonymous)A supposed lawyer called a company’s finance manager and invited him to a video conference with his boss.
Source
Wochenrückblick Woche 14: Online-Meeting mit Deep-Fake-Chef: CEO-Betrug 2.0, 09.04.2024
«Das Video des Chefs wurde in diesem Fall von den Betrügern mit Hilfe von Künstlicher Intelligenz (KI) erstellt.»
Open document: Wochenrückblick Woche 14: Online-Meeting mit Deep-Fake-Chef: CEO-Betrug 2.0 (opens in a new window), retrieved 06.11.2026
-
Hong Kong · 01.2024Abroad: Hong Kong
Arup (Hong Kong office)An employee in Hong Kong received an email from the supposed CFO in London about a confidential transaction.
Source
UK multinational Arup confirmed as victim of HK$200 million deepfake scam that used digital version of CFO to dupe staff, 2024-05
Open document: UK multinational Arup confirmed as victim of HK$200 million deepfake scam that used digital version of CFO to dupe staff (opens in a new window), retrieved 06.11.2026
-
United Kingdom · 03.2019Abroad: United Kingdom
British energy company (anonymous, subsidiary of a German group)The head of the British subsidiary believed he was on the phone with the head of the German parent company, who demanded an urgent payment to a Hungarian supplier.
Source
Scammers deepfake CEO's voice to talk underling into $243,000 transfer, 2019-09
Open document: Scammers deepfake CEO's voice to talk underling into $243,000 transfer (opens in a new window), retrieved 06.11.2026
-
Switzerland · 02.2026
Private individual (anonymous)Fraudsters called a victim as supposed NCSC employees and gained access to his mobile phone via remote access software.
Source
Wochenrückblick Woche 7: Wenn Betrüger bis an die Haustür kommen, 17.02.2026
«In der Folge erschienen die Betrüger respektive Komplizen der Betrüger persönlich am Wohnsitz der geschädigten Person und liessen sich Schmuck sowie Bargeld aushändigen.»
Open document: Wochenrückblick Woche 7: Wenn Betrüger bis an die Haustür kommen (opens in a new window), retrieved 06.11.2026
What helps
- Code word for payment orders from the management; never make exceptions because something is «confidential» or «urgent».
- Always call back on the stored number, never on the number in the call or the email.
- Payments from client accounts only with a second approval and a written client order.