Credit card fraud, phishing, Twint: who pays in Switzerland?
limited Bank or card first, then the policy
The bank or card issuer pays first, but as a rule only for payments you did not authorise yourself; cyber insurance mostly pays only after that, once the bank has refused in writing. If you confirmed the payment yourself, for example after a phishing call, you will as a rule bear the loss yourself.
As of
On this page
Who pays, in what order?
If you did not authorise the payment
-
First
Card issuer or bank under its T&C
unauthorised charge, duties of care complied with, reported in time
-
Then
Cyber or household contents add-on insurance, on a secondary basis
usually only after the bank’s written refusal
-
Then
Legal protection insurance
only lawyer and proceedings, e.g. against the perpetrator or in a dispute with the bank
Nobody pays
those affected bear the loss themselves
There is an unknown charge on my credit card, and I still have the card. Is this covered?
If you authorised the payment yourself
-
First
Call the bank immediately
stop the payment or try to recall it (no obligation to reimburse)
-
Then
Bank or card issuer
as a rule no reimbursement, because the payment is deemed approved; a goodwill gesture or the Swiss Banking Ombudsman possible
-
Then
Insurance
only a few products pay for approvals obtained by deception (e.g. Cornèrcard up to CHF 1'000 for phishing/smishing); many exclude voluntary payments
Nobody pays
in most cases those affected bear the loss themselves
A fake bank employee called me and I confirmed the payment myself.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What to do now
Reporting deadlines for unauthorised charges: most issuers examined require a written dispute within 30 days (Swisscard, Viseca, Cornèr, Cembra, UBS, Migros Bank, Raiffeisen credit card, ZKB Debit, PostFinance credit card); the Raiffeisen debit card allows 45 calendar days. With the ZKB debit card, any claim lapses once the deadline has expired.
Where does it say so?
Bedingungen für die Benützung der Raiffeisen Debitkarten, Version 1.2 – Januar 2026, Ziff. 12
«spätestens aber 45 Kalendertage nach Erhalt des monatlichen Kontoauszugs»
Open document: Bedingungen für die Benützung der Raiffeisen Debitkarten (opens in a new window), retrieved 06.11.2026
Ask for the bank’s refusal in writing and then report the case to the insurer straight away; the policy sets out its own reporting and cooperation duties.
Some legal protection policies have a waiting period after you take them out; it is shown in the answer by provider on the question pages.
The bank and the insurer point to each other, so the bank’s written refusal is the most important document.
Why, with sources
- Cyber and card insurance policies are typically secondary (subsidiary) to the bank: all four issuer policies examined (Cornèr, Swisscard, Viseca, Cembra) only pay if the bank provides no reimbursement at all or has refused in writing to cover the loss, and often only the part that the customer has to bear themselves.
Where does it say so?
Cyber-Versicherung für die Visa, Mastercard und Diners Club Karten der Cornèr Bank AG – Versicherungsbedingungen – Allianz, Ausgabe 06.2026, II C Banking-Schutz, Ziff. 1 (ebenso Swisscard Cyber Security C 3.4, Viseca Online-Kontoschutz Ziff. 5, Cembra CyberProtect Ziff. 1.3)
«die nicht durch die Erstattung ihrer Verluste durch das Finanzinstitut/den Bankkartenherausgeber auf subsidiärer Basis gedeckt sind.»
Open document: Cyber-Versicherung für die Visa, Mastercard und Diners Club Karten der Cornèr Bank AG – Versicherungsbedingungen – Allianz (opens in a new window), retrieved 06.11.2026
- At the same time, the card conditions of all issuers examined exclude losses «for which an insurer has to pay» (e.g. Swisscard section 11.4 b, Cornèr section 7 b, Viseca section 1.6.2, PostFinance section 11, UBS Debit section 8, Cembra section 4.1, Migros Bank section 4.1, Raiffeisen section 10, ZKB section 12). The bank and the insurer therefore refer to each other; how such cases are resolved in practice is not documented.
Where does it say so?
Allgemeine Geschäftsbedingungen für Kreditkarten der Swisscard AECS GmbH im Bereich Privatkunden, 01/2021, Ziff. 11.4 Bst. b
«Schäden, für die eine Versicherung aufzukommen hat, sowie indirekte Schäden oder Folgeschäden irgendwelcher Art (z. B. entgangener Gewinn).»
Open document: Allgemeine Geschäftsbedingungen für Kreditkarten der Swisscard AECS GmbH im Bereich Privatkunden (opens in a new window), retrieved 06.11.2026
What banks and card issuers refund
35 rules from the card and account terms of 10 providers, by case.
-
Card stolen or lost Swisscard, Viseca, Cornèrcard, PostFinance, UBS, Cembra, Migros Bank, Raiffeisen, ZKB 10 rules
-
Swisscard: Swisscard only covers charges from misuse by third parties if the customer has breached neither the T&C nor the duties of care and is not at fault. Excluded as soon as the transaction was made with PIN, mTAN or 3-D Secure (section 11.4 a), and in the event of misuse by persons close to the cardholder. Conditions: keep the PIN separately and do not write it down, block the card immediately, police report if misuse is suspected, written loss report within 30 days of the invoice date, form within 10 days. Claims must be assigned to Swisscard.
Deadline: 30 days
Swisscard AECS GmbH: Allgemeine Geschäftsbedingungen für Kreditkarten der Swisscard AECS GmbH im Bereich Privatkunden, 01/2021, Ziff. 11.3 (Fristen: Ziff. 10.1 Bst. d und f) · Open document (opens in a new window)
«Vorbehältlich Ziff. 11.4 übernimmt Swisscard Belastungen aus missbräuchlicher Verwendung der Karte durch Dritte, sofern dieser Kartenmissbrauch nicht durch eine Verletzung dieser AGB»
-
Viseca: Viseca covers losses from proven misuse by third parties not close to the cardholder in full. Not covered are losses where duties of care and notification were breached (the customer then bears the loss without limit until the card is blocked), transactions with PIN, 3-D Secure, SMS code or biometrics, and insured losses. Conditions: keep the card separate from the PIN, never write down the PIN, block immediately (24h service or app), police report with copy, dispute no later than 30 days after the statement date, form within 10 days.
Deadline: 30 days · Deductible: none
Viseca Card Services SA: Allgemeine Geschäftsbedingungen für Zahlkarten der Viseca Card Services SA (Private), Version Januar 2026, Ziff. 1.6.2 (Pflichten Ziff. 1.7.1 und 1.7.2) · Open document (opens in a new window)
«Wir übernehmen Schäden in voller Höhe, die Ihnen aus nachweislich missbräuchlicher Verwendung der Karte bzw. Authentifizierung durch nicht nahestehende Dritte entstehen.»
-
Cornèrcard: The bank only covers losses from misuse by third parties (including counterfeiting) if the holder proves that they complied with the T&C in all respects, in particular the duties of care, and is not at fault. Excluded: transactions with PIN, mTAN or 3-D Secure, misuse by persons close to the holder, insured losses. Conditions: never write down PIN and card data or disclose them to anyone, do not keep the PIN with the card, report loss immediately, police report, dispute immediately and in writing within 30 days of the monthly statement, loss form within 10 days.
Deadline: 30 days
Cornèr Bank AG: Allgemeine Geschäftsbedingungen für die Classic, Gold und Platinum Karten Visa, Mastercard und Diners Club der Cornèr Bank AG, Ausgabe 01.2025, Ziff. 7 (Pflichten Ziff. 6 c–e) · Open document (opens in a new window)
«übernimmt die Bank Schäden, die dem Haupt- oder Begleitkarteninhaber aus missbräuchlicher Verwendung der Karte durch Dritte entstehen.»
-
PostFinance: PostFinance Card (debit): PostFinance covers losses from misuse by third parties if the customer proves that the T&C and conditions of participation were complied with and she is not at fault. Persons close to the customer are not considered third parties; insured losses and consequential losses are excluded. Conditions: block the card immediately, police report in the case of criminal offences, use 3-D Secure where offered; loss form within 10 days. There is no dispute deadline in days for the debit card; the T&C require a dispute «immediately».
PostFinance AG: Teilnahmebedingungen physische und digitale Karten von PostFinance, Version August 2024, Ziff. 11 Haftung (Sorgfalt Ziff. 4 j) · Open document (opens in a new window)
«PostFinance übernimmt Schäden, die der Kund:in aus missbräuchlicher Verwendung der Karte durch Dritte entstehen, sofern sie nachweisen kann, dass sie»
-
UBS: Debit card: UBS covers losses from misuse by third parties (including counterfeiting) if the cardholder proves that they complied with the conditions in all respects and are not at fault. Persons close to the cardholder are not considered third parties; insured losses are excluded. Conditions: do not keep the PIN with the card and do not store it, report immediately, police report, dispute within 30 days of receipt of the account statement, form within 10 days.
Deadline: 30 days
UBS Switzerland AG: Vertragliche Grundlagen für private Kunden – Bedingungen für die Nutzung der UBS Debitkarten, Debitkarten-Bedingungen Ausgabe September 2024 (Sammeldokument gedruckt September 2026), Debitkarten Ziff. 8 (Pflichten Ziff. 7), PDF-S. 19 · Open document (opens in a new window)
«übernimmt UBS Schäden, die dem Kontoinhaber aus missbräuchlicher Verwendung der UBS Debitkarte durch Dritte entstanden sind.»
-
Cembra: Cembra covers losses from misuse by third parties or through counterfeiting if the holder complied with the duties of care under section 3 and is not at fault. Anyone who breaches their obligations is liable without limit until the card is blocked. Conditions: keep the PIN secret and do not record it, not even in encrypted form, report loss immediately, criminal complaint with copy, written dispute no later than 30 days from the monthly invoice, form within 10 days.
Deadline: 30 days
Cembra Money Bank AG: Allgemeine Geschäftsbedingungen für die Kreditkarten von Cembra, V1/03.2025, Ziff. 4.1 (Pflichten Ziff. 3.3, 3.4, 3.7; Ziff. 4.2) · Open document (opens in a new window)
«Wenn der Inhaber die Sorgfaltspflichten gemäss Ziffer 3 eingehalten hat und ihn auch sonst kein Verschulden trifft, übernimmt die Herausgeberin Schäden»
-
Migros Bank: Migros Bank covers losses from misuse by third parties (including counterfeiting) without deductible if the terms of use were complied with in all respects and there is no fault. Persons close to the holder are not considered third parties; in the event of a breach of duty, the holder is liable without limit until the card is blocked. Conditions: report without delay, written dispute no later than 30 days from the monthly invoice, form within 10 days, criminal complaint with copy.
Deadline: 30 days · Deductible: none
Migros Bank AG: Bedingungen für die Nutzung von Kreditkarten für Privatpersonen der Migros Bank AG, Version 01/2026, Ziff. 4.1 und 4.2 (Frist Ziff. 3.5) · Open document (opens in a new window)
«übernimmt die Migros Bank AG Schäden, die der hauptkarteninhabenden Person aus missbräuchlicher Verwendung der Karte durch Dritte entstehen (ohne Selbstbehalt für die hauptkarteninhabende Person).»
-
Raiffeisen: Credit card: the bank covers losses from misuse by third parties not close to the holder if the duties of care (section 8) were complied with and there is no fault. Not covered are losses in the event of a breach of duty until the card is blocked, transactions with one of the methods named in section 6 (PIN, 3-D Secure, mobile payment), insured losses and consequential losses. Report misuse immediately by telephone, written dispute no later than 30 days from the monthly invoice, form within 10 days.
Deadline: 30 days
Raiffeisen Schweiz Genossenschaft / Raiffeisenbanken: Bedingungen für die Benützung der Raiffeisen Kreditkarten (Kredit- und Prepaid-Karten für Privatpersonen), Ausgabe 2026 (PDF erstellt 30.10.2025), Ziff. 10 Verantwortlichkeit und Haftung (Frist Ziff. 8) · Open document (opens in a new window)
«übernimmt die Bank Schäden, welche aus missbräuchlicher Verwendung der Karte durch nicht nahestehende Dritte entstehen.»
-
Raiffeisen: Debit card (Debit Mastercard, Visa Debit): same liability logic as for the credit card (section 13), but a longer reporting deadline: report discrepancies no later than 45 calendar days after receipt of the account statement, otherwise it is deemed approved; form within 10 calendar days.
Deadline: 45 days
Raiffeisen Schweiz Genossenschaft / Raiffeisenbanken: Bedingungen für die Benützung der Raiffeisen Debitkarten, Version 1.2 – Januar 2026, Ziff. 12 und 13 · Open document (opens in a new window)
«spätestens aber 45 Kalendertage nach Erhalt des monatlichen Kontoauszugs, resp. der monatlichen Prüfung, ansonsten gilt der Kontoauszug als genehmigt.»
-
ZKB: ZKB Visa Debit: the bank covers losses from misuse by third parties (including counterfeiting) if the provisions were complied with in all respects, there is no fault and the dispute was made in time. Anyone who disputes too late (later than 30 days after the account statement, form within 10 days) loses any claim. If neither the bank nor the customer breached their obligations, the loss is borne by the party in whose sphere of influence the misuse occurred. ZKB credit cards are issued by Viseca; the Viseca T&C apply to them.
Deadline: 30 days
Zürcher Kantonalbank: Bestimmungen zur ZKB Visa Debit Card, Ausgabe Juni 2026, Ziff. 12 Schadenübernahme · Open document (opens in a new window)
«Bei verspäteter Einreichung von Beanstandungen hat die kartenberechtigte Person weder einen Anspruch auf Bearbeitung der Beanstandungen noch auf eine Schadensübernahme durch die Bank.»
-
-
Card details copied Swisscard, Viseca, Cornèrcard, PostFinance, UBS, Cembra, Migros Bank, Raiffeisen 8 rules
-
Swisscard: Swisscard covers pure card data transactions without an additional means of authentication under section 11.3 if the customer has fulfilled all obligations (among others, protecting the device with a lock, an up-to-date operating system and antivirus, section 10.1 k). The 3-D Secure conditions additionally require that the misuse is proven. Skimming with PIN entry falls under the exclusion in section 11.4 a.
Deadline: 30 days
Swisscard AECS GmbH: Besondere Bedingungen der Swisscard AECS GmbH für die Benutzung von 3-D Secure, Version 05/2024, Ziff. 4.5 · Open document (opens in a new window)
«übernimmt die Herausgeberin Belastungen aus nachgewiesener missbräuchlicher Verwendung der Karte durch Dritte»
-
Viseca: Expressly covered are counterfeits and data theft by third parties not close to the cardholder, provided the payment was not authenticated with PIN, 3-D Secure or SMS code and the customer has fulfilled their obligations (among others, protecting devices with antivirus and updates, not disclosing card data).
Deadline: 30 days · Deductible: none
Viseca Card Services SA: Allgemeine Geschäftsbedingungen für Zahlkarten der Viseca Card Services SA (Private), Version Januar 2026, Ziff. 1.6.2 · Open document (opens in a new window)
«Dies umfasst beispielsweise Schäden aufgrund von Fälschungen oder Verfälschungen der Karte oder Datendiebstahl durch nicht nahestehende Dritte.»
-
Cornèrcard: The risk of misuse lies in principle with the cardholder (authentication, section 5). Coverage only under the conditions of section 7 and only if merely card data without an additional means of authentication was used. Expressly excluded are losses through manipulation of mobile phones and SIM cards (section 7 g) and through electronic means of communication.
Deadline: 30 days
Cornèr Bank AG: Allgemeine Geschäftsbedingungen für die Classic, Gold und Platinum Karten Visa, Mastercard und Diners Club der Cornèr Bank AG, Ausgabe 01.2025, Ziff. 5 Legitimation · Open document (opens in a new window)
«Die Risiken aus der missbräuchlichen Verwendung der Karte liegen somit grundsätzlich beim Haupt- und Begleitkarteninhaber.»
-
PostFinance: PostFinance credit cards: the risk lies in principle with the customer. If no means of identification or security element was used, PostFinance covers the loss, provided the customer has complied with all conditions and is not at fault. Dispute within 30 days of the invoice, form within 10 days. Compensation may be limited or excluded, for example in the event of lack of cooperation or repeated cases.
Deadline: 30 days
PostFinance AG: Teilnahmebedingungen PostFinance-Kredit- und -Prepaidkarten, Version August 2024, Ziff. 6 c (Frist Ziff. 4 d) · Open document (opens in a new window)
«In allen übrigen Fällen übernimmt PostFinance Schäden aus missbräuchlicher Verwendung der Karte durch Dritte»
-
UBS: Credit card: the risk lies in principle with the cardholder. If no means of access was used, UBS covers the loss if disputed in time (immediately, no later than 30 days from the statement date), provided all T&C provisions were complied with and there is no fault.
Deadline: 30 days
UBS Switzerland AG: Vertragliche Grundlagen für private Kunden – Allgemeine Geschäftsbedingungen für die Benützung der UBS Kreditkarten, Kreditkarten-AGB Ausgabe September 2024, Kreditkarten Ziff. 8.2 (Frist Ziff. 7.4), PDF-S. 23 · Open document (opens in a new window)
«In allen übrigen Fällen übernimmt UBS bei rechtzeitiger Beanstandung (Ziffer 7.4) Schäden aus missbräuchlicher Verwendung der Karte durch Dritte»
-
Cembra: Stolen or copied card data must be reported immediately (section 3.3); section 4.1 then applies. However, Cembra rejects any liability for transactions after unlawful access to the holder’s device and for losses caused by spying out data or careless handling of means of authentication. Where 3-D Secure is offered, it must be used (section 3.9).
Deadline: 30 days
Cembra Money Bank AG: Allgemeine Geschäftsbedingungen für die Kreditkarten von Cembra, V1/03.2025, Ziff. 4.6 · Open document (opens in a new window)
«Die Herausgeberin lehnt jegliche Haftung für Transaktionen ab, welche aus einem unrechtmässigen Zugriff auf das Endgerät des Inhabers oder dessen Verwendung resultieren.»
-
Migros Bank: Even for transactions with PIN or 3-D Secure, Migros Bank covers the charges if it is proven that third parties unlawfully interfered with networks, telecom facilities or the customer’s infrastructure (e.g. malware on the device). Requirement: dispute in time and duties of care complied with. This clause is more customer-friendly than with most other issuers examined.
Deadline: 30 days · Deductible: none
Migros Bank AG: Bedingungen für die Nutzung von Kreditkarten für Privatpersonen der Migros Bank AG, Version 01/2026, Ziff. 4.5 · Open document (opens in a new window)
«Bei nachweislich rechtswidrigen Eingriffen von Dritten in die Einrichtungen von Netzwerk- und/ oder Telekommunikationsbetreibern oder in die von der inhabenden Person genutzten Infrastruktur»
-
Raiffeisen: Data theft and counterfeiting by third parties not close to the cardholder are expressly covered, provided no obligation was breached and the payment was not approved with PIN, 3-D Secure or mobile payment. For mobile payment losses, the conditions of the third-party provider must also have been complied with.
Deadline: 30 days
Raiffeisen Schweiz Genossenschaft / Raiffeisenbanken: Bedingungen für die Benützung der Raiffeisen Kreditkarten (Kredit- und Prepaid-Karten für Privatpersonen), Ausgabe 2026, Ziff. 10 · Open document (opens in a new window)
«Dies sind beispielsweise Schäden aufgrund von Fälschungen oder Verfälschungen der Karte oder Datendiebstahl durch nicht nahestehende Dritte.»
-
-
Payment approved by you Swisscard, Viseca, Cornèrcard, PostFinance, UBS, Cembra, Migros Bank, Raiffeisen, ZKB 9 rules
-
Swisscard: No coverage. Transactions approved with 3-D Secure are deemed authorised; the T&C exclude losses if at least one additional means of authentication was used. Swisscard rejects any responsibility for the transaction itself (e.g. investment fraud) (section 11.2).
Deadline: 30 days
Swisscard AECS GmbH: Allgemeine Geschäftsbedingungen für Kreditkarten der Swisscard AECS GmbH im Bereich Privatkunden, 01/2021, Ziff. 11.4 Bst. a (vgl. 3-D-Secure-Bedingungen Ziff. 1.4) · Open document (opens in a new window)
«wenn die fragliche Transaktion … mit mindestens einem zusätzlichen Legitimationsmittel (z. B. PIN-Code, mTAN, 3-D Secure, Swisscard Digital Services) durchgeführt wurde.»
-
Viseca: No coverage: transactions that the customer (or third parties close to them) authenticated with PIN, 3-D Secure, SMS code or biometrics are excluded. The customer alone is responsible for the underlying transaction (section 1.6.1). The online account protection also only covers transactions without approval.
Deadline: 30 days
Viseca Card Services SA: Allgemeine Geschäftsbedingungen für Zahlkarten der Viseca Card Services SA (Private), Version Januar 2026, Ziff. 1.6.2, Ausschlüsse · Open document (opens in a new window)
«Schäden aus Transaktionen, welche Sie oder nahestehende Dritte authentifiziert haben z. B. durch Eingabe des PIN-Codes, Bestätigung mittels 3-D Secure»
-
Cornèrcard: The bank is not liable as soon as at least one further means of authentication was used in addition to the card data (PIN, mTAN, 3-D Secure, app approval). Anyone who discloses their PIN or card data is liable for all consequences under section 3. Only those with the separate Cornèrcard cyber insurance receive up to CHF 1'000 per year for phishing or smishing (e-mail/SMS).
Deadline: 30 days
Cornèr Bank AG: Allgemeine Geschäftsbedingungen für die Classic, Gold und Platinum Karten Visa, Mastercard und Diners Club der Cornèr Bank AG, Ausgabe 01.2025, Ziff. 7 Bst. a · Open document (opens in a new window)
«mit mindestens einem zusätzlichen Legitimationsmittel (z.B. PIN-Code, mTAN, 3-D Secure) durchgeführt wurde.»
-
PostFinance: Credit card: if the customer approves transactions with a means of identification or security element, they bear the loss in any case. E-Finance: confirmations may only be given if they correspond to the customer’s own will (TNB digital section 5 e); PostFinance never asks for codes (section 5 a).
Deadline: 30 days
PostFinance AG: Teilnahmebedingungen PostFinance-Kredit- und -Prepaidkarten, Version August 2024, Ziff. 6 c · Open document (opens in a new window)
«In jedem Fall sind sie von der Kund:in zu tragen, wenn die Transaktionen unter Verwendung eines Identifikationsmittels oder Sicherheitselements»
-
UBS: No coverage: credit card transactions approved with a means of access (Access App, PIN, one-time codes) are borne by the cardholder in any case. In digital banking, the correct confirmation of orders lies solely with the customer (basic provisions section 5).
Deadline: 30 days
UBS Switzerland AG: Vertragliche Grundlagen für private Kunden – Allgemeine Geschäftsbedingungen für die Benützung der UBS Kreditkarten, Kreditkarten-AGB Ausgabe September 2024, Kreditkarten Ziff. 8.2, PDF-S. 23 · Open document (opens in a new window)
«In jedem Fall sind sie vom Karteninhaber zu tragen, wenn die Transaktionen unter Verwendung eines Zugangsmittels genehmigt wurden.»
-
Cembra: No coverage: transactions via card data, PIN or means of authentication (3-D Secure, app) are deemed authorised by the holder, even if another person initiated them. With 3-D Secure, the merchant and amount must be checked (section 3.5); codes must never be disclosed in response to an e-mail or SMS request (section 3.6).
Deadline: 30 days
Cembra Money Bank AG: Allgemeine Geschäftsbedingungen für die Kreditkarten von Cembra, V1/03.2025, Ziff. 2 (Karteneinsatz) und 3.6 · Open document (opens in a new window)
«gelten als durch den Inhaber autorisiert, selbst wenn es sich bei der die Transaktion auslösenden Person nicht um den Inhaber handelt.»
-
Migros Bank: Any authorised use with PIN, 3-D Secure code, Click to Pay or other means of authentication is deemed to have been made by the holder; the holder then bears the risk of misuse.
Deadline: 30 days
Migros Bank AG: Bedingungen für die Nutzung von Kreditkarten für Privatpersonen der Migros Bank AG, Version 01/2026, Ziff. 4.5 · Open document (opens in a new window)
«Jeder autorisierte Einsatz der Karte mit dem dazu passenden PIN-Code, dem 3-D Secure-Code … gilt als durch die inhabende Person erfolgt.»
-
Raiffeisen: No coverage of transactions that the cardholder (or persons close to them) approved with one of the methods named in section 6. 3-D Secure may only be confirmed if the details are correct; never pass codes on to third parties (section 8).
Deadline: 30 days
Raiffeisen Schweiz Genossenschaft / Raiffeisenbanken: Bedingungen für die Benützung der Raiffeisen Kreditkarten (Kredit- und Prepaid-Karten für Privatpersonen), Ausgabe 2026, Ziff. 10, Ausschlüsse · Open document (opens in a new window)
«Schäden aus Transaktionen, welche der Karteninhaber oder nahestehende Dritte gemäss einer in Ziffer 6 aufgezählten Methode genehmigt hat»
-
ZKB: E-banking: anyone who does not check the data displayed when confirming a transaction and confirms anyway bears the loss (sections 5 and 7.1 b).
Zürcher Kantonalbank: Besondere Bestimmungen für Digitale Bankdienstleistungen der Zürcher Kantonalbank, Januar 2025, Ziff. 7.1 Bst. b · Open document (opens in a new window)
«im Falle der Verletzung der Prüfpflichten beim Erteilen der Transaktionsbestätigung gemäss Ziff. 5»
-
-
E-banking taken over PostFinance, UBS, Migros Bank, ZKB 4 rules
-
PostFinance: Anyone who logs in with the means of identification is deemed authorised; the customer approves all actions carried out in this way (TNB digital section 2 b). The customer bears the loss resulting from breached duties of care. If nobody breached their obligations, the loss is borne by the party in whose sphere of influence the cause lay (T&C section 2). Obligations: keep codes secret, do not allow remote access, antivirus and updates, report immediately if suspicious, police report. The guarantee of up to CHF 100'000 announced in 2018 is not included in the current conditions of participation (version August 2024).
PostFinance AG: Allgemeine Geschäftsbedingungen der PostFinance AG, Version August 2024, Ziff. 2 Legitimation · Open document (opens in a new window)
«Falls weder die Kund:in noch PostFinance ihre Sorgfaltspflichten verletzt hat, so hat diejenige Partei den Schaden zu tragen, in deren Einflussbereich sich die Ursache»
-
UBS: Anyone who logs in with the personal means of access is treated as authorised. The authentication agreement places manipulation of the customer’s device, misuse of means of access, breached duties of care and interference by third parties in data transmission at the customer’s end on the customer. UBS is only liable if it has breached the customary standard of care. Obligations: keep means of access separately and never pass them on, do not respond to e-mails or SMS asking for access data, keep the operating system and browser up to date.
UBS Switzerland AG: Vertragliche Grundlagen für private Kunden – Basisbestimmungen für UBS Digital Banking, Basisbestimmungen Ausgabe Februar 2025 (63615 D 001 07.02.2025), Digital Banking Ziff. 6 Risiken, PDF-S. 11 · Open document (opens in a new window)
«Die Legitimationsabrede (vgl. Ziff. 2) bedeutet, dass die Risiken beim Vertragspartner liegen, die sich (i) aus Manipulationen am IT-System des Zugriffsberechtigten»
-
Migros Bank: Authentication is checked automatically; anyone who uses the correct means of identification is deemed authorised, and all orders are deemed authorised by the customer (section 2). If the customer breaches duties of care (official app, up-to-date operating system, antivirus, not passing on devices), the bank rejects any liability (section 6). Liability for unlawful interference in telecom networks is excluded (section 7).
Migros Bank AG: Bedingungen für die Benützung des E-Bankings der Migros Bank AG, 3828 – Version 4, Ziff. 6 Sorgfaltspflichten · Open document (opens in a new window)
«Sollte die Nichteinhaltung der folgenden Sorgfaltspflichten zu Schäden führen, lehnt die Bank jegliche Haftung dafür ab.»
-
ZKB: The customer bears the loss if their means of authentication are misused (unlawful access, fraud) and they have breached their duties of care, e.g. responded to phishing e-mails, saved the password or neglected updates and antivirus (section 4). If neither the bank nor the user breached obligations, the loss is borne by the party in whose sphere of influence the misuse occurred. The device is outside the bank’s control (section 7.3).
Zürcher Kantonalbank: Besondere Bestimmungen für Digitale Bankdienstleistungen der Zürcher Kantonalbank, Januar 2025, Ziff. 7.1 und 7.2 Risiken · Open document (opens in a new window)
«Haben weder die Bank noch der Benutzer ihre Sorgfaltspflichten verletzt, trägt den Schaden derjenige, in dessen Einflussbereich sich der Missbrauch oder der Betrug zugetragen hat.»
-
-
Twint Raiffeisen, ZKB, TWINT 4 rules
-
Raiffeisen: Raiffeisen TWINT: confirmed payments are irrevocable (section 7.1); P2P payments only go to the mobile number entered (section 7.3). The bank excludes any warranty and liability, including for unauthorised access to the device and for breaches of the duties of care. There is no rule on covering losses. Report misuse immediately, written dispute no later than 30 days from the account statement or credit card invoice, criminal complaint at the bank’s request.
Deadline: 30 days
Raiffeisen Schweiz Genossenschaft / Raiffeisenbanken: Raiffeisen TWINT – Allgemeine Geschäftsbedingungen, AGB Version 6.0 – Dezember 2024, Ziff. 14 Gewährleistung und Haftung (Frist Ziff. 9) · Open document (opens in a new window)
«Die Bank schliesst jede Gewährleistung und Haftung im Zusammenhang mit der Benützung der TWINT App aus»
-
ZKB: ZKB TWINT: payments made via TWINT are binding and can neither be revoked nor cancelled. The bank is not liable for goods and services paid for; claims are to be made against the merchant. Dispute no later than 30 days after execution, after which all claims lapse (section 6.4). The customer bears the consequences of misuse via biometric login (section 16).
Deadline: 30 days
Zürcher Kantonalbank: Nutzungsbedingungen für ZKB TWINT, Ausgabe November 2026, Ziff. 1 Gegenstand (Frist Ziff. 6.4) · Open document (opens in a new window)
«Über TWINT in Auftrag gegebene Zahlungen sind für den Kunden und für die Bank verbindlich und können nicht widerrufen oder storniert werden.»
-
TWINT: Actions that a third party carries out without authorisation with a customer’s TWINT app are attributed to the customer (section 1.7). TWINT AG is not liable for unauthorised access, breaches of duty or actions by third parties, except in the case of its own gross negligence or intent; it then compensates at most CHF 3'000 per loss event (section 1.8). Obligations: keep the code secret, lock the device, no jailbreak, check the recipient before every payment, police report in the case of criminal offences. TWINT advises those affected to call their bank immediately.
TWINT AG: Allgemeine Geschäftsbedingungen für die Nutzung von TWINT, Version 9.0 / Oktober 2026, Ziff. 1.7 und 1.8 · Open document (opens in a new window)
«Insbesondere werden Handlungen, die eine Drittperson unberechtigt mit der TWINT App einer Kundin bzw. eines Kunden vornimmt, der Kundin bzw. dem Kunden zugerechnet.»
-
TWINT: No right of chargeback in the T&C. TWINT recommends first requesting the money back via «Request money»; if the recipient does not respond, contact the bank that issues the TWINT app.
TWINT AG: FAQ: Ich habe Geld an die falsche Person/Mobiltelefonnummer gesendet. Wie bekomme ich mein Geld zurück?, nicht angegeben, FAQ-Antwort · Open document (opens in a new window)
«Wenn die unberechtigte Empfängerin oder der unberechtigte Empfänger nicht reagiert oder die Rückzahlung aktiv verweigert, musst du den Herausgeber deiner TWINT App kontaktieren.»
-
How the Swiss Banking Ombudsman decided
15 fraud cases from the annual reports 2020 to 2025. The Ombudsman mediates between customers and banks.
-
Case 2025/05
E-banking, phishing, 2-factor authorisation
What happened, the outcome
After a phishing attack, fraudsters registered a new device in the customer’s e-banking and transferred just under CHF 22'000 to a new recipient.
The bank did not pay; proceedings closed with an explanatory decision.
According to the Ombudsman, the cause of the loss lay within the customer’s sphere of influence and risk; under the contractual liability rules, the customer bears the loss.
Schweizerischer Bankenombudsman: Jahresbericht 2025, 2025 (publiziert Mai 2026), S. 14, Fall 2025/05 · Open document (opens in a new window)
«dass die Schadensursache der Einfluss- und Risikosphäre des Kunden zuzurechnen sei»
-
Case 2025/06
Payment app, new phone number linked
What happened, the outcome
After a new mobile phone had been linked to the customer’s payment app, four fraudulent transactions totalling CHF 200 were made.
Partially: the bank paid CHF 100 and promised to review its security level.
The Ombudsman examined whether the security level was adequate (no warning for a new device) and recommended an amicable solution as well as 2-factor authorisation for this process.
Schweizerischer Bankenombudsman: Jahresbericht 2025, 2025 (publiziert Mai 2026), S. 14, Fall 2025/06 · Open document (opens in a new window)
«Die Bank war bereit, dem Kunden eine Entschädigung von 100 CHF zu zahlen.»
-
Case 2025/07
Classified ad fraud, payment app, blocking hotline
What happened, the outcome
Alleged buyers on a classified ads platform obtained confidential data by deception, installed the seller’s payment app on another device and made transactions totalling CHF 4'300; the bank’s warning hotline was not staffed, and only the card was blocked, not the app.
Partially: the bank increased its offer to around 50% of the loss.
The Ombudsman emphasises that services running around the clock also need a blocking option that can be reached at all times.
Schweizerischer Bankenombudsman: Jahresbericht 2025, 2025 (publiziert Mai 2026), S. 15, Fall 2025/07 (Grundsatz S. 8) · Open document (opens in a new window)
«Der Ombudsman konnte erreichen, dass die Bank ihr Vergleichsangebot auf rund 50 % des Schadensbetrags erhöhte.»
-
Case 2025/08
Debit card fraud after registration in a payment app (SMS code)
What happened, the outcome
Fraudsters registered a customer’s debit card in a payment app; activation required an SMS code sent to her phone, which she had ignored as unclear.
The bank did not pay; proceedings ended without a mediated solution.
The bank saw a breach of the duty of care by the customer; the Ombudsman suggested a concession, the bank refused.
Schweizerischer Bankenombudsman: Jahresbericht 2025, 2025 (publiziert Mai 2026), S. 15, Fall 2025/08 · Open document (opens in a new window)
«Die Bank war der Ansicht, der Schaden sei wegen einer Sorgfaltspflichtverletzung der Kundin entstanden und verweigerte ein Entgegenkommen.»
-
Case 2025/09
Fraud, payment order executed despite revocation
What happened, the outcome
A fraud victim revoked a scheduled payment order of around CHF 900 on the same day; the bank executed it anyway.
The bank paid in full.
The Ombudsman considered the customer’s account plausible and pointed out contradictions in the bank’s arguments.
Schweizerischer Bankenombudsman: Jahresbericht 2025, 2025 (publiziert Mai 2026), S. 15, Fall 2025/09 · Open document (opens in a new window)
«überprüfte die Bank den Fall erneut und kam dem Kunden schliesslich vollumfänglich entgegen.»
-
Case 2024/06
TWINT, classified ad fraud
What happened, the outcome
An alleged buyer on a classified ads platform got the seller to disclose her phone number and account details; fraudsters activated TWINT on their device and made nine transactions totalling CHF 4'750.
Partially: goodwill payment, accepted by the customer as a settlement.
The bank relied on the customer’s breach of the duty of care; the Ombudsman doubted that the TWINT conditions had been validly accepted.
Schweizerischer Bankenombudsman: Jahresbericht 2024, 2024 (publiziert Mai 2025), S. 15, Fall 2024/06 · Open document (opens in a new window)
«erachtete er es als fraglich, dass die Bedingungen für TWINT … von der Kundin rechtsgültig akzeptiert worden waren.»
-
Case 2024/07
Phishing via a fake bank website (Google search result), e-banking
What happened, the outcome
The customer entered her e-banking details on a fake bank website from the top Google result; fraudsters initiated a payment of around CHF 5'000, and the bank only contacted the recipient bank five days after the report.
The bank did not pay; case closed without a mediation result.
The bank stated that the customer had confirmed the payment in the app and that the recall had been made in time.
Schweizerischer Bankenombudsman: Jahresbericht 2024, 2024 (publiziert Mai 2025), S. 15, Fall 2024/07 · Open document (opens in a new window)
«Die Bank antwortete der Kundin, sie habe die Zahlung auf der App bestätigt und erklärte, der Rückruf sei rechtzeitig erfolgt.»
-
Case 2024/08
Investment fraud, payment initiated by the customer at the counter
What happened, the outcome
An elderly customer transferred EUR 10'000 at the counter to a fake investment adviser abroad; his relatives demanded 50% from the bank because the counter employee should have recognised the fraud.
The bank did not pay.
The bank considered the order to have been executed properly and remained uncompromising.
Schweizerischer Bankenombudsman: Jahresbericht 2024, 2024 (publiziert Mai 2025), S. 16, Fall 2024/08 · Open document (opens in a new window)
«Die Bank wies die Forderung zurück und vertrat die Meinung, den Auftrag des Kunden pflichtgemäss ausgeführt zu haben»
-
Case 2023/07
Phishing, credit card, wallet on another device, fraud detection
What happened, the outcome
The customer entered card details and a confirmation code on a phishing page; the perpetrators registered the card in a wallet and charged CHF 12'000, above the card limit.
Partially: the bank paid CHF 3'000.
Concession because the limit had been exceeded; the bank’s fraud monitoring had not stopped the unusual charges.
Schweizerischer Bankenombudsman: Jahresbericht 2023, 2023 (publiziert Mai 2024), S. 16, Fall 2023/07 · Open document (opens in a new window)
«kam ihm aber schliesslich im Ombudsverfahren wegen der Limitenüberschreitung mit 3000 CHF entgegen»
-
Case 2023/08
Investment fraud (crypto), chargeback
What happened, the outcome
At the instigation of fraudsters, the customer bought cryptocurrency with his credit cards and forwarded it himself to unknown persons; he then requested a chargeback.
The bank did not pay; no mediation procedure.
The chargeback deadlines had expired, and the customer had forwarded the cryptocurrency of his own accord.
Schweizerischer Bankenombudsman: Jahresbericht 2023, 2023 (publiziert Mai 2024), S. 16, Fall 2023/08 · Open document (opens in a new window)
«Die Bank lehnte dies ab, da die entsprechenden Fristen bereits abgelaufen seien.»
-
Case 2023/09
Card fraud, reserved charge after fraud report
What happened, the outcome
The customer reported fraud immediately; the bank nevertheless passed on credit card payments that had initially been shown as «reserved».
No loss (the amounts could be recovered in another way); the Ombudsman explained the legal situation.
Under the card network’s rules, the bank must pay reserved amounts to the merchant.
Schweizerischer Bankenombudsman: Jahresbericht 2023, 2023 (publiziert Mai 2024), S. 16, Fall 2023/09 · Open document (opens in a new window)
«sie sei in einem solchen Fall aufgrund der Regeln des Kreditkartennetzwerks gegenüber dem Händler zur Zahlung verpflichtet»
-
Case 2023/10
Credit card fraud, chargeback at a crypto exchange
What happened, the outcome
Fraudsters bought cryptocurrency with the customer’s credit card; the crypto exchange was only willing to repay via a chargeback by the bank.
Money back: the bank initiated the chargeback, and it was successful.
The bank gave in after the Ombudsman’s intervention.
Schweizerischer Bankenombudsman: Jahresbericht 2023, 2023 (publiziert Mai 2024), S. 17, Fall 2023/10 · Open document (opens in a new window)
«Diese zeigte sich schliesslich dazu bereit und informierte den Ombudsman, dass das Verfahren erfolgreich abgeschlossen werden konnte.»
-
Case 2023/11
Online purchase, goods not delivered, chargeback deadline
What happened, the outcome
The customer never received goods ordered online and paid for by credit card; the bank rejected his chargeback as late.
The bank paid in full as a goodwill gesture.
The bank still considered the request to be late under the card organisation’s rules, but refunded the amount as a goodwill gesture.
Schweizerischer Bankenombudsman: Jahresbericht 2023, 2023 (publiziert Mai 2024), S. 17, Fall 2023/11 · Open document (opens in a new window)
«Trotzdem war die Bank bereit, dem Kunden den Betrag für die beanstandete Transaktion aus Kulanz zu erstatten.»
-
Case 2020/08
Love scam (romance scam), bank stops payments
What happened, the outcome
A customer wanted to transfer money to an internet acquaintance abroad; the bank suspected a romance scam, did not execute the payments, called in a fraud specialist from the police and then charged CHF 1'500 for its efforts.
No loss; following mediation by the Ombudsman, the bank halved the fees.
The Ombudsman praised the bank’s approach, but considered the basis for the fees questionable.
Schweizerischer Bankenombudsman: Jahresbericht 2020, 2020 (publiziert Juni 2021), S. 32, Fall 2020/08 · Open document (opens in a new window)
«Die Bank vermutete einen sogenannten «Romance Scam» und versuchte, die Kundin von diesen Überweisungen abzuhalten.»
-
Case 2020/09
Card taken at a manipulated cash machine (prepaid), blocking hotline
What happened, the outcome
Abroad, a manipulated machine retained the prepaid card after the PIN was entered; the perpetrators withdrew around CHF 2'000 before the card was blocked, and the blocking hotline was not staffed at night.
The bank paid (charges cancelled after several interventions).
The manipulation of the machine was not recognisable to the customer, and he may expect a blocking hotline staffed around the clock; the issuer had initially refused because the original card and PIN were used.
Schweizerischer Bankenombudsman: Jahresbericht 2020, 2020 (publiziert Juni 2021), S. 33, Fall 2020/09 · Open document (opens in a new window)
«Nach mehreren Interventionen konnte dieser die Kartenherausgeberin bewegen, die Belastungen zu stornieren.»
Legal position in Switzerland: 17 statements with sources
- According to the Swiss Banking Ombudsman, a bank in Switzerland is regularly not legally obliged to compensate customers in fraud cases; goodwill gestures are becoming rarer.
Where does it say so?
Jahresbericht 2024, 2024 (publiziert Mai 2025), S. 8, «2024 in Kürze»
«Eine rechtliche Verpflichtung der Finanzinstitute, die Kunden in solchen Fällen zu entschädigen, ist aufgrund der heutigen Rechtslage in der Schweiz regelmässig nicht gegeben.»
Open document: Jahresbericht 2024 (opens in a new window), retrieved 06.11.2026
- Principle of Swiss law: the loss is borne first by the person who suffers it. As a rule, a bank is only liable if it has culpably breached the contract and caused the loss in an adequately causal manner (the source does not cite any legal articles).
Where does it say so?
Jahresbericht 2020, 2020 (publiziert Juni 2021), S. 14, «2020 in Kürze»
«Das schweizerische Recht geht vielmehr davon aus, dass in erster Linie derjenige einen Schaden tragen muss, welcher ihn erleidet.»
Open document: Jahresbericht 2020 (opens in a new window), retrieved 06.11.2026
- For electronic orders, anyone who logs in with the agreed means of authentication is deemed authorised. The bank does not have to check the customer’s motives or the recipient; this applies to payments initiated by the customer in cases of investment fraud and love scams.
Where does it say so?
Jahresbericht 2020, 2020 (publiziert Juni 2021), S. 14, «2020 in Kürze»
«Eine Prüfung der Motive des Kunden für die Zahlung oder der Integrität des Zahlungsempfängers gehört nicht zu den Pflichten der Bank.»
Open document: Jahresbericht 2020 (opens in a new window), retrieved 06.11.2026
- As a rule, card issuers are only liable if the customer has fully complied with all duties of care in the card conditions. These catalogues are getting longer and are interpreted more strictly to the detriment of customers.
Where does it say so?
Jahresbericht 2020, 2020 (publiziert Juni 2021), S. 14, «2020 in Kürze»
«Zusätzlich werden diese Sorgfaltspflichten zulasten der Kunden zunehmend strenger interpretiert.»
Open document: Jahresbericht 2020 (opens in a new window), retrieved 06.11.2026
- The contracts (T&C) determine who bears the loss. They usually follow the risk sphere theory: the loss is borne by the party that could have prevented it in its own sphere by exercising care. The T&C of the providers examined (e.g. PostFinance T&C section 2, ZKB digital banking services section 7.2) expressly implement this.
Where does it say so?
Jahresbericht 2022, 2022 (publiziert Mai 2023), S. 7, «2022 in Kürze»
«Die einschlägigen Verträge basieren häufig auf der sogenannten Risikosphärentheorie»
Open document: Jahresbericht 2022 (opens in a new window), retrieved 06.11.2026
- Foreign legal systems in some cases regulate liability for fraud differently; such rules (for example as quoted by AI tools) cannot be applied in Switzerland. The source does not expressly name the EU Payment Services Directive (PSD2).
Where does it say so?
Jahresbericht 2025, 2025 (publiziert Mai 2026), S. 7, «2025 in Kürze»
«welche zum Beispiel in Betrugsfällen Haftungsfragen anders regeln als die schweizerische Rechtsordnung und hierzulande nicht umgesetzt werden können.»
Open document: Jahresbericht 2025 (opens in a new window), retrieved 06.11.2026
- Fraud cases at the Ombudsman increased by 85% in 2023 compared with the previous year. As a rule, customers bear the losses themselves; liability of the bank is rare.
Where does it say so?
Jahresbericht 2023, 2023 (publiziert Mai 2024), S. 9, «2023 in Kürze»
«Die Kunden müssen die Schäden aus diesen Vorfällen in aller Regel selbst tragen. Eine Haftung der Bank ist selten gegeben.»
Open document: Jahresbericht 2023 (opens in a new window), retrieved 06.11.2026
- In 2024, «fraud» was for the first time the most frequent cause of problems in the Ombudsman’s cases. Above all, online banking takeovers and payments that customers initiate themselves under false pretences have increased.
Where does it say so?
Jahresbericht 2024, 2024 (publiziert Mai 2025), S. 8, «2024 in Kürze»
««Betrug» war erstmals die häufigste Problemursache in den dem Ombudsman unterbreiteten Fällen»
Open document: Jahresbericht 2024 (opens in a new window), retrieved 06.11.2026
- According to the consumer protection foundation Stiftung für Konsumentenschutz (SKS), the chance of getting money back after phishing is small, because banks and card issuers often exclude liability contractually.
Where does it say so?
Gefährliche Kommunikation: Phishing, Ransomware, Betrug, zuletzt aktualisiert 28.09.2026, Abschnitt «Was tun, wenn …» (Schadenfall)
«Die Chance, dass Sie Ihr Geld zurückbekommen, ist allerdings klein. Banken und Kreditkartenanbieterinnen schliessen in ihren Verträgen die Haftung für solche Fälle oft aus.»
Open document: Gefährliche Kommunikation: Phishing, Ransomware, Betrug (opens in a new window), retrieved 06.11.2026
- The SKS recommends that victims of classified ad fraud check whether their household contents or legal protection insurance covers the loss.
Where does it say so?
Kleinanzeigen-Betrug, zuletzt aktualisiert 04.11.2026, Abschnitt Vorgehen im Betrugsfall
«Prüfen Sie, ob Ihr Schaden versichert ist (Hausratversicherung, Rechtsschutzversicherung).»
Open document: Kleinanzeigen-Betrug (opens in a new window), retrieved 06.11.2026
- According to the FRC, banks and TWINT provide for far-reaching exclusions of liability in their T&C; anyone who carelessly confirms a payment, e.g. to an unidentifiable recipient, often gets nothing back.
Where does it say so?
Twint: les escrocs l'adorent!, 05.12.2023, Artikeltext
«tant les banques que Twint prévoient d’importantes exclusions de responsabilité dans leurs conditions générales»
Open document: Twint: les escrocs l'adorent! (opens in a new window), retrieved 06.11.2026
- In 2018, PostFinance was the first Swiss bank to announce that it would cover losses from technical attacks in e-banking (including phishing and malware) up to CHF 100'000 per case, except in the case of gross negligence. We no longer found this commitment in the conditions of participation currently in force (version August 2024) or on the current E-Finance security page.
Where does it say so?
Betrug im Onlinebanking: Neu bis zu 100'000 Franken gedeckt, 28.08.2018 (aktualisiert 29.08.2018), Artikeltext
«Wie Postfinance in ihrer Pressemitteilung schreibt, führt sie als erste Schweizer Bank eine solche Regelung ein.»
Open document: Betrug im Onlinebanking: Neu bis zu 100'000 Franken gedeckt (opens in a new window), retrieved 06.11.2026
- Practical example: after a classified ad phishing attack with takeover of the PostFinance account (over CHF 80'000), PostFinance refused because the customer had breached her duty of care by passing on the security code.
Where does it say so?
Hacking – Postfinance-Konto geleert – Bank gibt Kundin Schuld, 08.02.2024 (Sendung 06.02.2024), Artikeltext
«Betrüger kapern per Phishing ein Konto und erbeuten 80'000 Franken. Postfinance lässt die Kundin im Regen stehen.»
Open document: Hacking – Postfinance-Konto geleert – Bank gibt Kundin Schuld (opens in a new window), retrieved 06.11.2026
- Cyber and card insurance policies are typically secondary (subsidiary) to the bank: all four issuer policies examined (Cornèr, Swisscard, Viseca, Cembra) only pay if the bank provides no reimbursement at all or has refused in writing to cover the loss, and often only the part that the customer has to bear themselves.
Where does it say so?
Cyber-Versicherung für die Visa, Mastercard und Diners Club Karten der Cornèr Bank AG – Versicherungsbedingungen – Allianz, Ausgabe 06.2026, II C Banking-Schutz, Ziff. 1 (ebenso Swisscard Cyber Security C 3.4, Viseca Online-Kontoschutz Ziff. 5, Cembra CyberProtect Ziff. 1.3)
«die nicht durch die Erstattung ihrer Verluste durch das Finanzinstitut/den Bankkartenherausgeber auf subsidiärer Basis gedeckt sind.»
Open document: Cyber-Versicherung für die Visa, Mastercard und Diners Club Karten der Cornèr Bank AG – Versicherungsbedingungen – Allianz (opens in a new window), retrieved 06.11.2026
- At the same time, the card conditions of all issuers examined exclude losses «for which an insurer has to pay» (e.g. Swisscard section 11.4 b, Cornèr section 7 b, Viseca section 1.6.2, PostFinance section 11, UBS Debit section 8, Cembra section 4.1, Migros Bank section 4.1, Raiffeisen section 10, ZKB section 12). The bank and the insurer therefore refer to each other; how such cases are resolved in practice is not documented.
Where does it say so?
Allgemeine Geschäftsbedingungen für Kreditkarten der Swisscard AECS GmbH im Bereich Privatkunden, 01/2021, Ziff. 11.4 Bst. b
«Schäden, für die eine Versicherung aufzukommen hat, sowie indirekte Schäden oder Folgeschäden irgendwelcher Art (z. B. entgangener Gewinn).»
Open document: Allgemeine Geschäftsbedingungen für Kreditkarten der Swisscard AECS GmbH im Bereich Privatkunden (opens in a new window), retrieved 06.11.2026
- Moneyland: some banks reimburse losses even without insurance, in some cases only as a goodwill gesture. Some cyber policies expressly exclude financial losses from online and mobile banking; private cyber insurance typically costs 40 to over 200 francs per year.
Where does it say so?
Cyber-Versicherungen für Privatpersonen, 27.01.2023, Artikeltext
«Vermögensschäden von Online- und Mobile-Banking werden bei manchen Policen explizit ausgeschlossen.»
Open document: Cyber-Versicherungen für Privatpersonen (opens in a new window), retrieved 06.11.2026
- Reporting deadlines for unauthorised charges: most issuers examined require a written dispute within 30 days (Swisscard, Viseca, Cornèr, Cembra, UBS, Migros Bank, Raiffeisen credit card, ZKB Debit, PostFinance credit card); the Raiffeisen debit card allows 45 calendar days. With the ZKB debit card, any claim lapses once the deadline has expired.
Where does it say so?
Bedingungen für die Benützung der Raiffeisen Debitkarten, Version 1.2 – Januar 2026, Ziff. 12
«spätestens aber 45 Kalendertage nach Erhalt des monatlichen Kontoauszugs»
Open document: Bedingungen für die Benützung der Raiffeisen Debitkarten (opens in a new window), retrieved 06.11.2026