Does cyber insurance cover phishing in Germany? Personal policies often do, usually up to EUR 3,000 to 15,000 and only if your bank refuses. The bank comes first: for payments you did not approve yourself, you carry at most EUR 50 unless you were grossly negligent. Business policies cover the IT damage after phishing, but money that leaves the account usually only with an extra module.
What phishing cover costs in Germany and what it typically pays.
Example
Typical range
Personal cyber insurance, single person, range in a consumer test
EUR 7 to 212 a year
Typical limit for online banking misuse, personal
about EUR 3,000 to 15,000 a year
Your share of an unauthorised payment without gross negligence
at most EUR 50
Payment fraud module in a business policy
limit usually EUR 10,000 to 250,000
Price range from the Stiftung Warentest consumer test of May 2024,
liability under the German Civil Code.
Personal limits and the range for business modules are guide values from quoting practice.
Worked example
Retired expat in Munich, text message claiming to be the bank, EUR 4,800 taken
How the loss can end up, depending on how the bank sees the case.
Taken by the fraudsters
EUR 4,800
Case A: bank refunds, no gross negligence
own share at most EUR 50
Case B: bank refuses, personal cyber policy with EUR 3,000 per case
EUR 3,000 reimbursed
Case B: remainder without cover
EUR 1,800
Case C: policy defines phishing as email only
EUR 0 from the policy
Whether EUR 50 or EUR 4,800 stays with you depends on the bank's stance and on a single word in the insurance terms.
Your bank first, then the insurer
In phishing, fraudsters trick you into revealing login details, codes or approvals, often through a fake email, a text message or a call supposedly from your bank. Whether any insurance pays afterwards depends first on what the bank has to refund.
If someone used your details to make a payment you did not approve yourself, it counts as unauthorised. Under section 675u of the German Civil Code (BGB), the bank must refund it promptly. Under section 675v, you carry at most EUR 50, unless you acted with gross negligence (grobe Fahrlässigkeit), for example by reading out a code to a stranger on the phone. Then you bear the loss yourself, and that is where cyber insurance matters.
Situation
Who pays first
Role of cyber insurance
Fraudster pays with stolen details
bank, you at most EUR 50
usually none beyond your share
Bank alleges gross negligence
nobody at first
personal policy pays up to its limit, if included
You send money to a fraudster yourself
bank is not liable
personal policy only if it names this fraud
Employee pays a fake invoice
the company
business policy only with a payment fraud module
Personal cyber insurance and phishing
Many personal cyber policies reimburse money lost through misuse of online banking, cards or payment apps. Almost always they pay only after the bank has refused. The limits are low, often a few thousand euros per case with an annual cap.
Read how the policy defines phishing. In 2025 the Regional Court of Bielefeld made clear, for a home contents policy with internet cover, that a clause defining phishing as a fake email does not cover a scam by text message (order of 25.09.2025, 22 S 81/25). Good wordings refer to electronic communication or name text messages, messengers and calls explicitly.
Businesses: phishing as entry point and as payment fraud
For a business, phishing has two faces. If an employee opens an infected attachment and the systems are encrypted, that is the classic cyber insurance case: forensics, recovery and business interruption are covered.
If accounts pays a fake invoice or follows a fake instruction from the boss, there is no hacking in the narrow sense. The model conditions of the German insurers' association expressly exclude the outflow of assets. Only a payment fraud module or fidelity insurance (Vertrauensschadenversicherung) covers these cases.
Where gross negligence begins
Whether you were grossly negligent is decided case by case. Courts tend to say yes if someone gives several codes to a caller despite clear warnings, or approves a request whose text plainly names a different purpose. Falling for a very convincing fake website is not automatically gross negligence.
The bank has to prove gross negligence, so ask for any refusal in writing with reasons. Cyber insurers may also reduce payment for gross negligence, although many personal policies partly waive this.
When you do not need separate phishing cover
If you only use online banking with app approval, never pass on codes by phone and your home contents insurance (Hausratversicherung) already has an internet module including phishing, a separate cyber policy just for phishing adds little. Check instead whether your existing policy covers text messages and calls as well.
Step by step
Call your bank at once and have the account, card and app blocked.
Report the fraud to the police, online if you prefer.
Ask the bank in writing for a refund and for reasons if it refuses.
Report the case to your cyber or home contents insurer, even before the bank decides.
