Does insurance pay if an employee falls for a deepfake call?
In short
Yes, insurance can pay if an employee falls for a deepfake call, but usually only fidelity or crime insurance (Vertrauensschadenversicherung) that includes fraud by outsiders. Cyber policies often exclude the outflow of money or pay only through a social engineering module, which often has its own lower limit.
Premiums and limits from published examples of cover against fraud in companies in Germany.
Example
Typical range
Fidelity insurance, office with 3 people, EUR 100,000 cover
around EUR 540 a year, about EUR 45 a month
Sub limit for losses without fault of own staff in one tariff
up to EUR 100,000 per case and year
Cyber insurance, small association with EUR 150,000 to 250,000 turnover, EUR 100,000 cover, EUR 1,000 excess
from about EUR 403 a year
Guide values from published sample calculations and tariff descriptions, as of October 2026.
Your premium depends on staff numbers, sector, sum insured and controls.
Worked example
Accounts team transfers EUR 150,000 after a video call
The bookkeeper of a wholesaler sees the supposed managing director in a video conference and transfers EUR 150,000 for a secret acquisition.
Loss
EUR 150,000
Cyber policy with social engineering module, cap EUR 100,000
at most EUR 100,000
Fidelity insurance with third party fraud, sum EUR 250,000
up to EUR 150,000
Excess
guide value from quoting practice: EUR 1,000 to 5,000
With fidelity insurance mainly the excess remains. With the cyber module alone at least EUR 50,000 is missing, without the module the whole amount.
How a deepfake call works
In fake president fraud a criminal poses as the boss or managing director and pushes someone with payment authority into an urgent, confidential transfer. With AI the voice on the phone or the face in a video call looks and sounds convincing.
Germany's Federal Office for Information Security (BSI) names calls using an executive's voice as a specific threat. Criminals often need only a few minutes of public material, such as interviews or company videos.
Which insurance replaces a deepfake loss
Fidelity insurance replaces the direct loss of money and usually the cost of investigating the case. The basic version only covers damage caused by your own staff. Modern wordings include fraud by outsiders who exploit employees' good faith. That extension is what matters after a deepfake call.
Watch for sub limits: some tariffs pay losses without fault of your own staff only up to EUR 100,000 per case and year, even if the overall sum is higher.
Policy
Pays after a deepfake call?
Fidelity insurance including third party fraud
yes, up to the agreed sum or sub limit
Fidelity insurance for own staff only
usually no
Cyber insurance without extra module
for the lost money usually no
Cyber insurance with social engineering module
partly, often tightly capped
General business liability
no
D&O insurance
only indirectly, if the company holds management liable
Why cyber insurance often refuses
Cyber policies usually require an information security breach, meaning an attack on your systems. A deepfake call hacks no computer, it deceives a person. The model wording of the German Insurance Association (GDV) also excludes the outflow of assets.
Many insurers offer an add on for social engineering. It can have its own sub limit below the sum insured. With a large transfer part of the loss would then stay with you.
Policy duties that decide whether you are paid
In fake president cases insurers often point to breached obligations (Obliegenheiten), meaning duties under the contract. A company with written payment rules that it demonstrably follows is in a much stronger position after a loss.
Three rules work well: payments above a fixed amount need two approvers. Every unusual instruction triggers a call back on a known number, never the number from the call. Changes of bank details are checked separately.
When the policy is worth it for your company
Fidelity insurance makes most sense if several people can release transfers, management appears in public videos and interviews, or large sums regularly go abroad. A sole trader who approves every payment personally rarely needs it. Norman Nammert acts as an insurance broker and can check existing cyber and fidelity policies for this gap.
Step by step
Check who in the company may release transfers and up to what amount.
Put four eyes approval and call backs on known numbers in writing.
Train staff with payment authority on deepfake calls.
Read the cyber policy for the asset outflow exclusion and the social engineering cap.
Get quotes for fidelity insurance that includes third party fraud.
In an emergency call the bank at once, report to the police and inform the insurer.
Checklist
Third party deception expressly insured
Social engineering cap high enough for your usual payments
Four eyes principle documented
Call back rule for new bank details
Retroactive cover for earlier caused, later discovered losses
Costs of investigation and legal action included
Common mistakes
Believing cyber insurance covers any fraud
Looking only at the total sum and missing the sub limit
Having approval rules but not following them day to day
Clarifying internally first and calling the bank too late
Questions and answers
Frequently asked
What should we do right after a suspicious deepfake call?
Call the bank immediately so it can stop the payment if possible, report to the police,
inform the insurer and secure call logs, messages and account details.
Will the bank refund the money?
Usually not.
An authorised person released the transfer, so it counts as authorised.
Calling the bank quickly can still help to stop money.
Is a deepfake email different from a deepfake call?
For fidelity insurance the deception counts, not the channel.
Still check whether your tariff names deception by phone and video.
How much does fidelity insurance cost?
For small offices often a few hundred euros a year,
one published example shows around EUR 540 for EUR 100,000 cover.
More staff and higher sums cost more.
Does the EU AI Act help against deepfake fraud?
Hardly.
The labelling duty since 2 August 2026 targets honest users, fraudsters ignore it.
