Who pays if scammers use a cloned voice to take your money?
In short
If scammers use a cloned voice to take your money, usually nobody pays: if you made the transfer yourself, it counts as authorised and the bank does not have to refund under section 675u of the German Civil Code (BGB). Home contents and liability insurance do not cover this fraud. Some personal cyber policies pay up to about EUR 3,000 per case for around EUR 137 a year, check whether phone fraud is included.
What personal cyber insurance with fraud cover costs in Germany, based on published tariff comparisons.
Example
Typical range
Range of all tested personal cyber tariffs, single person
EUR 7 to 212 a year
Basic tariff, single person
EUR 3.75 a month, around EUR 45 a year
Comfort tariff with up to EUR 3,000 per case and EUR 10,000 a year, single person
EUR 11.40 a month, around EUR 137 a year
Comfort tariff, family
EUR 13.41 a month, around EUR 161 a year
Prices from the Stiftung Warentest consumer test (May 2024) and a tariff report.
Whether phone fraud with a transfer you made yourself is covered depends only on the policy
wording.
The calculation in the example is a guide value from quoting practice.
Worked example
Pensioner transfers EUR 8,000 after a call from a fake granddaughter
The voice on the phone sounds like the granddaughter who supposedly needs bail after an accident. The grandmother transfers the money at once.
Loss
EUR 8,000
Refund from the bank, payment was authorised
EUR 0
Cyber policy with EUR 3,000 per case, if phone fraud is included
up to EUR 3,000
Annual premium of this policy
around EUR 137
Even with a matching policy at least EUR 5,000 is lost. A code word would have prevented the loss.
How scammers use a cloned voice
The call sounds like your daughter, grandson or partner: an accident, an arrest, an urgent bill. The voice is taken from social media videos or voice messages and rebuilt with AI.
According to Germany's Federal Office for Information Security (BSI), a very good voice copy needs several hours of recordings, but with large collections of other voices as support a few minutes are enough. Researchers are working on methods that need only seconds. Warning signs are often a metallic sound, odd stress on words or long pauses before each answer.
Why the bank rarely pays after a voice clone scam
Section 675u BGB obliges the bank to refund unauthorised payments by the end of the following business day. In a voice clone scam, however, you released the transfer yourself, deceived but authorised. Then the refund duty does not apply.
It is different if the scammers use stolen login data to take the money themselves. Then the payment is unauthorised and the bank must generally refund, unless you acted with gross negligence (section 675v BGB).
What happened
Who pays
You transfer money yourself after the call
usually nobody, except a cyber policy with fraud cover
You give away a TAN or login on the phone and the scammers debit your account
the bank unless you were grossly negligent, otherwise a cyber policy
You hand cash to a courier
home contents (Hausrat) no, fraud is neither burglary nor robbery
A company pays after a call from a fake boss
fidelity insurance including third party fraud
Which insurance helps against a cloned voice
Personal cyber insurance in Germany costs EUR 7 to 212 a year according to a consumer test. One tariff paying up to EUR 3,000 per case and EUR 10,000 a year for internet crime costs EUR 11.40 a month. Whether fraud by phone counts or only fraud online depends on the wording and differs between tariffs.
With a loss of EUR 20,000 such a policy replaces only a small part. It softens the blow, it is not full protection. Norman Nammert acts as an insurance broker and can check whether your tariff expressly includes deception by phone.
What really protects you
Agree a code word in your family that appears nowhere online and ask for it in every emergency call. Hang up and call the person back on the number you have saved. Real police and real hospitals do not ask for money on the phone.
Fewer public voice recordings make cloning harder but do not prevent it. More important is one rule: no money after a surprise call before you have called back.
When you do not need a policy for this
If you use a fixed code word, release transfers only after calling back and never move larger sums on the spot, you do not need a separate cyber policy for voice clone scams. Limits of a few thousand euros only partly cover typical losses anyway.
Step by step
Agree a secret code word with family and close friends.
Hang up on any money emergency and call back on the saved number.
After a payment call the bank immediately and ask for a recall of the transfer.
Report to the police and keep the call log.
Check whether your cyber policy covers phone fraud and report the loss.
Checklist
Family code word agreed and practised
Relatives' numbers saved
Low daily limit for transfers
Cyber policy expressly names deception by phone
Fraud limit per case known
Common mistakes
Trusting a familiar voice without calling back
Assuming the bank refunds every fraudulent transfer
Waiting to call the bank until the family has been reached
Buying a cyber policy without checking whether phone fraud is covered
Questions and answers
Frequently asked
Can I make the bank pay if I transferred the money myself?
A refund claim under section 675u BGB does not exist because the payment was authorised.
Only legal advice can clarify whether other claims exist in your case.
Does home contents insurance pay after a scam call?
As a rule no.
It covers burglary and robbery, not handing over money voluntarily after being deceived.
How much of my voice do scammers need?
For a usable copy often only a few minutes of recordings,
for example from videos or voice messages.
The more material is public, the better the fake.
Does the deepfake labelling duty help?
Not against scammers.
The duty in force since 2 August 2026 applies to honest users of AI.
Your protection is the code word and calling back.
What should I do right after the scam?
Call the bank immediately, inform the police,
secure evidence and notify your cyber insurer if you have one.
