# Crime and fidelity insurance in Germany: when fraud comes from inside or by phone

> Most business policies cover accidents and mistakes, not intent. If a bookkeeper siphons money off for years, or a member of staff wires a large sum abroad after a fake email from the managing director, neither the general liability policy nor, in many cases, the cyber policy pays. In Germany this gap is filled by the Vertrauensschadenversicherung, known internationally as crime or fidelity insurance. It reimburses your own financial loss from deliberate acts by employees and, depending on the policy, by outside fraudsters.

Quelle/Source: https://www.nammert.com/en/insurance-broker-crime-fidelity.php  
Updated: 2026-11-04

## Do I need crime cover if I already have cyber insurance?

Often yes. Cyber insurance is built for attacks on your IT: forensics, data recovery, business interruption, data protection. When an employee makes a payment themselves because they were deceived, no system was hacked, and many cyber policies then pay nothing or only a small sublimit. Theft or embezzlement by your own staff is usually not covered by cyber at all. Read both wordings side by side and close the gap deliberately.

## At a glance

- **Compulsory?:** No, but some clients and banks ask about it
- **Insured perpetrators:** your own staff, and outside third parties depending on the policy
- **Typical acts:** embezzlement, fraud, theft, forgery, fake president scams
- **What is paid:** your own financial loss plus the cost of establishing it
- **Boundary:** cyber pays for the attack on IT, crime pays for the act

## Three kinds of perpetrator, one policy

The cover started with insiders: employees who use access to tills, stock or bank accounts. Such cases often run undetected for a long time because the people involved know the processes and how to avoid the controls. Modern policies also insure outsiders who break into payment systems, and fraudsters who pose as the managing director, a supplier or the bank.

The policy defines who counts as a trusted person. Besides employees this often includes trainees, agency workers, freelancers and directors. Shareholders with a controlling stake are frequently excluded, because a company cannot insure itself against itself.

## Fake president and social engineering

In a fake president scam, someone posing as senior management makes contact by email, phone or, increasingly, with a cloned voice and demands an urgent, confidential transfer. A close relative is invoice fraud: a supposed supplier announces new bank details and the next genuine invoice is paid to the fraudster.

For the insurer the distinction matters: no system was breached, an employee made an authorised payment. Good crime policies name this kind of deception as an insured event. Check the amount, because social engineering usually has its own sublimit well below the main sum insured.

## Where cyber ends and crime begins

A cyber policy pays for what an attack on your technology costs: incident response, forensics, restoration, business interruption and third party claims after a data breach. Crime insurance pays for the financial loss from the act itself, meaning the money that left the account or the goods that were taken.

The two overlap in payment fraud. Some cyber policies offer a small sublimit for it, some crime policies include hacking of payment systems. You should not pay twice, but neither should a loss fall between the two contracts.

## When a loss is covered

Fidelity losses are often found years after the first act. Many German policies therefore cover losses discovered during the policy period and include earlier acts through agreed retroactive cover, provided you did not know about them. The period for reporting after the policy ends matters too.

After a loss, insurers almost always require a criminal complaint and your cooperation in the investigation. Good policies include the cost of forensic accountants who quantify the loss. Once the insurer pays, your claims against the perpetrator pass to it.

## What is covered

- Embezzlement, misappropriation and theft by your own employees
- Fraud and forgery to the detriment of the company
- Fake president, invoice fraud and other social engineering, depending on the policy
- Manipulation of payments and accounts by outside perpetrators
- Losses at client premises caused deliberately by your staff, as an add-on
- Cost of experts who establish the amount of the loss
- Cost of legal action against the perpetrator, depending on the policy
- Acts before inception through agreed retroactive cover

## What is not covered

- Acts by controlling shareholders, depending on the policy
- Acts already known before inception
- Lost profit and indirect losses unless included
- IT restoration after an attack, which belongs in the cyber policy
- The agreed deductible
- Amounts above the social engineering sublimit

## Who needs it

- Businesses where a few people control accounts, cash and payments
- Companies with international business and frequent payments to new recipients
- Service providers whose staff work at client premises, such as cleaning, care or security
- Property managers, financial intermediaries and anyone holding client money
- Retail and warehousing with easily resold goods
- Clubs and associations with volunteer treasurers

## Who does not need it

- Sole traders without staff who approve every payment themselves
- Businesses without cash or client money whose cyber policy already covers payment fraud with an adequate limit

## What it costs

The premium depends on the number of trusted persons, turnover, sector and the sum insured. Internal controls weigh heavily: dual authorisation, separate roles in payments and call backs when bank details change visibly reduce the risk. There are no independent published price comparisons, so we do not quote amounts.

**What drives the premium:**

- Number of employees and trusted persons
- Turnover and size of typical payments
- Sector, cash holdings and access to client money
- Internal payment controls
- Sum insured and social engineering sublimit
- Deductible and loss history

_The premium is set only after the insurer has reviewed its proposal form, which focuses on your payment processes._

## The policy levels on the market

- **Compact cover for small businesses:** Flat sum insured, losses caused by your own staff, social engineering with a small sublimit. Short proposal form.
- **Mid-market policy:** Higher limits, outside perpetrators and fake president scams expressly included, retroactive cover and expert costs. The right fit for most companies with their own accounts department.
- **Bespoke crime programme:** For groups with large payment flows: worldwide scope, subsidiaries, high limits, coordinated with the cyber and D&O programme.

## How to recognise a good policy

| Criterion | Minimum standard | Strong policy | Why it matters |
| --- | --- | --- | --- |
| Outside perpetrators | own staff only | third parties without staff involvement | Most payment fraudsters are outside the company. |
| Social engineering | excluded or small sublimit | expressly covered with a meaningful limit | Fake president and invoice fraud hit well run companies too. |
| Retroactive cover | none | several years before inception | Embezzlement usually runs for a long time before it is noticed. |
| Discovery period after expiry | short | long enough | Some losses only surface after a change of insurer. |
| Who counts as trusted person | employees only | also agency workers, freelancers and directors | Perpetrators are not always on the payroll. |
| Client losses | not covered | included as add-on | If your staff steal at a client, liability insurance does not pay for intentional acts. |
| Expert costs | not covered | included | The loss often has to be reconstructed from the books. |

## Insurers on the German market

A well known provider of this cover is Allianz Trade. In Germany it operates as a branch of the Belgian company Euler Hermes SA and is therefore not on the BaFin list of insurers under German federal supervision; that is why it is missing below. The same applies to other international crime insurers. Listed are insurers under federal supervision licensed for miscellaneous financial loss. R+V and Zurich offer their own fidelity product; whether the others will write a given risk, we check case by case. This is a market overview, not a statement about who we work with.

- **R+V**: insurer of the German cooperative banks, fidelity cover for small and large businesses
- **Zurich**: Zurich group company, fidelity insurance for business clients
- **HDI Global**: industrial insurer of the Talanx group, based in Hanover
- **Allianz Commercial**: industrial and specialty insurer of the Allianz group, based in Munich
- **Markel**: Munich based specialty insurer, business clients through brokers

84 insurers supervised by BaFin, the German regulator, are licensed for this class of insurance. (Sonstige finanzielle Verluste). Source: BaFin company database, 2026-09-18; EU insurers without a German office excluded.

## Typical claims and who pays

- **Bookkeeper skims money for years** (often five or six figures): The core case for this cover. What matters is that the years before inception are included through retroactive cover.
- **Fake boss orders urgent transfer** (the amount transferred): Basic policies often cover social engineering only up to a small sublimit, strong ones with a meaningful amount.
- **Supplier sends new bank details** (one or more genuine invoices): Invoice fraud via fake supplier emails is paid only by policies that expressly include outside deception.
- **Cleaner steals at a client site** (value of the loot plus the client relationship): Client losses are a separate add-on. Liability insurance does not pay for intentional acts.
- **Majority owner drains the account** (the money taken): Whoever controls the company is not an insured trusted person under many policies. Only control rights in the articles help here.
- **Ransomware locks the servers** (restoration and downtime): This is a cyber claim. If attackers also divert payments, the crime policy can reimburse the money lost.

## Myth or truth

- „General liability insurance pays for theft by your own staff." ✘ Wrong. Liability covers third party claims, not your own loss, and intentional acts are excluded anyway.
- „Cyber insurance covers every fake president case." ✘ No. If an employee made the payment, no system was attacked. Many cyber policies then pay nothing or only a small sublimit.
- „Fake CEO fraud only hits large corporations." ✘ Wrong. Fraudsters target businesses with short decision paths and few controls, which includes many small and mid-sized companies.
- „Dual authorisation for payments improves your terms." ✔ Yes. Insurers ask about payment controls, and businesses that can show them tend to get higher limits and lower premiums.
- „Insurers usually require a criminal complaint after a loss." ✔ True. Reporting is a standard policy condition, and once it has paid, the insurer can pursue the perpetrator itself.

## Common mistakes

- Assuming general liability pays for theft by your own staff
- Relying on the cyber policy without reading its payment fraud clause
- Looking only at the sum insured and missing the social engineering sublimit
- Losing retroactive cover when switching insurer
- Handling a suspicion internally instead of involving the insurer early
- Accepting a supplier's new bank details without calling back on a known number

## FAQ

### What is a fidelity loss?

A financial loss caused deliberately by someone the company trusts, for example through embezzlement, misappropriation or fraud. Modern policies also include outsiders who pose as a trusted person.

### Why does liability insurance not pay?

Because it covers third party claims against you, not your own loss. Intentional acts are excluded from liability cover in any case.

### Is fake president fraud covered?

In good policies yes, usually under social engineering or deception. Many set a separate limit for it. Ask how high it is and whether fake supplier emails are included.

### Do I have to report it to the police?

Almost always. Insurers require a criminal complaint and your support in the investigation. Agree the timing with the insurer so evidence is preserved.

### What if the acts go back years?

Then retroactive cover decides. Many policies cover acts committed before inception but discovered during the policy period, provided you did not know about them.

### Are losses at my clients covered?

Only if the policy includes them. For cleaning, care or security firms this add-on matters because some clients require it.

### Is the managing director a trusted person?

Employed directors usually are. Controlling shareholders are excluded in many policies, so family businesses should read the wording closely.

### What does the insurer ask before quoting?

Turnover, headcount and above all your controls: who approves payments, whether dual authorisation applies and how changed bank details are checked. Better controls mean better terms.

### Why use a broker?

Because policies differ widely on who counts as a perpetrator, the social engineering sublimit, retroactive cover and how they fit with cyber. We put both contracts side by side, collect quotes and support you after a loss. The insurer pays our commission.

## Legal basis and sources

- [Insurance Contract Act (VVG, German)](https://www.gesetze-im-internet.de/vvg_2008/)
- [BaFin company database (licensed insurers)](https://portal.mvp.bafin.de/database/InstInfo/)

## Request quotes

We obtain quotes and come back with a comparison, free of charge. You can write in English. https://www.nammert.com/en/insurance-broker-crime-fidelity.php#anfrage

---

Your broker: Norman Nammert, trading as NAMMERT. Insurance broker licensed under section 34d(1) of the German Trade Regulation Act. Broker register no. D-C08Q-TOSD4-37. NAMMERT Assekuradeur GmbH is a separate company. It does not arrange your contract.

NAMMERT Assekuradeur GmbH, Karl-Marx-Straße 4, 15711 Königs Wusterhausen, +49 3375 29 12 77, info@nammert.com. Wikidata: Q141141479.