Cyber insurance (Cyberversicherung) and identity theft belong together, because stolen access data often leads to damage to your account, orders or contracts. Knowing what cyber insurance can cover and which steps help in an emergency lets you act faster and more safely. This guide explains the key points.
Short answer: Cyber insurance is not compulsory for private individuals under law. Depending on the tariff, it covers costs after fraud, data or legal cases, often with restrictions. Against identity theft, precautions, blocking accounts and cards quickly and reporting the case to the police help most. Benefits and premiums depend on the tariff. Stand: October 2026.
The essentials at a glance
- Identity theft means that third parties misuse your data, for example for orders, contracts or transfers.
- Cyber insurance is a voluntary add-on. Its benefits vary widely and are often limited.
- For unauthorised payments after a lost payment instrument, you are generally liable only up to 50 euros, unless you were grossly negligent.
- In an emergency, speed matters: block accounts and cards, change passwords and report the incident.
- The best insurance is prevention: strong passwords, two-factor authentication and caution with messages.
What is identity theft?
Identity theft is when someone pretends to be you using your data. Typical cases are orders placed in your name, the conclusion of contracts, the opening of an account or the use of your online account. The data often comes from phishing emails, fake websites or data leaks at services you use.
What makes it dangerous is that the damage is often discovered late. A wrong bill or a reminder for a contract you never signed are common first signs. It is therefore worth checking bank statements and post carefully. Our guide Organise student finances: account, reserve and deadlines shows how to keep your accounts and deadlines in view.
How do you recognise a fraud attempt?
Phishing messages often look deceptively genuine. They rely on time pressure, threats or tempting offers to make you act hastily. Typical warning signs are unknown senders, links that do not match the supposed company, and requests to enter data or codes.
A simple rule helps: do not follow the link in the message. Instead, open the website or call the number you know yourself. Reputable banks and authorities do not ask for full passwords or transaction numbers by message. If in doubt, check with your bank before you approve anything.
What to do if it has happened?
In an emergency, a clear sequence helps. The recommendations of the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI) on consumer protection and passwords provide a good basis.
- Block the affected accounts and cards immediately with your bank or card provider.
- Change the passwords of all affected services and activate two-factor authentication wherever possible.
- File a report with the police and keep the reference number.
- Ask the relevant credit reference agencies (Auskunfteien) for information if contracts exist in your name.
- Report the damage to your insurer if you have cover, and document everything with date and time.
What does private cyber insurance cover?
Private cyber policies are not a uniform product group. The overview shows typical building blocks and what to look for.
| Building block | Typical benefit | What to look for |
|---|---|---|
| IT help costs | Support in cleaning up devices and accounts | Maximum sums and deductible |
| Financial loss through fraud | Partial reimbursement for online fraud | Sublimits, exclusions and proof requirements |
| Legal protection | Costs of disputes connected with cyber incidents | How it differs from legal protection in your existing contract |
| Data protection and crisis support | Advice on data loss or data leaks | Scope of the advice and waiting periods |
Many policies require you to observe certain security measures, such as up-to-date software or two-factor authentication. These duties are known as duties of the policyholder (Obliegenheiten). If they are breached, the insurer may reduce the benefit. Read that section carefully.
Who really needs cyber insurance?
For many students a separate cyber policy is not essential, because other protection mechanisms apply. For unauthorised payments, the bank bears much of the loss. The liability of the account holder for lost payment instruments is limited by law, unless they are grossly negligent. The rules are set out in § 675v BGB.
Worked example (assumption): After you lose your card, 300 euros are debited without authorisation. You did not keep the card with gross negligence and reported the loss without delay. Your own liability is then at most 50 euros, and the bank generally bears the rest. Whether this applies in your case depends on the circumstances.
Cyber insurance can make sense if you are self-employed, sell a lot online or manage sensitive data. Damage can then go beyond the loss in a single account, for example through business interruption or the costs of IT help. For everyday private life, good precautions are often enough.
Precautions that really help
The most effective protection starts before an incident. The following measures cost little and protect reliably.
- Passwords: Use a long, separate password for each service, ideally with a password manager.
- Two-factor authentication: Activate it for email, online banking and shopping accounts.
- Phishing: Check senders, links and payment requests before you click. Your bank never asks for your full password by message.
- Updates: Keep smartphone, computer and apps up to date.
- Data trails: Give personal data only where you really need to.
Frequently asked questions
Does my bank help if my account is misused?
Yes, in many cases. Report the incident immediately so that the bank can stop payments. The statutory liability rule protects you from unauthorised payments, as long as you report the loss without undue delay and there is no gross negligence.
What is the difference between cyber insurance and household contents insurance?
Household contents insurance protects items in your home, for example after a burglary or fire. Cyber insurance responds to digital damage such as fraud or misuse of data. Both cover different risks and do not replace each other.
Do I have to report phishing losses immediately?
Yes, as soon as possible. Delays can jeopardise reimbursement or weaken your claim against the bank. Keep all messages, links and payment records that you saw.
Does cyber insurance also apply abroad?
That depends on the tariff. Check the territorial scope and whether damage arising abroad is covered. This is particularly worth checking before trips or longer stays abroad.
What to do now
- Check whether your bank and card provider offer two-factor authentication and notifications, and activate them.
- Set up a password manager and change the passwords of your important accounts.
- Create an emergency plan with the phone number of your bank, the blocking hotline and the police emergency number.
- Then decide whether insurance cover fits your situation, and compare the conditions carefully.
What does this mean for your everyday life?
During your studies you manage many accounts: a current account, online shops, university portals, social networks and sometimes contracts for a flat or a mobile phone. Each of these is a possible point of attack. You do not need to do everything perfectly, but your most important accounts should be well protected.
A good starting point is a short inventory. Note which services are linked to your email address and where payment details are stored. Close accounts you no longer use and remove old payment methods. This noticeably reduces your exposure and takes only a few minutes.
Related reading
- Insurance for students: what you really need
- Organise student finances: account, reserve and deadlines
- Student insurance discounts: what is really worth it
Sources: § 675v BGB, Liability for unauthorised payments (retrieved October 2026), Federal Office for Information Security (retrieved October 2026).
Stand: October 2026. This guide is general information and not individual advice.
