The evolution of cyber fraud in Estonia, 2017–2026

ERR describes the years before the surge as ones in which annual fraud losses "ranged between five and ten million euros," without giving a source for the range. The Police and Border Guard Board (PPA) recorded nearly eight million euros lost to scams in 2023, roughly 22,000 euros a day, and 16 million euros in 2024. By the police count, the surge began in 2024.

In 2025 losses reached 29 million euros. RIA's Cyber Security in Estonia 2026 yearbook calls that "three times more than the year before"; PPA calls it nearly double its 2024 figure of 16 million. Both 29-million figures are the same PPA number: RIA's yearbook says its fraud cases are drawn from reports by the Police and Border Guard Board and RIA, and PPA's total already includes fraud aimed at businesses. They differ only on the baseline. RIA's "three times" implies about 9.7 million euros for 2024, while PPA's own 2024 figure is 16 million, and neither source explains the gap. Eesti Pank, which tracks bank-reported payment fraud separately, put 2024 at 13.5 million euros. Anyone quoting a single "Estonian fraud number" should say which authority they mean.

PPA's 2025 breakdown counts 3,685 victims. Phone scams were the largest category, about 11.5 million euros of the 29 million (PPA, 19 January 2026), followed by investment fraud (6.3 million), fraud aimed at businesses (2.7 million) and sales fraud (1.7 million). Individuals are the most frequent victims; businesses take the largest single losses.

Estonian is the mother tongue of about 900,000 people, 67 percent of the population at the 2021 census. For years that smallness was the market's best defense. Phishing aimed at Estonia was mostly Russian-language, and the Estonian that appeared in scam material was visibly translated: wrong cases, wrong word order, tells a native speaker caught instantly.

The picture changed in 2017 with the arrival of Smart-ID as a mass authentication method. Large-scale phishing in Estonia began in 2019, when banks phased out password cards and moved customers to Smart-ID, and security researcher Arnis Paršovs of the University of Tartu has argued that the change traded one problem for another: a password card is clunky, but a scammer on the phone had to explicitly ask a victim for the password, which raised suspicion. With Smart-ID, the scammer only needs to talk the victim into approving something. The authentication rail itself was not the weakness. The consent step became the attack surface, and the full technical analysis is in my separate report on Smart-ID.

For a few years the language barrier still held. The scams that worked were Russian-language phone fraud, and the vishing that did reach Estonian speakers came with detectable accents. The barrier was doing real work, and nobody had to pay to maintain it.

SEB's Baltic fraud statistics for the first half of 2024 are the clearest single document in this story. In Estonia, Estonian-speaking clients were 65 percent of fraud incidents. Russian speakers were over 30 percent. Nearly half of all losses were borne by Estonian-speaking clients, with Russian-speaking clients contributing an equal share.

In early 2024 the barrier was still working. SEB found that phone fraud in the Baltics was "mainly conducted in Russian" and that a significant part of the population in Estonia and Latvia speaks Russian as a native language or at a conversational level. SEB's security chief Katlin Kukk put it this way: contrary to the belief that non-native speakers are the easier targets, most victims are native speakers of their own language who can also converse in Russian. Lithuania, where fewer people speak Russian, had the lowest phone-fraud losses. Estonian-speaking victims were being reached in Russian.

The break came at the end of that year. Hannes Kelt, head of the North Prefecture's cyber and economic crime unit, told ERR in April 2026 that from late 2024 the calls were being made on a mass scale in Estonian as well, which meant that people who speak Estonian had started working in call centers in Ukraine and other countries. PPA's Jaagup Toompuu gave the same reason for the 2025 jump: the calls are no longer made only in Russian, because Estonian speakers have been recruited to target the whole population.

The SEB data set also shows who the victims are. Most fraud cases fall in the 36-50 age group, the 51-64 group carries the highest financial losses at over 30 percent of the identified total, most victims are women, and men lose more money, 53 percent of total losses. The average loss per victim across the Baltics was about 3,000 euros. That is the working population: people with bank accounts who answer unknown calls.

Phone fraud overtook email phishing as the dominant vector during this period. SEB Latvia put vishing at nearly two-thirds of identified fraud damages in Latvia, and first in Estonia. RIA's 2026 yearbook describes the surge in phone scams and notes that people lose tens of thousands of euros a day to them.

The methodology industrialized into a standard two-call sequence. The first call impersonates the Health Insurance Fund (Tervisekassa) with a hook: unused benefits, a refund, a cheaper specialist-visit rate if you "confirm your details." Confirming means entering a Smart-ID PIN1. The second call comes from someone posing as the European Central Bank, your own bank, or the police, claiming the first call was the scam and your money must be "rescued" immediately. The second call can last for hours and is engineered to extract PIN2, the code that authorizes payments and loans.

The sequence is well documented because it keeps working. RIA describes a non-profit that lost over 120,000 euros to a three-call variant built on a fake electricity switchboard appointment: the victim confirmed the appointment with Smart-ID PIN1, then followed instructions from callers posing as police and bank staff, entering PIN1 and PIN2 repeatedly. ERR reports the same pattern in the largest phone-scam criminal case in recent years, the same case whose courier network is described below: 59 victims defrauded of a combined 600,000 euros over about six months from late 2024, with losses per victim from a few hundred euros to 117,000. Elari Haugas, head of the North Prefecture serious crime unit, spoke to ERR about the recruitment and the sentences in that case.

The sophistication is mostly organizational. ERR and Äripäev, working with the Pealtnägija investigation program, ran an undercover recruitment experiment in early 2026 that documents the industry in detail.

The jobs are advertised openly on Telegram, in Russian. A position in Uzhhorod, western Ukraine, a city about the size of Tartu, offers Estonian or Lithuanian speakers free flights, free housing, free meals, and a salary of 1,600 euros plus 10 percent of each transaction. The ad copy claims salaries can reach 5,000 euros a week. The recruiter in the undercover calls confirmed the terms directly: no contract, weekly settlements, "the conditions are the same for everyone." If you speak Estonian or Lithuanian the job is in Uzhhorod; if you speak German, Odesa. Applicants' Estonian is verified at B2 level. The recruiter claimed seven Estonian-speaking employees already worked there.

The domestic end is a courier economy. A court case covered by ERR involved five Tallinn-based native Russian speakers, barely twenty years old, who collected bank cards from victims across the country, from Pärnu to Narva. Coordination ran over Telegram with disappearing messages. Couriers kept 5 to 10 percent of each withdrawal. One courier, Darja, described the largest single transfer at around 150,000 euros; the court record caps individual victim losses at 117,000, and the two figures have not been reconciled. The group received suspended sentences and was ordered to repay the full 600,000 euros, a sum the couriers themselves do not expect to ever be recovered in full. The organizers in that case were not identified.

The infrastructure layer is international. In mid-October 2025, an international police operation dismantled a network that sold phone numbers registered in various countries and provided anonymous accounts to fraud perpetrators. Latvian police arrested five suspects including the alleged leader and seized 40,000 active SIM cards. The network enabled losses exceeding 5 million euros across at least 3,200 victims in Estonia, Latvia, and Austria. This is the SIM box problem made visible at scale: local-looking numbers, no local presence.

Phone scams hit individuals most often. RIA's yearbook says that "by loss amount, business-related fraud causes the most significant financial damage." In aggregate the police count looks different: PPA puts fraud aimed at businesses at 2.7 million euros in 2025, against 11.5 million for phone scams and 6.3 million for investment fraud. Business cases are rarer, and single cases are the largest.

The case RIA leads with is Hekotek, a machinery manufacturer. In August 2025 it became public that fraudsters had moved 1.6 million euros out of the company in 52 transfers within two hours. The chain: a call to the chief financial officer posing as the Health Insurance Fund, a new Smart-ID account created in the CFO's name with information from that call, further calls posing as bank staff and police, and remote access to the CFO's computer via AnyDesk. Part of the money was recovered; final losses still exceed one million euros, and the company is in litigation with its former CFO over responsibility.

The rest of the yearbook's case list reads like a taxonomy of preventable failure. An invoice scam in November 2025: a company received an email from a long-standing supplier stating its bank details had changed, paid an approximately 50,000-euro invoice, and the money was gone. A CEO-fraud case from 2022 at the Estonian Traditional Music Centre, which organizes the Viljandi folk festival, became public in November 2025: three transfers totaling over 53,000 euros to foreign accounts before discovery. A gift-card variant cost one company about 550 euros. The countermeasures RIA recommends are mundane and mostly free: two-person approval rules, SPF/DKIM/DMARC, verifying changed bank details by calling a known number.

A large 2026 case followed the Hekotek script. In May 2026 the Estonian Artists' Association lost about 700,000 euros, mostly Ministry of Culture funding earmarked for artists' salaries. Police said the fraudsters first contacted the association's chief accountant on 7 May, posing as an employee of Omniva's delivery center with a registered letter to hand over. Smart-ID PINs and calls from people posing as officials followed. Police later detained two suspects.

The final stage is the one the headlines reach for first, and the chronology matters. As of June 2025, the native-level Estonian calls were being made by real people. Taavi Kotka, former Estonian government CTO, told ERR in June 2025 that he had received a native-fluency Tervisekassa call himself, filmed it, and concluded the caller was definitely a real Estonian: "I haven't yet seen AI making calls in such good Estonian as yet." His forecast was that AI would close the gap "in the not too distant future," and that the economics already favor the scammers: "You can make and send hundreds of thousands of such calls to us in a few hours."

Where AI is already operational is in text and video. The 2026 yearbook describes a deepfake video of President Alar Karis that circulated in 2025, promoting a fake government investment platform that guaranteed 870 euros a week, and used the president's authority to build credibility. Investment fraud was the other growth line: RIA reports that people in Estonia lost nearly six million euros to investment scams in 2025 alone. The yearbook's individual cases include a 57-year-old man who transferred 504,400 euros from his company's accounts to a fake trading platform over six months under an adviser's guidance, and a 68-year-old woman who lost nearly 15,000 euros to a broker who disappeared with her deposits.

Across these cases, AI lowered the cost of the parts of the fraud economy that were still expensive. RIA's yearbook already describes fluent-Estonian scams as the norm, and 2025 produced a deepfake of the president. Voice is the input still made by humans. In May 2026 police told ERR it is still difficult to confirm how often AI voices are used in scam calls, and TalTech's Tanel Alumäe said synthetic Estonian voices are not yet as convincing as English ones. Both expect that to change; Kotka's forecast is the same.

ERR, citing the Police and Border Guard Board, reported on 13 August 2026 that police received 1,816 reports of phone and internet fraud in the first six months of 2026, and that people in Estonia lost 13.2 million euros. This is a news report citing PPA, not a PPA release. According to PPA's Jaagup Toompuu, more than half of the cases were multi-stage phone scams: a call from a supposed service provider hands the victim on to a fake bank security department, and then to someone posing as a police officer. Investment fraud now runs on fake news pages featuring well-known Estonians, among them Arvo Pärt and Ott Tänak.

The banks have started to change the approval step. SK ID Solutions made Smart-ID+ available to integrators on 26 June 2025. With it, the user starts the login by scanning a QR code shown on the screen, so a caller can no longer simply trigger a request for the victim to approve. Bigbank became the first Estonian bank to go live with it on 11 June 2026, LHV followed from 16 June, and SEB and Swedbank say they will introduce it later in 2026. Smart-ID+ makes this kind of vishing much harder. It does not rule it out: LHV said in January 2026 that QR flows stay vulnerable when the fraudster is in live contact with the victim.

Enforcement has also reached an organizer. In April 2026 Harju County Court convicted Artur Yermolayev, the Ukrainian leader of a criminal organization specializing in phone fraud, under a plea bargain. He received a five-year sentence, most of it suspended, a deportation order and a ten-year Schengen entry ban; the court took into account his agreement to pay 8.5 million euros to the Estonian state. Telecom operators work earlier in the chain: Telia blocked about 24 million scam calls in 2025, and the three large operators about 35 million together (Eesti Pank seminar, March 2026).

Five conclusions follow from the sources.

The language barrier was a security control. Estonia was protected for years by the fact that fluent Estonian was scarce. That protection was real, invisible, and free, and its collapse is the single most important event in this story. Everything else is a consequence.

The collapse was structural. Nothing in the sources suggests Estonians became more gullible; the supply chain changed, first with recruited native speakers, then with AI. Campaigns and warnings ran for the entire year of 2025, as RIA notes, and losses still rose to 29 million euros, nearly double by PPA's count. Awareness campaigns cannot replace a barrier that has gone.

The banking system chose the attack surface. Paršovs argued in January 2026 that the technical options for protecting Smart-ID approval flows had far outpaced deployment. The fixes existed long before banks deployed them. Smart-ID+, which makes the user start the operation by scanning a QR code, finally went live at Bigbank and LHV in June 2026, with SEB and Swedbank promising it later in the year. The protocol analysis is in my Smart-ID report; the fraud data up to mid-2026 is its cost column.

Vishing is the vector that matters. Email phishing is a mass-market lottery. Phone fraud is a two-hour interactive process that harvests both PINs and, in the courier cases, the physical card. It is higher-touch, higher-yield, and it is what the call centers are staffed for. Defenses that focus on email miss the part of the pipeline that is actually industrialized.

The next stage is predictable. AI voice synthesis in fluent Estonian is the obvious completion of the trajectory, Kotka's forecast, and nothing in the 2025 data argues against it. The defense that works against it is the same one that works against the current wave: make the approval step itself phishing-resistant, move verification off the phone call, and treat the user's PIN as a secret that no legitimate party ever asks for.