7 phone scams hitting Estonia in 2026

Phone scams are the most common and most expensive cyber-crime in Estonia in 2026. According to the police and the Estonian Banking Association, people in Estonia lost more than €6.5 million to social-engineering scams in the back half of 2025 alone. The figures for the first quarter of 2026 are already higher than for the whole first half of last year.

Below are seven cases from this year that we have direct information on from the police and CERT-EE. Each one comes with a 30-second rule: the sign that tells you, within the first half-minute of the call, that you are talking to a scammer.

Quick answer

The most common phone scam in Estonia in 2026 is a call "from the bank" about a security risk, where the caller asks you to authenticate with Smart-ID. Banks never ask you to confirm anything with Smart-ID over the phone. If you hear "please authenticate", hang up. Then call the bank yourself, and only on its official number (Swedbank: 6 310 310; LHV: 6 800 400; SEB: 6 655 100).

Case 1: "Calling from Swedbank", €47,000 lost

In March 2026 a pensioner in Tallinn got a call from someone claiming to be from Swedbank: "There's a technical issue, please confirm via Smart-ID." Twelve minutes later, €47,000 had gone from her account.

30-second rule: if you didn't call the bank, the bank will never ask you to confirm a security action. The bank checks who you are when you contact it yourself.

Case 2: "Captain Tamm from the police" and an AI voice

In February 2026 a mother in Tartu got a call from "Captain Tamm from the police": "Your son has been in a car accident, and we need an €8,000 fine paid immediately." The voice sounded exactly like her son. It was an AI clone built from a 30-second TikTok video.

30-second rule: the police never ask for money over the phone. If someone wants a transfer right now, it is always a scam. Hang up and call your child yourself.

Case 3: The tax office and the "unpaid tax"

"This is the Tax and Customs Board. You have €1,247 in unpaid tax. If you don't pay within 24 hours, we'll take you to court."

30-second rule: the real Estonian Tax and Customs Board sends all official notices through the e-MTA portal. Go to emta.ee yourself and log in there, not through a link in an email or message.

Case 4: "Microsoft tech support"

An old trick that still works. The caller says your computer has a virus and asks you to install "remote management software". Fifteen minutes later, your bank account is empty.

30-second rule: Microsoft never calls you first. If someone rings saying they're tech support, just hang up.

Case 5: "Your son is in trouble", the WhatsApp version

In Estonia this one often starts with a WhatsApp message: "Mum, my phone fell in water, this is my new number. I'll send you an invoice, can you pay it?"

30-second rule: treat any "my phone has changed" message from a new number with suspicion. Call your child back on their old number.

Case 6: A crypto "investment" from a "famous local entrepreneur"

Someone posing as a well-known Estonian entrepreneur offers 30 % annual returns on LinkedIn or Facebook. Real business leaders don't raise money through social-media ads. If you see famous Estonian names on an investment ad, it's always fake.

Case 7: "Your parcel is waiting, pay €1.99"

A fake text in the name of Omniva, DPD or DHL asks you to pay a €1.99 "customs fee". You open the link, enter your card details, and within the hour €800–€4,000 is gone from your account.

30-second rule: real couriers never ask for payment by email or text. Check your parcel on the courier's own website or app, opened yourself, not through a link.

What you get from the 2-academic-hour course

CyberSafe for Adults lasts 90 minutes. We listen to real recorded scam calls and practise what to do. Afterwards you'll recognise these scenarios and be able to pass the same rules on to your family.

Read next

• FAQ
• Upcoming groups: pick a course date
• CyberSafe for Children: our course for 9–14-year-olds