On 5 November 2026, ERR News reported that Estonian banks now have the legal right to temporarily suspend suspicious payments, talk to the police and share information with other financial institutions, and that they intend to use it. People in Estonia lost nearly €30 million to scammers last year, only a few percent of victims got money back, and cash withdrawals are rising in 2026. A planned Smart-ID measure to block PIN entry during phone calls was dropped because customers prefer convenience.
The report does not mention X-Road, but the story is about the same thing X-Road is: how a digital state authenticates people and moves data between institutions. That is the useful lens here.
The case for the new powers
The strongest argument for the law is hard to dismiss. Estonia's identity stack is among the best in the world, and fraudsters still beat it. The State Information System Authority (RIA) says people in Estonia lost 29 million euros to fraudsters in 2025, three times more than the year before. Its page describes victims being talked into entering their Smart-ID or Mobile-ID PIN during a call. Eesti Pank's fraud statistics show how little protection victims had. In 2024, clients bore the loss in 98% of credit transfer frauds. And 89% of those transfers were authenticated by the victim or by the scammer. A bank that can see a pattern but is not allowed to act on it is a poor safeguard, so a legal right to pause a payment, alert the police and warn other banks closes a real gap.
ERR's February 2026 reporting on the Ministry of Finance bill said a bank could block a transfer even after the customer confirmed it with their PIN2, and that the EU plans to make freezing suspicious payments mandatory from 2028. Estonia is moving ahead of that schedule.
Where the design is weak
The law adds a safety net after the transaction request. It does not change the step the scammers exploit. Every successful scam described by RIA and Eesti Pank has the same shape: a legitimate credential, entered by a real person who has been deceived. The state's own response shows the tension. In May 2026 ERR reported plans to slow unusually large transfers and block Smart-ID PIN entry during phone calls. According to the hook report, that call-blocking measure has now been dropped because customers prefer convenience.
That is a revealed preference, and policymakers should take it seriously. A control people reject gets routed around, or never ships. The better evidence comes from a design change that kept convenience. Smart-ID+ requires users to start the login themselves by scanning a QR code in the app. SK ID Solutions told ERR in June that this effectively eliminated the tactic of tricking users into approving logins during a call. The key change was reversing who initiates the login. The scammer can no longer be the one who starts it, and the user does not need to do any extra work. Bigbank was first to adopt it, and Swedbank and SEB had planned to follow later in 2026.
What X-Road actually teaches
X-Road is the data-exchange layer between Estonian state systems. RIA describes its features as authentication, multi-level authorisation, processing of logs, and encrypted and signed data traffic, with the data owner keeping control throughout. e-Estonia says all outgoing data is digitally signed and encrypted, and all incoming data is authenticated and logged. It reports 2.2 billion transactions a year, though it gives no date for that figure.
Three design principles carry over to anti-fraud policy, whether or not the banking sector ever runs on X-Road itself. I have not seen any statement that the new bank information-sharing channels will use it, so this is an analogy and not a description of the law.
- Every exchange is attributable. Because data flows are signed and logged, a later dispute can be examined. Fraud information sharing between banks and police needs the same audit trail, so a wrongly frozen payment can be traced to a decision and a decision-maker.
- Data owners stay in control. The layer moves data on the basis of agreements, without pooling it in one database. A bank-to-bank fraud signal system should be built the same way, with narrow, purpose-limited exchanges and no central blacklist that can be abused or breached.
- Security is designed into the protocol. X-Road does not depend on users noticing a suspicious prompt. The scam-resistant version of consumer authentication works the same way, as Smart-ID+ shows.
A proportionate path
The pro-innovation reading is not that Estonia has been too trusting of digital identity. The gap is on the consumer side, where one human step still undoes the protections. A proportionate response would have four parts.
- Keep the freeze power narrow. Banks should be able to pause, not permanently block, with a short, defined window, a duty to tell the customer why, and a quick appeal route. Over-blocking has real costs for small businesses and for people making legitimate large payments.
- Push Smart-ID+ to full coverage. It is the one measure with evidence of effect, and it did not force a trade-off against convenience.
- Make the information-sharing auditable. Logged, purpose-bound exchanges between banks and the police, in the X-Road tradition, protect both victims and wrongly flagged customers.
- Measure outcomes publicly. The few percent recovery rate cited by ERR should be tracked by bank and published. If freeze powers raise it, that is the evidence the law is working. If cash withdrawals keep rising instead, scammers are simply switching to couriers and ATMs. Eesti Pank has already recorded cash-courier scams growing from about €50,000 in 2023 to about €900,000 in 2024.
Estonia has the strongest digital state in Europe, and it has handled a cyber threat of a different kind well. Fraud is the same sort of problem, a trust problem inside a well-built system. Giving banks new powers is a sensible step. Making the authentication step hard to abuse without making it harder to use is what will cut the losses.