Wirecard: How a Missing €1.9 Billion Passed Every Control

Wirecard is the most instructive corporate fraud of the last decade because none of the warning signs were hidden. Short sellers and journalists published detailed allegations for years and were investigated themselves rather than the company. Understanding why the system defended the fraud is more useful than understanding the fraud. This case study belongs to the software pillar of the Germany Company Stories hub.

How did the reported business model work?

On paper, a payments processor handling transactions for online merchants, with a substantial portion of the business conducted through third-party acquiring partners in jurisdictions where the company did not hold its own licences.

That third-party arrangement is where the problem sat. Revenue and cash from those partners were reported based on documentation supplied by the partners themselves, in jurisdictions where independent verification was difficult and where the counterparties were opaque.

The cash was said to be held in trustee accounts. A trustee structure interposes another party between the company and the bank, which means an auditor confirming the balance is confirming with the trustee rather than directly with the bank holding the money.

That single structural feature explains a great deal. Confirmation from an intermediary is not verification of existence, and the distinction is elementary in audit methodology.

Why did the regulator investigate the journalists?

Because the framework in place treated allegations against a listed company primarily as a potential market manipulation issue rather than as a potential accounting issue, and because supervision of financial reporting was delegated to a small private-sector body rather than held directly by the regulator.

The most striking action was a temporary ban on short selling the company's shares alongside a criminal complaint relating to market manipulation against journalists who had published allegations. The effect was to signal official confidence in the company at precisely the moment scepticism was warranted.

The institutional cause was structural rather than personal. A supervisor without direct authority over accounting enforcement, facing a listed national champion in a strategically favoured sector, defaulted to protecting market integrity as it understood it.

The subsequent reform gave the regulator direct powers over listed company financial reporting, ended the delegated arrangement and expanded investigative authority, which is the correct lesson drawn from the correct diagnosis.

What did the auditors miss and why?

Existence of cash, which is among the most basic assertions in any audit. The failure involved accepting confirmations routed through intermediaries rather than obtaining direct confirmation from the banks purportedly holding the funds.

There is also a professional scepticism dimension. Rapid growth, unusually high margins relative to peers, complex third-party arrangements in high-risk jurisdictions and repeated public allegations should collectively raise the assessed risk of material misstatement dramatically.

The economics of audit contribute. Audit is a competitive, price-pressured service, and the incremental cost of independent verification in multiple jurisdictions is real, while the probability of any individual client being fraudulent is low. Rational cost management across a portfolio produces underinvestment in exactly the cases that matter.

Regulatory response addressed this through tighter rotation requirements, restrictions on non-audit services to audit clients and increased liability, all of which raise the cost of a weak audit relative to a thorough one.

What should investors and boards actually do differently?

Verify cash independently and treat unexplained margin superiority as a question rather than a strength. Those two habits would have caught this case and most others resembling it.

For a board, the specific practice is to require the audit committee to see direct bank confirmations for material balances, particularly those held through intermediaries or in jurisdictions where the group has limited operational presence. That is a request any honest management can satisfy in days.

For an investor, the practical test is whether the reported economics are explicable. A payments business earning margins far above established competitors is either doing something genuinely novel, which should be identifiable, or reporting something that is not occurring.

For an employee or supplier, the signal is internal control behaviour: reluctance to document, unusual approval routes, entities without clear commercial purpose and pressure on those who ask questions. Every large fraud generates these signals internally long before they become public.

What are the wider lessons for German capital markets?

That national champion narratives are a supervisory risk. The company was widely presented as evidence that Germany could produce a globally competitive technology business, and that narrative created institutional reluctance to entertain the possibility of fraud.

The structural reforms that followed, giving the supervisor direct authority over financial reporting and strengthening audit rules, addressed the mechanics correctly. The cultural question, whether a supervisor would today act more decisively against a politically favoured company, is not resolved by legislation.

The episode also damaged something valuable. It reinforced a perception that German listed technology companies carry governance risk, which raises the cost of capital for every honest company in the sector, as the BioNTech capital markets analysis discusses from another angle.

The constructive reading is that the reforms were substantial and the detection mechanisms that eventually worked, investigative journalism and short sellers, are now better protected. Both are uncomfortable participants in a market and both are necessary.

What should an audit committee ask about cash?

Four specific questions, none of which require technical accounting knowledge. Where is each material cash balance physically held. Which institution holds it. Has the auditor obtained confirmation directly from that institution rather than through any intermediary. And can management demonstrate an unrestricted transfer of a material amount on request.

The last is the strongest test and the least used. Cash that exists can be moved; cash that cannot be moved on demand is either restricted, which should be disclosed, or absent.

The same logic extends to other assets prone to fabrication: receivables from related or opaque counterparties, inventory in third-party warehouses and revenue recognised from partners who also supply the supporting documentation.

The practical governance point is that these questions cost almost nothing to ask and are extremely awkward to answer falsely. A board that asks them routinely creates a control that no amount of documentation forgery easily defeats.

What is the role of short sellers in detection?

They are the only market participants with a direct financial incentive to find fraud, and their research is consequently more rigorous than most sell-side analysis, which faces the opposite incentive.

The objection is that short sellers profit from the decline they help cause and may exaggerate. Both are true and neither means the underlying analysis is wrong; the appropriate response is to evaluate the evidence rather than the motive.

Regulatory responses that restrict short selling in a specific stock during a controversy are therefore counterproductive. They remove the participants with the strongest incentive to verify claims and signal official confidence that may be unwarranted.

The constructive framing is that short sellers, investigative journalists and whistleblowers form a detection layer outside the formal control system, and the formal system should treat their output as an input to supervision rather than as an attack to be repelled.

What happened to the wider payments sector afterwards?

Heightened scrutiny and a repricing of governance risk. Payments businesses with complex partner structures, opaque geographic revenue or unusual margins faced considerably harder questions from investors, auditors and regulators.

That is a healthy correction and it carried a cost for honest operators, who had to spend more on assurance and disclosure to distinguish themselves. Governance failure by one participant raises the cost of capital for the entire sector.

The durable structural change is supervisory. Financial reporting enforcement moved to the regulator directly, and payment institution licensing and oversight tightened, which raises the barrier to building a large payments business quickly and is very likely the correct trade.

How do you evaluate a high-growth company in an opaque market?

By triangulating reported figures against independent sources. If a company reports processing volumes, those volumes should be broadly consistent with the merchant base it claims, the payment networks it uses and the industry data available for those geographies.

When reported economics cannot be reconciled with any external reference point, that is the finding. It does not prove fraud, and it does mean the investor is relying entirely on management representation, which should be priced accordingly.

The practical discipline is to write down, before investing, what evidence would falsify the thesis. Investors who did this in this case identified the cash confirmation issue early; those who did not treated each new allegation as noise.

What signals should employees watch for?

Process irregularity rather than financial detail. Entities with unclear purpose, transactions routed through unusual approval paths, reluctance to produce documentation for routine requests, and pressure on staff who raise questions are all observable without access to the accounts.

Whistleblower protection has strengthened considerably in Europe, with mandatory internal reporting channels for larger organisations and protection against retaliation. Those channels only work if reports are investigated independently of the people they concern.

Why did index inclusion make things worse?

Because it converted a contested stock into a mandatory holding. Once a company enters a major index, every fund tracking that index must buy it in proportion to its weight, irrespective of any view on the accounts.

That has two effects. It supplies a large base of shareholders who conduct no analysis, and it lends institutional legitimacy that discourages remaining sceptics, since inclusion is widely misread as a quality assessment rather than a mechanical consequence of market capitalisation and liquidity.

Index providers have since given more attention to governance criteria and to accelerated removal procedures, though the fundamental tension remains: an index tracks the market, and the market can be wrong for years.

Frequently Asked Questions