Wirecard's house tumbles

Dan McCrum, an investigative reporter for the Financial Times, spent six years questioning the finances of Wirecard, Germany’s moneymaking payments processor. Fraudulent Wirecard would strike back against McCrum and his wife with smear campaigns, lawsuits and surveillance. German banks and regulators targeted him. But his efforts paid off. Read about his crazy, weird investigation.

A wanted poster hangs on a wall in Dan McCrum’s home office. Two photos of the same young man — one heavily bearded — confidently smile under the headline, “Fraud in the billions.”

The “Public Prosecutor’s Office of Munich I, Police Headquarters in Munich and the BKA” (German Federal Criminal Police Office) apparently need help. The wanted poster reads: “Jan Marsalek, ex-board member of Wirecard AG, is strongly suspected of having committed billions in commercial gang fraud, the particularly serious case of embezzlement and other property and economic offences. He is currently on the run.”

In August 2014, McCrum, then a reporter for the Financial Times’ blog, FT Alphaville, was looking for companies “with problematic accounting,” as he calls them. He didn’t realize that he’d soon be involved in a six-year investigation that would make him the target of German banks and regulators, threaten his reputation and make him look over his shoulder at night.

However, in the end, his investigations helped bring down Wirecard, the 20-year-old fraudulent payments processor firm from Munich. And they gave him some great stories to tell.

The ACFE will present McCrum with its 2021 Guardian Award for his bulldog tenacity and resolve to uncover a behemoth fraudulent company that falsely touted assets of more than $26 billion before its demise last year. McCrum will be a keynoter at the 32nd Annual ACFE Global Fraud Conference, June 21-23.

The ACFE presents the Guardian Award annually to a journalist whose determination, perseverance and commitment to the truth has contributed significantly to the fight against fraud.

Nominees are chosen based upon their contributions to expose specific acts of fraud and white-collar crime, and/or through helping to shine a spotlight on issues central to fraud and the worldwide effort to prevent and detect it. The award inscription reads: “For Vigilance in Fraud Reporting.”

“I’m honored and truly grateful because of what the ACFE represents and its focus, and also to be in the company of the people you’ve presented the award to in the past,” McCrum says in a recent interview with Fraud Magazine.

“I’d love the ACFE members to feel that if they encounter situations that require a bit of public-interest reporting that they’d reach out to me,” he says.

Payments processor juggernaut

McCrum has been interested in the intricacies of capital markets for years. Armed with a degree in economics and politics from Durham University, he worked as an analyst for Citigroup and then wrote for Investors Chronicle. He came to the FT in 2007.

“In 2014, I was having some conversations with hedge fund managers,” McCrum says. “One said, ‘Would you be interested in some German gangsters?’ And he told me about this German company called Wirecard.”

First, some history. Backed by venture capital in the late stages of the dotcom boom, Wirecard was founded in 1999 as a payment processor helping websites collect credit card payments from customers. (See Wirecard: the timeline, by Dan McCrum, the Financial Times, June 25, 2020.)

In 2002, the company almost went belly up. Markus Braun, a former KPMG consultant for Wirecard, became chief executive and merged the company with a Munich rival, Electronic Business Systems. In 2005, the firm was listed on the Frankfurt stock market when it did a reverse takeover of a defunct call center group, which allowed it to avoid the scrutiny of an initial public offering. With 323 employees, the core of its business was managing payments for online gambling and pornography.

In 2006, Wirecard moved into banking when it purchased XCOM. Visa and Mastercard licensed Wirecard Bank, which meant it could issue credit cards and handle money on behalf of merchants. This hybrid of banking and non-banking operations made its accounts harder to compare with peers and helped persuade investors to rely on the company’s adjusted versions of financial statements, according to “Wirecard: the timeline.”

“In 2008, Wirecard was subjected to a short attack,” McCrum says. “The head of a [German] shareholder association published a dossier alleging balance-sheet problems [at Wirecard],” he says. “But it was an undisclosed short attack, so BaFin [the German Federal Financial Supervisory Authority] investigated.”

Wirecard then appointed EY to conduct a special audit. “The author of that [shareholder association] report and someone else received short jail sentences for market manipulation” because they hadn’t disclosed their positions in Wirecard stock, McCrum says.

In 2010, the company appointed Jan Marsalek, a young protégé of Braun and fellow Austrian, chief operating officer. Marsalek had been with the company since his teen years as a tech prodigy. The accounting numbers at that point were clean because of the EY audit, McCrum says.

Wirecard thereafter changed its official language to English. From 2010 to 2014, the company raised 500 million euros from shareholders and bought obscure payments companies across Asia in a series of oddly structured deals beginning in Singapore, which became it headquarters in the region, according to McCrum. Investors started to flock.

That brings us back to McCrum’s 2014 search for business tips for the FT blog.

Committing fraud since 2010

“This English hedge fund manager, Leo Perry, got in touch with me, and he said he’d taken a look at all the acquisitions that Wirecard had been doing for about three or four years then in Asia,” McCrum says. “And as he describes it now, it was the best documented accounting fraud he’d ever seen. He then walked me through it.”

McCrum realized that Wirecard had been committing fraud since 2010 onward. However, he says it’s a lot harder to use the word “fraud” in U.K. media articles than it is in the U.S., for example, because of stricter libel laws. But that’s exactly what he was seeing at Wirecard.

Perry’s working theory in 2014, McCrum says, was that Wirecard was disguising fake profits by overpaying for worthless businesses in Asia. “One of the odd things was it was paying out money for these businesses just before the end of the year as sort of a down payment, but it wasn’t actually signing the contracts or taking control of the assets until later in the following financial year,” McCrum says. “So, it was getting rid of some fake cash and was also creating some space for other kinds of financial tricks.”

McCrum flew to Bahrain to check on one of Wirecard’s supposed business partners. “It was very clear that something was wrong,” McCrum says. “This business had been lying about work it did; its offices weren’t the scale it had claimed.

“There was something fishy … but it was still very hard to use the word ‘fraud’ yet, so I wrote a series of blog posts for FT Alphaville that essentially framed questions,” he says. “We could say, ‘Look at the documents that don’t seem to match what the company is saying.’”

250-million-euro hole

McCrum’s FT Alphaville blog series, “The House of Wirecard,” suggested a 250-million-euro hole in the group’s balance sheet. Wirecard responded with a letter from Schillings, a U.K. law firm, and hired FTI Consulting in London to manage its external public relations. So began Wirecard’s aggressive and ultimately strange defense.

In October 2015, Wirecard announced its largest-ever takeover, a 340-million-euro acquisition of several Indian payments businesses.

The FT reported in April of that year that Wirecard provided different levels of regulatory disclosure about transactions depending on the jurisdiction involved. The FT wrote that a corporate filing in Singapore — where a company purchased by Wirecard was based — revealed that its assumption of 12 million euros in liabilities was really an opaque loan it made to an unspecified recipient after the Indian acquisitions’ completion “for the acquisition of intangible assets from a third party."

According to the FT Wirecard timeline, J Capital Research reported that Wirecard’s operations across Asia were far smaller than it claimed. Wirecard claimed that short sellers paid for the report.

In February 2016, two then-anonymous professional investors published a 100-page dossier of money-laundering allegations against Wirecard and evidence under the pseudonym, Zatarra (named for a pseudonym used by Alexandre Dumas’ “Count of Monte Cristo”).

McCrum published an FT article on the Zatarra Report that month, but Wirecard denied everything. “That’s when everything started to go crazy,” he says. “Wirecard had been threatening [The Financial Times] for quite some time. But now they were accusing us of conducting a short-seller attack.”

A short sale is the sale of an asset or stock the seller doesn’t own. In other words, Wirecard was alleging that FT — specifically McCrum and his closest colleagues — were publishing falsehoods about Wirecard that would lower its stock price so they could then buy shares at a low price and fraudulently profit from the company’s bad news.

BaFin, the German financial regulator, began to investigate Zatarra and others for alleged market manipulation.

Marsalek gobsmacks FT

In April 2016, Paul Murphy, the editor of FT Alphaville at the time, received a call from a longtime source — a stock market speculator — who wanted to introduce someone who vehemently disagreed with the FT blog posts and articles, and said that McCrum was completely wrong about Wirecard. Amazingly, that someone was Marsalek, then the chief operating officer of Wirecard and the “mastermind of its dirty-tricks operation,” McCrum says.

“You know that we were gobsmacked because it’s unusual for a company … to approach you that way rather than just pick up the phone,” he says. “Wirecard had a completely normal PR firm, FTI Consulting, at this point [who could’ve done that]. … So my boss said to [Marsalek], ‘We’re not going to talk with you; you’re threatening to sue us!’"

Then Marsalek offered money to an equities specialist on the newspaper to quietly remove the Wirecard posts from Alphaville, McCrum says. And Marsalek falsely told the equities specialist that a French company was about to make a takeover bid. “We got a rare on-the-record denial from the French company,” he says.

“Later that year, on Dec. 16, a fake whistleblower appeared and published online effectively this theory that a journalist from Reuters and I were in cahoots with the authors of the Zatarra report,” McCrum says. The fake whistleblower published online a series of faked and hacked correspondence. “I could see that there were emails from one of my sources to me.” McCrum discovered that an Indian hacking gang had conducted a phishing campaign to infiltrate his sources’ email accounts, including those of analysts, hedge fund executives, other journalists and even his wife.

“There was nothing we could write at the time about that because there’s no way to prove that this was Wirecard,” he says. “Because it was so extraordinary and so blatant it convinced us that we were dealing with a criminal company."

McCrum says that even though there was clear evidence of a variety of problems at Wirecard, BaFin was preoccupied with investigating the authors of this Zatarra report instead.

Despite the bad press and allegations, Wirecard received a clean audit from EY in 2017. A cash-generation improvement renewed investor enthusiasm for shares, which more than doubled in price. Wirecard took over Citibank’s payment processing operation in 11 Asian countries.

Wirecard’s Singapore headquarters legal staff began an investigation in March 2018 into three members of its finance team after an internal whistleblower alleged a plan to fraudulently send money to India via third parties in a “round-tripping” scheme.

According to McCrum, a lump of money would leave the bank Wirecard owned in Germany, would appear on the balance sheet of a dormant Hong Kong subsidiary, depart to sit momentarily in the books of an external “customer” and then travel back to Wirecard in India, where it would look like legitimate business revenue to local auditors.

In September 2018, Wirecard was included in the Dax 30 index, replacing Commerzbank. Investors now saw it as Europe’s largest fintech company that would challenge Silicon Valley. Then in October of that year whistleblowers told the FT that they thought Wirecard had squashed the internal investigation in Singapore.

Singapore investigation and Twitter accusations

McCrum and the FT reporter Stefania Palma in Singapore published their first article in January 2019 on the Singapore investigation, which Wirecard described as false. BaFin began to investigate McCrum and the FT over an allegation of market manipulation.

On Jan. 30, 2019, anonymous Twitter bots screamed, “McCrums a criminal … Dannyboy McCRIM is GOING TO JAIL!!” (See Wirecard and me: Dan McCrum on exposing a criminal enterprise, by Dan McCrum, the Financial Times, Sept. 2, 2020.)

The next day, Germany’s Commerzbank sent to its customers a note from Heike Pauls, an equity research analyst at the bank. “Yesterday, serial offender Dan McCrum, journalist at the otherwise renowned FT, published another negative article about Wirecard,” Pauls wrote. “As before, McCrum’s article followed a visible increase in short [selling] during the past few weeks. We believe that market manipulation looks obvious …”

She went on to say, “We are actually more concerned about [the] obvious active participation of the FT in market manipulation than about the allegations to the company. We believe that regulators need to take a serious look at the situation.”

McCrum was flabbergasted. “I didn’t think I was ever going to be able to travel to Germany or I might get arrested,” he says. Twitter spam accounts claimed that he wrote the articles implicating Wirecard because his wife worked for a competitor. Wirecard seemed to be determined to destroy his and his wife’s reputation.

In February 2019, Singapore police raided Wirecard’s offices. BaFin announced a two-month ban on short selling and cited Wirecard’s “importance for the economy” and “serious threat to market confidence.” The FT’s reporting on fraud in the Singapore office had significantly lowered Wirecard’s stock price and wiped billions off its market value.

The FT attempted to visit some of the Wirecard partners in the Philippines. They discovered, for example, a retired seaman and his family, who were bemused to learn that their house was supposedly the site of an international payments business.

That month, Wirecard filed a suit against the FT and McCrum. “Our objective is to seek a halt to the incorrect use of business secrets for the purposes of reporting, as well as damages,” Wirecard said in a statement. (See Wirecard sues FT over investigative reports, Reuters, March 28, 2019.)

“[Wirecard] hand-delivered the lawsuit to my home address,” McCrum says. “It’s like they were saying, ‘By the way, we do know where you live.’"

In March 2019, Singapore prosecutors named five Wirecard staff and eight subsidiaries of the group as suspects.

But then in April 2019, SoftBank — the Japanese conglomerate known for large tech investments — apparently gave Wirecard a vote of confidence by injecting it with 900 million euros in cash.

Smoking-gun Excel file?

In July 2019, McCrum discovered that a list of supposed customers — names, revenues, sales — in an April 6, 2018, Wirecard Excel file were all fake. McCrum was excited about this possible Excel smoking gun. “We were very confident that we had them — possibly overconfident,” he says.

Wirecard said McCrum had used a forged document to claim that a large part of its business was fabricated. Wirecard then alleged the FT colluded with short sellers based on a tape recording it purportedly obtained in a sting operation overseen by Rami El Obeidi, the former head of foreign intelligence in Libya’s National Transitional Council, which governed the country temporarily in the wake of Muammar Gaddafi’s death.

El Obeidi, or “The Doctor,” as he liked to be addressed, had met with officials from the U.K. Financial Conduct Authority to press the case that McCrum was crookedly conspiring with short sellers to sabotage Wirecard, McCrum says.

“Dr. Rami” had brought in an ex-special forces guy who, with the help of an ex-counterterrorism operative, assembled 28 private investigators to follow McCrum, his colleagues, investors and hedge-fund bosses, McCrum says.

In October 2019, the FT published documents, which indicated that Wirecard fraudulently inflated profits at its units in Dubai and Dublin, and customers listed in documents it provided to EY didn’t exist. Wirecard said the documents weren’t authentic, and its executives had done nothing wrong. Investors pressured it to conduct a special audit. Wirecard appointed KPMG.

KPMG cited ‘obstacles’ in report

On April 28, 2020, KPMG said in its report that it couldn’t verify that arrangements responsible for “the lion’s share” of Wirecard profits reported from 2016 to 2018 were genuine, citing several “obstacles” to its work. The report caused Wirecard’s stock to crash 26 percent. “We were unable to fully comprehend Wirecard’s ‘gross accounting’ of revenue generated with [third-party acquiring partners],” wrote KPMG, pointing out that it didn’t receive the necessary documents to do so. (See Wirecard: what KPMG’s report found, by Dan McCrum and Olaf Storbeck, the Financial Times, April 29, 2020.)

Braun told investors that “E&Y informed us this morning that they have no problem at all to sign off the audit 2019."

On June 5, 2020, police searched Wirecard’s offices after Munich prosecutors finally launched a criminal investigation against Braun and the three other executive board members, McCrum says. The search followed a criminal complaint submitted by BaFin a few days earlier related to potentially misleading statements Wirecard made to investors ahead of the publication of the KPMG report, he says.

On June 18, 2020, Braun explained in a YouTube video that EY couldn’t verify the existence of 1.9 billion euros in cash supposedly held by two banks in the Philippines. “At present it cannot be ruled out,” Braun said in the video statement, “that Wirecard AG has become the aggrieved party in a case of fraud of considerable proportions.” (See Wirecard says it cannot rule out ‘fraud of considerable proportions,’ Reuters, June 18, 2020.)

Wirecard then suspended Marsalek. James Freis joined the management board as chief compliance officer. Braun resigned the next day, and Freis became interim CEO.

On June 22, 2020, Wirecard said the “missing” 1.9 billion euros probably didn’t exist. The company fired Marsalek. Apparently, he left Germany and is still on the run, as of press time. German law enforcement issued his wanted poster.

“Marsalek told people when he left the country after Wirecard collapsed that he was going to the Philippines to sort things out,” McCrum says. “Immigration records showed him arriving on a flight from Germany into Manila and then the next day flying to China. But this was an incredible false trail. When authorities looked at the closed-circuit television [in Manila], he didn’t get off the plane. … It seems more likely someone was bribed to alter the immigration records.

“It seems to be a reasonable theory, that it was decided at Wirecard that Marsalek would be the fall guy. He would disappear, and everybody else would blame him,” McCrum says.

But it didn’t quite work out that way. On June 23, Braun was arrested on suspicion of false accounting and market manipulation. The Munich prosecutor’s office said it’s investigating the company’s former management board. On June 25, Wirecard said it would file for insolvency.

Effective blindfold

McCrum is relieved that the Wirecard story has reached its apparent denouement, but he’s still frustrated it took six years of investigative reporting to get to this point. “With every story, we [at the Financial Times] thought, ‘This is it. This story will finally make people realize.’ But it wouldn’t because the German authorities had effectively demonized us,” he says.

Wirecard’s bizarre and intimidating pushback took a toll on McCrum and his wife. “I always told myself that it would probably be worse for Wirecard if something mysteriously happened to me,” he says. “But still I had some dark nights dreaming what would happen if I got knocked off my bike or something."

McCrum is still investigating the roots and details of the Wirecard fraud for an upcoming book and documentary. But he thinks the crimes lasted so long because the German government was proud of this high-tech marvel, the German regulators were incompetent and happy investors wanted to believe that the dividends would keep rolling in.

“Similar to the Bernie Madoff case, when investors are making a lot of money, they don’t ask too many questions,” he says. “Greed is a very effective blindfold."

Dick Carozza, CFE, is editor-in-chief emeritus of Fraud Magazine. Contact him at dcarozza@ACFE.com.