Intimidation, surveillance and conspiracy theories: inside the FT's five-year investigation of a billion-dollar fraud.
January 30 2019: it was mid-afternoon on a grey Wednesday in London when a dozen or so anonymous Twitter bots burst into life. "McCrums a criminal . . . Dannyboy McCRIM is GOING TO JAIL!!" they sang.
As this stream of online abuse gathered pace, another more formal voice joined the chorus, that of Heike Pauls, a respected and widely followed equity research analyst at Germany's Commerzbank. The following morning, a research note to the bank's clients was published. It was titled "More fake news".
"Yesterday, serial offender Dan McCrum, journalist at the otherwise renowned FT, published another negative article about Wirecard," Pauls wrote. "As before, McCrum's article followed a visible increase in short [selling] during the past few weeks. We believe that market manipulation looks obvious . . . "
She went on to say: "We are actually more concerned about [the] obvious active participation of the FT in market manipulation than about the allegations to the company. We believe that regulators need to take a serious look at the situation."
At first, I thought the note was a hoax but, astoundingly, it was real. It was the latest episode in a skirmish that was to last 18 months, leaving me under attack as German banks and regulators waved away evidence of corporate criminality to place me at the heart of a conspiracy theory. At times, it seemed like the world had gone mad.
Wirecard was a pioneering payments processor from Munich that handled credit and debit card payments. A stock market darling that promised to make cash obsolete, the company had grown over two decades to become a member of the Dax index and, in the eyes of retail investors, a fintech giant that was the country's answer to Silicon Valley. Pauls put its target value at €28bn, double that of Deutsche Bank.
The charge of criminality from Commerzbank — the idea that I, as a reporter, was somehow in league with speculators trying to damage a company by sending the share price crashing, and that the FT was OK with that — did not come as a complete shock. For many years, Wirecard executives, along with its band of corporate cheerleaders, had routinely dismissed critics as "criminal short-sellers" who would profit if the company's share price fell.
I'd investigated Wirecard since 2014, following a tip that something was awry with the accounts. Together with the FT's investigations team editor Paul Murphy and in-house libel lawyer Nigel Hanson, we had learnt what to expect from scrutinising the company: furious online abuse, hacking, electronic eavesdropping, physical surveillance and some of London's most expensive lawyers.
But in the end, it all came crashing down. A couple of years after the Twitter bots attacked me, Wirecard is a smouldering wreck. The ex-chief executive, Markus Braun, is in jail, awaiting trial along with other colleagues, while the company's former chief operating officer, Jan Marsalek, is on the run. This is the tale of what it was like to unravel and expose the reality of a criminal enterprise that relied on a network of professional enablers to keep in motion one of the biggest corporate frauds of the modern era.
My Wirecard odyssey first went public in April 2015, when I wrote a series of posts on Alphaville, the FT's financial blog. Entitled The House of Wirecard, the series asked a simple question: do the company's numbers add up?
Ten months later, Matt Earl and Fraser Perring, two professional investors acting anonymously at the time, published what became known as the Zatarra Report, named for a pseudonym used by Alexandre Dumas' Count of Monte Cristo. This was an incendiary 100-page compendium of evidence and allegations that for years Wirecard had duped the major card networks run by Visa and Mastercard in order to process online gambling payments for American customers, something very much frowned upon by the US authorities at the time.
My article on the report in February 2016 triggered a furious legal response from Wirecard's lawyers and caused a sharp intake of breath among the FT's own legal team, since Zatarra threw allegations of fraud and money laundering around with abandon.
It was amid this tumult that Paul Murphy, who at the time edited FT Alphaville, took an odd phone call. A stock market speculator and gossip who Murphy spoke to in private on a pretty regular basis — call him Bill — wanted to make an introduction. Was Murphy really sure about "the stuff on Wirecard" on FT Alphaville, he asked? Bill said he was in touch with someone who vehemently disagreed. His name was Jan Marsalek.
Marsalek, then just 36 years old, was the chief operating officer of Wirecard and the mastermind of its dirty-tricks operation. A suave dealmaker who lived half his life in private jets and luxury hotels, he thrived where the worlds of business, crime, politics and spycraft intersect, a solid gold credit card tucked in the pocket of his designer suit. We now know that he had a range of secret-service contacts in Russia and Austria, as well as deploying at least a dozen private investigators in multiple countries. Documents seen by the FT indicate Wirecard had a broad toolkit at its disposal, ranging from a cast of social-media sock-puppets spouting propaganda to physical surveillance to sophisticated eavesdropping kit used to mirror iPhones.
However he'd done it, Marsalek had identified one of Murphy's regular sources — and hoped to use him to influence the FT's reporting.
Murphy's response to Bill was blunt. "We don't offer a journalistic ear to people threatening to sue us," he recalls saying. "If Marsalek wants to set the record straight, tell him to answer Dan's questions." But he was rattled. How and why would an executive running a multibillion-euro global payments processing business in Germany find Bill, the long-term owner of a big London nightclub, who spent his daylight hours punting on the market?
Within days, Marsalek tried a different route into the FT. Bryce Elder, an equities specialist on the paper, returned from a Mayfair lunch and sat down next to Murphy in the newsroom. "A strange thing just happened to me," he said. "I was offered money to quietly remove the Wirecard posts from Alphaville. Of course, I told him where to go but he said there's a takeover bid coming for Wirecard."
The three of us pulled up the Wirecard share-price chart and associated trading volume. "There's no bid coming for that company," Murphy said. Wirecard's stock price had been hammered after the Zatarra Report, falling by a third. The publicity had sent investors of all sizes back to read the House of Wirecard series and review earlier episodes where speculators raised suspicions about the company.
The evident strategy of Wirecard was to portray our journalism as reckless and ill-informed — and on this front its machinations were about to get even more creative.
In April 2016, rumours started to circulate among London stock market traders that the FT was about to report that Wirecard was in takeover talks, and that the newspaper would issue a correction and an apology for its past coverage. Elder, who keeps his ear close to this rumour mill, was quickly told the terms of the supposed bid: Wirecard would merge with its French rival Ingenico. He also received a name and number to contact for verification of the deal: Jan Marsalek.
Marsalek, who was in Moscow at the time, answered his call and confirmed the takeover: Wirecard had supposedly reached heads of agreement with Ingenico in a transaction designed to create a European payment-processing powerhouse. The price would be €60 per share, 70 per cent above the prevailing market price — a bid premium that would stun investors.
But as Marsalek spoke, calls were simultaneously going into Ingenico executives from our Paris office. The French were adamant: there were no talks, there was no deal, the story was fictitious. Ingenico even produced an on-the-record statement.
At the FT we were dumbfounded. A senior executive at a large publicly listed European company had brazenly tried to spoof our journalists into running a completely fabricated, highly price-sensitive story. This was simply outside of our experience and, while it cemented our conviction that something was up, it was also deeply intimidating. What other tactics would the company try, I wondered.
In December I found out, when screenshots of emails between me and a corporate investigator were posted online for all to see. More worryingly, they appeared along with a collection of doctored chat-message transcripts, presented as evidence that I was synchronising the publication of Wirecard-related content with various hedge funds.
Wirecard's associates, helped by an Indian hacker team, had invented their own "whistleblower" who published this cache of supposed evidence as a file called Zatarra Leaks. It included hacked correspondence between hedge funds, clandestine surveillance photos of investors at their homes — and my emails. This was accompanied by a rabid conspiracy about London-based traders and corrupt journalists ganging up on an innocent German technology company.
Panicked, I replaced all my personal electronics and spent days setting elaborate passwords on every device. On the advice of Sam Jones, who covered the security services for the FT, I attached a timer to my WiFi router to turn it off at night and reduce the opportunity for attack.
A day later a furious missive arrived from Schillings, Wirecard's media lawyers at the time. Had the FT's (then) editor Lionel Barber seen the evidence that showed the whole Zatarra affair to be a criminal conspiracy? And was Dan McCrum being investigated by the FT for corruption?
Those were uncomfortable days. I had to hand over my correspondence to show that these "revelations" were in fact messages taken out of context or simply fabricated. But from Wirecard's perspective, the smearing worked. The combination of fierce legal attack and planting a grain of doubt about my innocence made reporting on the company laborious. There was also a dispiriting sense that whatever the story, investors and regulators preferred Wirecard's Kool-Aid. The company's share price doubled in 2017. Braun, his billionaire status increasingly likely, celebrated Christmas by taking out a €150m loan from Deutsche Bank, secured against the value of his 7 per cent Wirecard stake.
In early 2018, Murphy was lunching with one of his regular "bid-gossip" contacts at Signor Sassi, a splashy Italian restaurant near Harrods, when Wirecard came up in conversation. "You know they will pay you good money to stop writing about them," the market contact stated. Murphy smiled, dismissing the idea. "No, I'm serious, they will pay you proper money," he insisted. "They will pay you $10m. Go and talk to Bill. He'll help you."
Intrigued by this latest twist, Murphy went to see Bill, who was surprised by the sum but explained that "Marsalek desperately wants to meet you. He will fly over from Munich at a moment's notice. Why don't we fix up a lunch?" "Let's do it," Murphy replied.
Our immediate assumption was that this was a trap — a sting to demonstrate an FT journalist could be bribed. If there was going to be a lunch with Marsalek, we had to monitor it covertly.
The meal in question was arranged with surprising speed — for February 16 2018 — and, ultimately, took place at a steak restaurant at 45 Park Lane, where the prices naturally limit the number of people dining on any given day. Along with Marsalek came Bill and his son, plus a mysterious character called Sina Taleb, who couldn't quite explain why he was there. Nearby, presenting themselves as three "ladies who lunch", were Cynthia O'Murchu and Sarah O'Connor from the FT investigations team, as well as Camilla Hodgson, then a trainee FT reporter. They discreetly videoed proceedings with a high-tech handbag, while Murphy was covertly mic'd up.
It was for naught: Marsalek didn't offer Murphy $10m. It may be that a last-minute venue switch exposed our amateur surveillance, or he wanted Murphy to make the incriminating "ask". Marsalek did voice his belief, based on what he claimed was his direct experience, that journalists could be easily bought. And he repeatedly pressed his line that, knowingly or otherwise, I was working with short-sellers to damage Wirecard stock.
What Marsalek also admitted to, albeit indirectly, was running a spying operation against us. ("Maybe friends of mine did it," he said.) And he explained, almost candidly, why this was needed: a misinformed or malicious FT story represented an "existential threat" to Wirecard, which, like any financial institution, had to retain the trust of those it did business with. "If we lose our correspondent banking relationships, the business would go down almost overnight," he said.
Wirecard didn't know at the time but its fate was sealed later that year. In October 2018, I flew to Singapore to meet whistleblowers, along with my colleague Stefania Palma from our bureau there. We were stunned as they described amateurish plots to forge invoices and cook up money flows, and listened with rising excitement as we learnt there was a full paper trail, a pile of Wirecard internal documents said to be concrete evidence of fraud.
Back in London, given our knowledge of Wirecard's surveillance capabilities, it was decided I would spend the next three months in a small windowless office by the FT's main newsroom, working on a so-called air-gapped computer, off-grid. I pored over the documents, avoiding meetings. We'd got into the habit of not invoking "the company" by name — much like Voldemort in Harry Potter — just to be on the safe side. The whole project was codenamed "Ahab", after Peter Spiegel, then the FT's news editor, took inspiration from Moby-Dick and started referring to Wirecard as my white whale.
Top of the whistleblowers' cache of documents was a report carried out for the company by an Asian law firm, Rajah & Tann. Called "Project Tiger" and authorised by a mid-level Wirecard lawyer in Munich at the request of his colleagues in Singapore, it revealed stark allegations that the books were cooked.
Roll forward to January 30 2019 and we were ready. Since the Zatarra affair, Wirecard's share price had grown sevenfold, propelling the company into Germany's prestigious Dax 30 index. The business was now worth more than €20bn and chief executive Markus Braun projected with total confidence that revenue would grow fivefold, to €10bn, by 2025. But I already knew the numbers were fake.
Questions focused on Wirecard's book-cooking operation in Singapore went to the company at 6am London time, giving it seven hours to respond. I waited nervously, conscious that Wirecard might run to the courts to try and stop us, claiming that a story about an internal investigation undertaken by lawyers would be a breach of confidence.
At 12.30, Murphy slipped out of the FT HQ for a quick crab sandwich and glass of wine at Sweetings, an archaic lunch spot just across the river. But suddenly he was back and visibly alarmed. "We've got a leak! We've got a bloody leak!" he said to me.
At Sweetings, he'd taken a call from a market trader, who said he'd heard there was a Wirecard article coming at 1pm and wondered what we were reporting. We sat and rolled through the names of those who knew we were planning to publish that day: the two of us, Nigel the lawyer, Lionel the editor. That was it. The copy wasn't even in our content-management system yet. There was no leak from the FT.
The penny dropped: any leak must have come from Wirecard. Alerted by our questions, it had spread the news through the London market and once again was about to accuse us of collaborating with market speculators. The evidence was in the reference by Murphy's caller to publishing at 1pm. We were never going to publish at that time; 1pm was simply the deadline given for comment.
Right on cue, a letter arrived from Schillings: "Our client has been informed of large and unusual short positions being taken out this morning against it, in anticipation of the publication of damaging information or allegations about it which would negatively impact its share price, as previous Financial Times articles have done . . . The repeated pattern of collusion with market players and, particularly, the timing of the short positions being taken out coinciding with Mr McCrum's approaches, is particularly suspicious . . . "
We published our story that day and Wirecard's share price crashed. In a series of articles over the coming months, I described how senior members of the company's finance team were forging documents and constructing fake money flows, known as round-tripping. Palma flew to the Philippines to visit the supposed addresses of Wirecard business partners there. One doubled up as a tour-bus company; another was the residential address of a retired seaman who had never heard of Wirecard.
But rather than following up on our revelations, large sections of the German business press simply took Wirecard's version of events (any accounting irregularities are minor and have been dealt with, McCrum is a criminal working with short-sellers) and proceeded to attack the FT repeatedly.
Even more worryingly, BaFin, Germany's financial regulator, took a similar approach, apparently believing what company executives told them. In February, Wirecard handed over to them an unsigned witness statement from a convicted criminal who, if he wrote it, misspelled his own address. With this "evidence" that traders had been aware an FT story was coming on January 30 — again supposedly at 1pm — the regulator intervened to suspend short selling in Wirecard stock for two months in order to protect it from speculators.
In April, BaFin filed a criminal complaint against Palma and me, plus a string of traders and hedge funds I'd never spoken to. I had the strange sensation of watching colleagues report and edit a piece about our impending prosecution. "Are you sure you didn't let anything slip?" one editor asked, attempting to tread the line between collegiality and duty. "Have you been arrested yet?" became the standard greeting as I crossed the newsroom.
At least I'd found out when the news broke. Palma was stuck in a Jakarta traffic jam when she glanced at her phone to discover emails discussing whether it was appropriate to name us as suspects in an FT article. "The idea that the financial regulator of one of the biggest markets in Europe was investigating was pretty nerve-racking. I couldn't quite believe we were the ones being targeted," she recalls.
Wirecard told anyone who would listen that it was suing the FT, while its Philippines partners also threatened legal action, falsely alleging that Palma and I tried to bribe local officials. A story appeared in the Manila Standard claiming that somehow the retired seaman was paid to lie to Palma when she turned up at his house unannounced.
On one level all this was just bizarre. As Fahmi Quadir, a New York short-seller, put it in a wide-ranging critique of the ban, the authorities created "a toxic environment where whistleblowers will avoid coming forward for fear of civil or criminal penalty for telling the truth. BaFin's actions may set a dangerous precedent for market cosseting and capitulation to corporate influence."
Following news of the short selling ban, the criminal investigation and the high-profile backing of Japanese conglomerate SoftBank with a $1bn investment that April, Wirecard's share price staged a robust recovery. The company had seen off its critics once again. I went back into my bunker and our trove of documents. As I did so, Wirecard executives were working to make sure that when I returned they would be ready.
I've never met Nick Gold but Murphy has described him as a compulsive stock market gambler in his late forties who will trade on the slightest rumour, as well as a party animal regularly sighted at A-list hangouts. He's also part owner of The Box, a rather notorious "ladies and bottles" club in Soho.
It would emerge later in the year that an elaborate (but, ultimately, incompetent) network of intelligence and security operatives engaged by Wirecard in London had targeted Gold in 2019. He was identified as the vulnerable character among a group of friends who were big in property, gambled on the stock market continuously and, crucially, had bet against Wirecard shares at one time or other.
Overseeing the surveillance effort was a maverick Libyan, Rami El Obeidi. He was briefly the head of foreign intelligence in the transitional government installed after the country's leader Colonel Gaddafi was killed in 2011. He liked to be addressed as "The Doctor" and always stayed at the Dorchester when in London, meeting there with officials from the UK's Financial Conduct Authority to press a case that I was crookedly conspiring with short-sellers to bring Wirecard down.
It was "Dr Rami" who brought in an ex-special forces guy from Manchester called Greg Raynor to work the Wirecard case. He, in turn, reached out to an ex-MI5 counter-terrorism operative, Hayley Elvins, and together they assembled a collection of 28 private investigators to follow me, my colleagues and a baffling array of investors and hedge fund bosses, including Crispin Odey.
It was pretty clear by now that the FT had become a huge moneymaking machine for these black operations pressing back against our reporting. Arcanum Global, owned by Ron Wahid and advised by a string of former senior military, policing and intelligence leaders, had a £3.2m contract with Wirecard. Elsewhere Charlie Palmer, partner in the public relations arm of FTI Consulting, failed to get the Mail on Sunday to reprint nonsense written by newspapers in the Philippines.
Meanwhile, international law firm Herbert Smith Freehills jousted with the FT's lawyers, and a daisy chain of investigations by Fieldfisher lawyers and consultants at Control Risks — based on information carefully provided by Wirecard — was used to reassure the audit team at EY about issues raised by the FT. By the time Wirecard collapsed, it was spending £120m a year on "advice".
Observers of the Wirecard affair have tended to criticise the German establishment for the fact that this fraud ran for 20 years unchecked — poor auditing, zero regulatory oversight. And yet almost all the external professionals hired by the company to protect its reputation were based in London.
The fact that I can now name Wahid, Elvins, Raynor, Dr Rami and Palmer as being part of a supposedly clandestine operation against the FT speaks to their incompetence. However, someone among that group got something right when they focused on Nick Gold.
Bemused by Wirecard's ability to shrug off the very serious allegations we raised during the first half of 2019, I went back to look for fresh evidence. Something was nagging at me. We'd reported that Wirecard outsourced huge amounts of payments processing to business partners and named a payments client mentioned in the files — LiveJasmin, an adult-entertainment empire built on live webcams.
LiveJasmin ignored our inquiries before we published but afterwards complained it had never heard of these partners. "We are linked directly to Wirecard because they are one of our acquirer banks. There is no other party involved in this and we do not have nor need any other party to process transactions," a spokesperson said.
I went back to an Excel file headed "Customer Relationship Monitoring", dated April 6 2018, with about 40 sheets of customer data. Clicking on the one labelled "Alam" — a Wirecard partner in Dubai — I ran my eyes down the list of customers. Some of the names looked odd. I knew from past research that some of the entities there could not have been doing business with Wirecard at the time because they no longer existed. And then it hit me: the whole list; the names, the revenue, the sales . . . it was all fake.
Several dozen phone calls later, we were in a position to send questions to Wirecard seeking comment. The stakes were high. It was mid-July and we were about to allege, in print, that a large part of the Wirecard business was fabricated.
A reply finally arrived, rejecting everything outright and asserting that I'd used a forged document to make these claims. But there was a sting in the tail. To quote from a Herbert Smith letter: "We are instructed to inform you that our client has recently obtained evidence in the form of an audio recording, which has been provided to the criminal authorities in the UK and Germany, showing that the publication foreshadowed by Mr McCrum's email is intended to form part of a short selling strategy and that its forthcoming publication has already been communicated to short sellers."
Here's what happened. Nick Gold, the compulsive punter, was vacationing at his villa in Cannes when he bumped into an old friend, a football agent. This friend told Gold he knew of an investor who wanted to put £50m to work in the London stock market. Did Gold want an introduction?
A meeting was set up between a representative of the investor and Gold on July 17 2019, along with Gold's business partner Jonathan Dennis. The pair were told the investor wanted a trade or strategy to execute immediately. But the representative was actually a private investigator. He recorded everything as Gold claimed advance knowledge of when the FT was publishing articles critical of Wirecard and that a new story, casting doubt on the existence of Wirecard revenues, was due that week.
Gold would later state he guessed that something was coming from a conversation with Murphy on an entirely different topic. He'd tried to interest Murphy in further information about Flutter, the betting group that was also an FT focus at the time — and Murphy had replied: "I can't look at Flutter, I'm too busy with Wirecard right now."
From my perspective, this was disastrous. The German press was running lurid stories about seemingly corrupt reporters, then the FT's editor Lionel Barber decided to call in an external law firm, RPC, to investigate Murphy and me. This investigation would ultimately conclude there was no collusion with Gold or anyone else — but it took two months, during which nothing further could be run on Wirecard, which used the time to raise €1.4bn of new debt from investors.
Yet in hindsight the Gold affair was a blessing in disguise. Wirecard staked its reputation on a transparent lie and hardened our resolve to expose it. Through Herbert Smith, the company claimed the "Alam" spreadsheet itself was fabricated — but we were sure it was genuine. I had correspondence between members of the Wirecard finance team discussing the document.
By early October, Barber cleared a plan for one of the boldest pieces of journalism in the FT's history. We would publish the Alam piece first drafted in July showing that half of Wirecard's claimed business simply didn't exist, and we would also publish the actual spreadsheet, providing everyone with very tangible evidence that Braun was lying, repeatedly. The choice would be clear: if the document with its fraudulent data was real, Wirecard's profits were fake.
The piece went live on October 14 2019, sealing Braun's fate together with that of his co-conspirators. It only took another eight months of dithering by the German authorities, amid a special audit from KPMG, to actually bring the business down.
In the end, the fraud was farcical in its simplicity. Due to announce results on June 18 this year, Wirecard instead said that €1.9bn was "missing". Two pieces of paper, supposedly listing large sums held at banks in the Philippines, were forgeries. The tragedy was that it took so long for EY to check.
A whirlwind week followed. Braun was fired and arrested. Wirecard admitted that the billions weren't missing, they were imaginary, then collapsed into insolvency. The ex-billionaire was soon joined in jail by other senior executives, although not Marsalek, who vanished as his lies unravelled and is still on the run. A reckoning began in Germany, where Commerzbank was among the institutions that had lent Wirecard €3.2bn.
For me, and for many of the long-term investigators of the group, it felt like a huge weight had lifted. My great white whale was gone at last.
Written by: Dan McCrum
© Financial Times