Dan McCrum’s Money Men is the first-person account of the Financial Times investigation that exposed Wirecard, the German payments company that joined the DAX 30 in 2018, was valued at more than €20 billion at its peak, and collapsed in June 2020 when €1.9 billion of cash that its accounts said was held in trustee accounts in the Philippines turned out not to exist. For an internal auditor it is the most instructive fraud book of the decade, because the fraud survived a decade of public warnings, a Big Four audit relationship, a special forensic audit by a second Big Four firm, a national regulator that chose to investigate the journalists rather than the company, and a supervisory board that preferred the management’s story to the evidence. This guide summarises the book without reproducing it, sets out the mechanics of the fraud and the controls that should have caught it, maps each failure to an audit lesson, and ends with a worked example of a bank audit team testing its own third-party acquiring business against the Wirecard questions.
In this guide
- The book in one page
- Who Dan McCrum is, and how the book came about
- The timeline: 2008 to 2020
- The mechanics: how the fraud worked
- The seven gates that failed
- The eight ideas worth keeping
- The vocabulary: twelve terms defined for practitioners
- What it means for internal audit: a failure-by-failure map
- The aftermath: trials, reforms and what changed
- The criticisms, and what the book leaves out
- Editions, reading time and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Thornwick Bank tests its acquiring business
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is it about? | Wirecard, a Munich payments processor whose reported growth came largely from a third-party acquiring business in Asia that did not exist on the scale claimed, and the six-year reporting effort, led by McCrum at the Financial Times, that proved it. |
| What was the fraud? | Revenue and profit were booked from partner companies in Dubai, Singapore and the Philippines that supposedly processed payments on Wirecard’s behalf; the cash from that business was said to sit in trustee accounts. The partners were shells or tiny firms, the contracts and bank confirmations were fabricated, and by 2020 the accounts showed €1.9 billion that no bank held. |
| Who ran it? | According to Munich prosecutors, chief executive Markus Braun, chief operating officer Jan Marsalek, and a small group of executives in the Asian and Dubai operations. Marsalek fled the day he was dismissed and remains at large; Braun was arrested within days of the collapse. |
| Why did it last so long? | Because every institution that could have stopped it had a reason not to: the auditor relied on fabricated confirmations, the regulator treated criticism as market manipulation, the supervisory board deferred to management, investors trusted the share price, and the critics were sued, surveilled and smeared. |
| How did it end? | A special audit by KPMG, commissioned by Wirecard to silence the critics, could not verify the cash; EY then refused to sign the 2019 accounts; on 22 June 2020 the company admitted the money probably did not exist and filed for insolvency on 25 June. |
| Why read it as an auditor? | Because it is a complete catalogue of how cash, revenue and third-party relationships are falsified, how confirmations are defeated, how whistleblowers are neutralised, and how boards and auditors talk themselves out of evidence. Every chapter is a control that failed. |
| Reading time | About nine hours for the 352-page paperback; it reads like a thriller, which is the point and also the risk. |
Who Dan McCrum is, and how the book came about
McCrum is an investigative reporter at the Financial Times who had covered hedge funds and short sellers before a tip in 2014 pointed him at Wirecard. The FT’s “House of Wirecard” series began in 2015, and the paper published a sequence of increasingly specific stories through 2019 and 2020 based on leaked documents and internal whistleblowers. The book, published in the United Kingdom by Bantam Press in June 2022 and in paperback the following year, is McCrum’s account of that work: what the sources showed, how the company and its allies responded, and what it was like to be named as a suspect in a German criminal inquiry for reporting the truth. McCrum’s investigation is also the subject of Skandal! Bringing Down Wirecard, a Netflix documentary released in September 2022. The perspective matters for how to read it: this is the reporter’s story, with the reporter’s sense of pursuit, and the institutional post-mortems came later and from other hands.
The timeline: 2008 to 2020
| Date | Event | Why it matters |
|---|---|---|
| 2008 | A German shareholder association raises questions about Wirecard’s balance sheet; the critics are prosecuted and Wirecard appoints EY as auditor the following year | The pattern is set: criticism treated as crime, and an auditor whose first engagement follows a controversy |
| 2014 to 2015 | A tip leads McCrum to the company; the FT begins the “House of Wirecard” series on accounting questions | The first public, documented doubts about the Asian acquisitions |
| 2016 | An anonymous short-seller report (“Zatarra”) alleges fraud and money laundering; German prosecutors investigate the authors rather than the company | Regulators and prosecutors line up on the company’s side |
| 2018 | Wirecard replaces Commerzbank in the DAX 30; a whistleblower in Singapore reports forged contracts and round-tripped cash to the company’s own legal team | Peak credibility outside, and inside the firm a report that is contained rather than acted on |
| January to February 2019 | The FT publishes the Singapore allegations; the share price falls; BaFin imposes a two-month ban on short selling Wirecard shares and, in April, files a criminal complaint against the FT journalists | A financial regulator protects the company from its critics |
| October 2019 | The FT publishes internal documents pointing to suspect accounting in the third-party acquiring business; Wirecard commissions KPMG to conduct a special audit | The company’s own chosen check becomes the trap |
| 28 April 2020 | KPMG’s report says it cannot verify the existence of the cash or the revenue from third-party acquiring for 2016 to 2018 | The first institutional confirmation that the critics were right |
| 18 June 2020 | EY refuses to sign the 2019 accounts; €1.9 billion in trustee accounts cannot be confirmed; within days the Philippine banks say the documents are forged | The confirmations the audit had relied on are revealed as fabricated |
| 19 to 25 June 2020 | Wirecard admits the cash probably does not exist; Braun resigns and is arrested; Marsalek disappears; the company files for insolvency | The end, sixteen months after the regulator’s ban on the people who said so |
The mechanics: how the fraud worked
Wirecard had a real business: it processed card payments for online merchants, particularly in sectors mainstream banks avoided, and it owned a bank and a prepaid card operation in Germany. The fraud sat on top of it. In markets where Wirecard did not hold licences, the company said it used third-party acquirers, partner firms in Dubai, the Philippines and Singapore, which processed payments under their own licences and remitted Wirecard’s share. This business was reported as the source of most of the group’s profit. The partners were real companies in the sense of being registered, but the volumes attributed to them were invented, the merchant lists supplied to auditors were fabricated or borrowed, and the cash the business supposedly generated was described as being held in escrow by trustees, in bank accounts the auditors confirmed by letter rather than by direct access.
The scheme needed three supports. The first was paperwork: contracts, merchant schedules, trustee agreements and bank confirmations, produced inside the company or by cooperating partners, and presented to EY as evidence. The second was cash movement that looked like a business: round-tripping funds through the partners and the group’s own entities so that balances existed at period ends, and later booking acquisitions at inflated prices that moved cash to the partner network. The third was the defence of the perimeter: a security operation, aggressive law firms, private investigators who surveilled critics, a media strategy that cast every doubter as a short-seller conspiracy, and a cultivated relationship with the regulator and the political class. The book’s central insight is that the third support was as much a part of the fraud as the first two. A fraud that cannot be questioned does not need to be convincing.
| Component | What was claimed | What was true | The test that would have shown it |
|---|---|---|---|
| Third-party acquiring revenue | Most of group profit came from partner-processed volumes | The partners had no capacity for the volumes; the merchant lists were fabricated | Site visits to the partners; direct contact with a sample of merchants; reconciliation of volumes to card-scheme data |
| Trustee cash balances | €1.9 billion held in escrow accounts at two Philippine banks | The banks had no such accounts; the confirmation letters were forged | Confirmations obtained directly from the bank, by the auditor, through verified channels; direct observation of online banking |
| Acquisitions in Asia | Growth purchased through acquisitions of payment businesses in India and elsewhere | Prices far above the sellers’ own valuations; the difference flowed back to the partner network | Independent valuation; tracing of consideration to recipients; related-party screening of counterparties |
| Whistleblower allegations | An internal investigation in Singapore found no fraud | The investigation by an outside law firm found evidence of forgery and round-tripping and was shelved by the group | The audit committee reads the law firm’s report itself, not management’s summary |
| Critics | A coordinated short-selling conspiracy with the press | The critics had documents; the company had lawyers | A board that tests the allegations rather than the motives of the people making them |
The seven gates that failed
An internal auditor reads the book as a sequence of gates, each of which had the information or the authority to stop the fraud and did not use it.
- The external auditor. EY audited Wirecard from 2009 and relied for years on bank confirmations that were not obtained directly from the banks and on trustee arrangements it did not independently verify. The later German regulatory findings and the two-year ban on EY taking on new public-interest audit clients turned on exactly this.
- The supervisory board and audit committee. The board treated each wave of allegations as a reputational problem to be managed rather than a factual question to be answered, accepted management’s summaries of internal investigations, and did not demand to see the underlying evidence until 2019.
- Internal audit and compliance. The book gives them little space, which is itself the finding: the functions existed, reported into a management that was running the fraud, and had no access to the partner network the profits came from.
- The financial regulator. BaFin’s short-selling ban and criminal complaint against the journalists in 2019 is the episode the book is remembered for, and it was followed in 2021 by the resignation of BaFin’s president and a reform of German audit and market supervision.
- The accounting enforcement body. Germany’s financial reporting enforcement panel, a small private body, had been examining Wirecard’s accounts since early 2019 without reaching a conclusion by the time the company collapsed; it was replaced after the scandal.
- The investors and analysts. The share price was the argument. A company in the DAX with a €20 billion valuation and a sell-side consensus of “buy” was assumed to be real, and the few analysts who dissented were treated as outliers.
- The whistleblowers’ first recipients. The Singapore whistleblower went to the company’s own legal team in 2018. The law firm engaged to investigate found real problems; the group narrowed the scope, controlled the conclusions and announced that nothing material had been found.
The eight ideas worth keeping
- Cash is the hardest thing to fake and the easiest thing to fake badly. Everything in the fraud depended on balances that could not be touched. Existence of cash is proved by the auditor’s own contact with the bank through a verified channel, and by nothing else; a letter on a bank’s paper, handed over by the client, proves that someone owns a printer.
- Profit that comes from a business you cannot visit is a hypothesis. The third-party acquiring business was the group’s profit engine and nobody independent had ever seen it operate. Any revenue stream that is material, remote and intermediated by partners should be verified at the partner, not at head office.
- The response to criticism is evidence about the critic’s claim. Honest companies answer questions with documents; Wirecard answered them with lawyers, detectives and complaints to the regulator. An audit committee should treat an aggressive response to a specific allegation as a reason to look harder, not as reassurance.
- An investigation controlled by the subject is not an investigation. Scope, access, reporting line and the right to publish determine what an inquiry can find. The Singapore investigation and the first phase of the KPMG special audit were both constrained by the company; the KPMG report became decisive only when its authors refused to say more than the evidence allowed.
- Regulators protect what they understand to be the national interest, which may not be the truth. BaFin’s conduct is the book’s most quoted episode because it inverts the regulator’s role, and the lesson for a board is that external oversight cannot be assumed to be sceptical on your behalf.
- Growth by acquisition can be a cash pipe. Overpaying for businesses whose sellers are connected to the fraud moves money out of the company under the cover of strategy. The due diligence and valuation of acquisitions is a fraud control, not only a value control.
- Complexity is a choice. The group structure, the partner network, the trustee arrangements and the multiple jurisdictions were not accidents of growth; they were the architecture of the fraud. Structures that make verification impractical should be treated as risks in themselves.
- Persistence is a control. The fraud was exposed because one reporter and a handful of short sellers kept producing evidence for six years against intimidation. The audit function’s equivalent is the follow-up that does not accept “resolved” without seeing the resolution, which the issue validation guide describes.
The vocabulary: twelve terms defined for practitioners
| Term | What it means in the book | What it looks like in an audit |
|---|---|---|
| Third-party acquirer (TPA) | A partner that processes payments under its own licence and remits a share | Intermediated revenue: verify at the intermediary, reconcile to scheme data |
| Trustee (escrow) account | A bank account held by a third party on the company’s behalf | Cash not controlled by the entity: confirm directly with the bank, test the trustee’s existence and independence |
| Bank confirmation | The auditor’s written request to a bank to confirm balances | Must be sent and received by the auditor through a verified address; client-provided confirmations are not evidence |
| Round-tripping | Moving money in a circle so that balances appear at period ends | Test period-end cash movements for reversals shortly after; trace large receipts to their ultimate source |
| Short seller | An investor who profits if the share price falls, often the first to publish doubts | A source of allegations to be tested on their merits, not dismissed on their motive |
| Special audit (Sonderprüfung) | A forensic review commissioned to examine specific allegations | Scope and access decide its value; a special audit scoped by the subject proves little |
| DAX inclusion | Membership of Germany’s blue-chip index | Index membership forces institutional ownership and is read as a quality signal; it is not one |
| Whistleblower | An insider who reports wrongdoing | The recipient, the independence of the investigation and the feedback loop are the controls; see the fraud risk guide |
| Merchant list | The customers whose payments a processor handles | The population for a revenue existence test; sample and contact merchants directly |
| Acquisition round-trip | Overpaying for a business connected to the fraud to move cash out | Related-party screening of sellers; independent valuation; tracing of consideration |
| Enforcement panel | Germany’s two-tier accounting enforcement system at the time | Oversight that could examine but not compel; replaced after 2020 |
| Litigation as a control defeat | Suing critics to silence them | A pattern the audit committee should log and ask about |
What it means for internal audit: a failure-by-failure map
The external audit failure is the one the public remembers, but the book is at least as much a lesson for the internal function and the audit committee, because the information that would have ended the fraud was inside the company for years. The fraud risk management guide and the corporate scandals guide provide the general frameworks; the table applies them to this case.
| Failure in the book | Control the audit function should expect | Test that produces evidence |
|---|---|---|
| Cash existence rested on paper confirmations | Treasury reconciles every bank account to a statement obtained by direct system access; accounts not under treasury control are listed and justified | Obtain the bank account inventory from the banks’ own relationship confirmations; compare with the ledger; test direct access for every material account; see the cash management and bank reconciliation audit guide |
| Profit from an unvisited partner network | Material intermediated revenue is subject to on-site verification, merchant-level reconciliation and scheme-data reconciliation at least annually | Select the three largest partners; reconcile reported volumes to card-scheme settlement data; contact a sample of merchants |
| Investigation scoped by management | A policy that allegations of financial misconduct against senior management go to the audit committee, which appoints and instructs the investigator and receives the report directly | Read the policy; read the last two investigation engagement letters for who instructed and who received |
| Whistleblower report contained | A reporting channel independent of the legal and executive functions, with case logs reviewed by the audit committee | Reconcile the hotline case log to the audit committee papers; test the handling of the three oldest open cases |
| Acquisitions moved cash to the network | Independent valuation of every acquisition above a threshold; related-party screening of sellers and advisers; post-completion tracing of consideration | Reperform the screening for the last three deals; trace the consideration for one to the recipient bank |
| Critics attacked rather than answered | A board protocol for public allegations: log, assign, obtain evidence, report back; legal action only after the facts are established | Review the board’s handling of the last significant public allegation against the company |
| Group structure defeated verification | A legal-entity rationale for every subsidiary, trustee and partner arrangement, reviewed annually by the audit committee | Request the rationale document; test whether any entity exists only to hold cash or route revenue |
| Internal audit without access | The function’s charter guarantees access to all entities, partners and records; the CAE reports functionally to the audit committee | Read the charter; test one instance in the last year where access was requested from a partner or remote entity |
Two points sit above the table. First, the single most protective control in the whole story would have been an audit committee that insisted on seeing primary evidence, the law firm’s report, the bank confirmations and the KPMG working papers, rather than management’s account of them. The audit committee playbook describes that stance. Second, the function that cannot reach the part of the business that produces the profit is not auditing the business, and the authority and limits guide explains what a charter must say to prevent that situation.
The aftermath: trials, reforms and what changed
The book ends with the collapse, and the institutional consequences came afterwards. Braun and two other former executives went on trial in Munich in December 2022 on charges including fraud and market manipulation, in proceedings that were still running years later; the head of the Dubai operation turned prosecution witness. Marsalek, the chief operating officer, fled through Austria and is believed to have reached Russia; British prosecutors later identified him in connection with a Russian espionage network. The scandal led to the Financial Market Integrity Strengthening Act of 2021, which abolished the two-tier enforcement system, gave BaFin direct powers to examine accounts, tightened auditor rotation and liability, and required supervisory boards of listed companies to have an audit committee with accounting and audit expertise. Germany’s audit oversight body imposed a two-year ban on EY accepting new audits of public-interest entities in 2023, and civil claims by investors and the insolvency administrator continued. BaFin’s president resigned in January 2021. For an auditor the aftermath is the useful part: almost every reform is a control that the book shows was missing.
The criticisms, and what the book leaves out
The book is a reporter’s memoir, and the criticisms follow from that. It is the FT’s story, so the short sellers, the other journalists and the insiders who took the real risks appear as supporting cast; several of them have told their own versions. It is thin on the mechanics of the accounting, on what EY actually did in each year and why, and on the internal governance of Wirecard, because McCrum’s sources were outside and below the board rather than inside it; the German parliamentary inquiry and the insolvency administrator’s reports are the places to go for that. And the pace of the narrative, which makes the book readable, also flattens the long stretches in which nothing happened and the company’s defence worked; the reader can finish it feeling that the fraud was obvious, when for most of six years it was not obvious to most people, and the question of why it was not is the one an auditor most needs answered. Those are limits, not flaws, and the book remains the best single account of the case.
Editions, reading time and how to read it
| What | Details | Best for |
|---|---|---|
| Hardback | Bantam Press (Transworld), June 2022, 352 pages | The first edition |
| Paperback | Penguin, 2023 | The edition most readers own |
| Documentary | Netflix’s Skandal! Bringing Down Wirecard (2022), built around McCrum’s investigation | A ninety-minute version for a team that will not read it |
| Reading plan | The 2018 Singapore chapters and the 2019 BaFin chapters first, then the 2020 collapse, then the beginning | An auditor who wants the control failures before the chase |
| Companion reading | The Bad Blood summary for the Theranos parallel; the German parliamentary inquiry report for the institutional post-mortem | Seeing the pattern across cases |
A one-hour discussion guide for an audit team
- Ten minutes: the cash question. List every account in the organisation’s cash reconciliation that is not reconciled to a statement obtained by direct system access. If the list is empty, confirm how anyone knows.
- Fifteen minutes: the unvisited profit. Name the revenue streams that are material and intermediated, in which a partner, agent or distributor stands between the organisation and the end customer. Ask when each was last verified at the partner.
- Fifteen minutes: who instructs the investigator? Read the organisation’s policy on allegations against senior management. Identify who scopes, who pays, who receives the report. Compare with the Singapore episode.
- Ten minutes: the allegation protocol. Recall the last public or internal allegation of financial misconduct the organisation received, and reconstruct the response in the book’s terms: was the claim tested, or the claimant?
- Ten minutes: the plan. Decide which of the eight tests in the map the function has performed in the last three years and whether the gaps belong in the next plan; the risk assessment guide describes how to document the decision.
Worked example: Thornwick Bank tests its acquiring business
Thornwick Bank is a fictional $62 billion regional bank with a merchant acquiring unit that, like many, uses partner processors for merchants in sectors and geographies it does not serve directly. Its internal audit function of twenty-four people added a Wirecard-framed review of the unit to the 2027 plan after the audit committee chair asked whether the bank could have a Wirecard problem. The review used the eight tests above.
| Wirecard question | What Thornwick found | Result |
|---|---|---|
| Is every cash balance confirmed by direct access? | All operating accounts were reconciled to statements pulled by treasury from the banks’ portals; one settlement account at a partner processor was reconciled to a monthly PDF the partner emailed | Finding: the partner account to be reconciled to the card schemes’ settlement reports and confirmed directly with the partner’s bank |
| Is intermediated revenue verified at the partner? | Partner volumes were reconciled monthly to scheme data; no one had visited the largest partner in four years | Observation: an annual on-site review added to the vendor management programme; the third-party risk guide cited |
| Who instructs investigations into senior management? | The policy routed allegations to the general counsel, who could escalate to the audit committee at discretion | Finding: policy amended so that allegations involving executives go to the audit committee chair directly |
| Is the hotline independent and reviewed? | Operated by a vendor, cases reviewed quarterly by the audit committee; two cases older than a year were open with no activity | Finding on case management; the two cases closed within the quarter |
| Are acquisitions screened for related parties? | The unit had made no acquisitions; the bank’s acquisitions policy required screening but had no step for tracing consideration | Observation: the policy was updated for future use |
| How did the bank handle its last public allegation? | A 2025 social-media allegation about a merchant category was logged, investigated by compliance and reported to the board within a month, with the evidence attached | No finding; recorded as a strength |
| Does the structure defeat verification? | Three partner arrangements lacked a documented business rationale beyond “legacy” | Observation: rationale documented; one arrangement terminated as unnecessary |
| Does internal audit have access? | The charter guaranteed access to bank entities; it was silent on partners | Finding: partner contracts to include audit access rights at renewal |
The review produced three findings and three observations, none rated high, and the audit committee’s response was that it had learned more about how the unit actually worked from the Wirecard framing than from the previous three routine reviews combined. The bank did not have a Wirecard problem. It had the ordinary set of gaps, a partner reconciled by PDF, a charter that stopped at the legal-entity boundary, an investigation policy that routed through the executive, that a fraud of that kind would exploit, and it closed them. That is what reading the book is for.
Frequently asked questions
How is Money Men different from the other Wirecard books and the documentary?
It is the reporter’s account, strongest on the sources, the documents and the campaign against the critics. The German parliamentary inquiry and the insolvency administrator’s reports are better on the accounting and governance detail; the documentary tells the same investigation in condensed form.
What did EY do wrong, in audit terms?
The regulatory findings centred on reliance on confirmations and trustee arrangements that were not independently verified, and on a failure to respond adequately to the warning signs of 2016 to 2019. Germany’s audit oversight body imposed a two-year ban on new public-interest audits in 2023.
Could internal audit have caught it?
Not while it reported into the executives running the fraud and had no access to the partner network. The lesson is structural: functional reporting to the audit committee, a charter that reaches partners and remote entities, and an investigation policy that bypasses the executive for allegations against it.
What is the single most important control the book points to?
Direct, auditor-obtained confirmation of cash, with system access to every material account. Every other part of the fraud depended on the cash being accepted on paper.
Is the Wirecard pattern specific to Germany or to payments?
No. The combination of remote intermediated revenue, cash held by third parties, a hostile response to critics and a board that deferred to management appears in cases across jurisdictions and sectors; the corporate scandals guide sets several of them side by side.
Where does the book sit in the reading list?
In the fraud and scandal group of the internal audit reading list, beside Bad Blood, The Smartest Guys in the Room and Billion Dollar Whale.
Related guides
- Fraud Risk Management: Assessment, Controls and Analytics — the framework the book’s failures map onto
- Corporate Scandals and the Internal Audit Lessons — Wirecard beside eleven other cases
- Bad Blood: Summary and Review — the Theranos parallel: a story that silenced its critics
- Third-Party Risk Management End-to-End — verifying the partners the profit comes from
- The Audit Committee Playbook — the committee that insists on primary evidence
- What Internal Audit Can and Cannot Do: Authority, Access and Limits — the charter that reaches the partner network
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
- No One Would Listen by Harry Markopolos: Summary and Lessons for Auditors — Madoff and the warnings the SEC did not act on
Leave a Reply