On 18 June 2020, the auditors at Ernst & Young told Wirecard’s management board they could not confirm that EUR 1.9 billion the company claimed to hold in two Philippine bank accounts actually existed. Within four days, Wirecard would admit the money probably never had. Within a week, the most valuable fintech in Europe — a member of Germany’s DAX 30, briefly worth more than Deutsche Bank — would file for insolvency.
The forensic question is narrow and strange. How does almost two billion euros disappear from a balance sheet when it was never there to begin with? The answer lies in a paper trail that ran through Manila, two of the largest banks in the Philippines, and a set of documents that the banks themselves said were fake.
The money that was supposed to be in Manila
Wirecard’s official story, repeated to investors for years, was that the company processed payments for clients it could not legally hold accounts for directly — high-risk merchants in places where Wirecard did not have local licences. To handle those flows, it used what it called “third-party acquirers,” partners in Asia who collected the cash on Wirecard’s behalf and parked the proceeds in escrow accounts at local banks.
By 2019, those escrow balances had grown to EUR 1.9 billion. On paper, the money sat in trust accounts at two Manila institutions: BDO Unibank and Bank of the Philippine Islands. The auditors at EY had been signing off on Wirecard’s accounts for a decade. Each year, the third-party acquirer business reported the fattest margins in the group. Each year, the cash balances grew.
The trouble was that no one at EY had ever physically confirmed the accounts existed by talking directly to the banks. Confirmation letters, instead, were funnelled through a Manila-based trustee, who in turn produced documents on what appeared to be BDO and BPI letterhead.
Seven days in June
In April 2020, KPMG completed a separate special investigation that Wirecard had commissioned to silence years of fraud allegations from the Financial Times. The KPMG report could not verify the existence of the third-party acquirer revenues. It was the first crack.
Two months later, EY refused to sign off on the 2019 annual accounts. Wirecard’s chief executive Markus Braun went on video on 18 June and suggested the company might be the victim of a large-scale fraud, an attempt to frame Wirecard itself as deceived rather than complicit.
That framing collapsed within forty-eight hours. On 21 June, Benjamin Diokno, governor of the Bangko Sentral ng Pilipinas, told reporters in Manila that the EUR 1.9 billion had never entered the Philippine financial system. Both BDO and BPI, he said, had checked their records. Neither had ever had Wirecard as a client.
Diokno stated in remarks reported by Deutsche Welle that their investigation found no money had entered the Philippine financial system and that both banks had no records of Wirecard as a client. He added that the scandal had fraudulently used the names of two major Philippine banks to conceal the perpetrators’ activities.
The documents linking the banks to Wirecard’s escrow accounts, Diokno said, were fake.
On 22 June, Wirecard’s management board issued an ad-hoc disclosure conceding that the EUR 1.9 billion most likely did not exist. On 25 June, the company filed for insolvency. Markus Braun had already resigned. His chief operating officer, Jan Marsalek, had vanished.
The mechanics of a forged escrow
To understand how the documents passed muster for so long, you have to picture the chain of custody. Wirecard did not claim to hold the accounts itself. The accounts were held by a third-party trustee, who held the money in trust for Wirecard’s clients, at banks Wirecard had no direct relationship with. Each link in the chain reduced what could be verified directly.
When auditors asked for confirmation, the request went to the trustee. The trustee produced bank statements and confirmation letters. Those letters bore what looked like the letterheads of BDO and BPI, with what looked like the signatures of bank officers. EY relied on screenshots and faxed copies for years before finally, in 2020, demanding direct contact with the banks.
When that contact happened, both banks said the same thing: the documents were not theirs. Philippine prosecutors later filed charges against a bank executive, while clearing several others, in a case that named a former Department of Transportation official among those tied to forged documents.
The structure worked because each party in the chain had an alibi. The banks did not know their letterheads were being copied. The trustee — a Manila lawyer named Mark Tolentino, appointed in 2019 — who held no real money, was the choke point. And the auditors, who should have been the backstop, accepted documents that travelled through too many hands.
The forensic puzzle does not end with the forgery. The EUR 1.9 billion was not merely cash that disappeared. It was the accounting plug that made the rest of the business look profitable.
Wirecard’s third-party acquirer revenues — the supposed payments processing in Asia — accounted for a substantial portion of the group’s reported profits in the years before 2020. Take away those revenues and what remained was a payments business that was, at best, marginally profitable, and at worst losing money. The escrow balances were the visible proof that the revenues were real. As long as the cash pile kept growing, the profits looked credible.
The cash pile was the alibi. Once it evaporated, the entire growth story did too. Wirecard’s share price collapsed in the space of a week. The company’s auditors at EY, who had signed off on the accounts for more than a decade, became defendants. German prosecutors opened criminal investigations into Braun and his colleagues. Braun denies wrongdoing and says he was deceived by subordinates; his trial in Munich has been underway, with proceedings continuing.
The man who vanished
The other half of the forensic question is who actually moved the paper. Jan Marsalek, the Austrian chief operating officer who oversaw the third-party acquirer business, disappeared in the days following the scandal’s exposure. Reports indicate he fled to Russia.
Marsalek had spent years cultivating contacts in Russian intelligence circles. Investigative reporting by The New Yorker and a joint investigation by Der Spiegel, ZDF and The Insider has since placed him in Moscow, where German prosecutors believe he is being protected. The Bundeskriminalamt has had him on an international wanted notice for more than five years.
The forensic significance of Marsalek is not just where he ended up. It is that the person with operational responsibility for the third-party acquirer business — the part of Wirecard that did not exist — was the one with the means and the contacts to disappear cleanly within seventy-two hours of the auditors raising the alarm.
For those interested in the broader context of this scandal, Silicon Canals has a detailed video examining the full scope of what became one of Europe’s largest financial frauds, including the intelligence connections that made it possible.
What the auditors saw and did not see
The KPMG special investigation, published in April 2020, is the cleanest forensic record of how the escrow story unravelled from the inside. KPMG examined transactions across three third-party acquirer partners — in Dubai, the Philippines and Singapore — and reported it could not obtain the original documentation to verify the revenues. The auditors’ phrasing was careful, but the message was clear: the evidence Wirecard had been giving its statutory auditors for years was not the kind of evidence a forensic accountant could trace to a counterparty.
That phrasing — that the auditors could not verify — is what triggered EY’s refusal to sign two months later. The two events were sequential. The KPMG report exposed the absence of original documents. EY then demanded the originals from the banks themselves. The banks said the documents did not exist.
EY itself has since faced regulatory sanction in Germany. The Apas, the German audit watchdog, fined the firm and barred it from accepting new listed-company audit mandates for two years. Several individual EY auditors face professional sanctions. Civil litigation by Wirecard’s creditors and shareholders continues in courts across Europe.
The trail that ended on letterhead
What makes the Wirecard case unusual in the catalogue of financial frauds is not the size, although EUR 1.9 billion is large by any measure. It is the simplicity of the final step. The fraud did not require a complex derivatives structure or a hidden subsidiary network. It required a printer, a plausible letterhead, and a chain of intermediaries long enough that no auditor ever picked up a telephone to the bank named on the page.
BDO and BPI, when finally asked directly, took less than seventy-two hours to confirm what a single phone call years earlier could have established: they had never heard of Wirecard. Statements from both banks and from the Philippine central bank were unequivocal. No accounts. No client relationship. Fabricated documents.
The forensic mechanism, stripped to its essentials, was this: a company invented a stream of profits, invented the bank balances that proved the profits were real, invented the trustees that held the balances, and invented the bank confirmations that verified the trustees. Each layer of the invention pointed at the next layer for validation. None of the layers pointed at anything that could be physically counted.
For five years, the Financial Times reporter Dan McCrum had written that the Wirecard business model did not add up. The Bundesanstalt für Finanzdienstleistungsaufsicht — BaFin, the German regulator — responded in February 2019 by banning short-selling of Wirecard shares, the first time it had ever shielded a single listed company that way, and later referred a suspected market-manipulation case to Munich prosecutors, who were already investigating McCrum. The regulator was treating the people pointing at the empty room as the threat.
The room turned out to be empty on a Thursday afternoon in Aschheim in June 2020, when EY refused to sign. By Sunday, the Manila banks had said the documents on their letterhead were not theirs. By the following Thursday, the company was insolvent. Six years on, Markus Braun’s trial continues in Munich. Jan Marsalek, according to investigators tracking his Moscow life, is still there. The EUR 1.9 billion is still where it always was, which is nowhere at all.
