How much does CEO fraud cost German companies?
In February 2017, the head of financial accounting at a German company received an email that appeared to come from her managing director and transferred €1,490,770 to an account in China. The money could not be retrieved from the receiving account. Cases like this are known as CEO fraud, Fake President or Chef-Masche. Criminals impersonate a senior executive to get an employee to release a payment.
What such cases cost German companies is only partly documented. The most detailed police figures are the BKA's for 2016, revised after a special survey. They show 56 completed cases with €83.9 million in damage, about €1.5 million per case, according to the Bundeslagebild Wirtschaftskriminalität 2017.
The count covers police-recorded cases only. Many companies never report an attack, and a few large losses pull the average up.
For 2013 to mid-2016, BKA figures quoted by Welt am Sonntag put the loss per affected company between €1 million and €18 million. The Bavarian State Criminal Police warns that the transfers in such cases typically run to six or seven figures.
In August 2016, the Nuremberg-based cable maker Leoni discovered that around €40 million had been transferred to foreign accounts through its Romanian subsidiary, using falsified documents and identities. Its IT systems were not affected, but its share price fell more than 7% on the day of the announcement.
Who pays when the money is gone?
A bank recall has the best chance if it starts within hours. Once the money has moved on through further accounts, recovery becomes much harder.
Even when the bank is liable, the company can end up sharing the loss. In the Düsseldorf case, the head of accounting had asked the bank to accept the €1.49 million order by fax as an exception, with a signature supposedly returned by email.
In October 2018 the Regional Court of Düsseldorf ruled (6 O 72/17) that the transfer was not authorized, because the signature was forged, so the bank in principle had to refund it (§ 675u BGB). It also held the company partly responsible, because the accountant had acted negligently.
The court ordered the bank to reimburse €745,410, about half of the transfer, plus interest. The company bore the other half, and the litigation costs were split. How staff handle an unusual request can therefore decide liability, not only whether the money leaves.
Standard cyber policies may not cover a payment that an employee was tricked into authorizing. In Germany, that risk can be covered by fidelity insurance (Vertrauensschadenversicherung). Policies differ in their deductibles and in whether, and up to what limit, they cover social engineering.
The remaining costs are less visible. They include forensics if a mailbox was compromised, legal advice, management and finance hours spent on recall attempts and evidence, and closer scrutiny from banks and auditors.
Reporting duties apply only in some cases. If a compromised mailbox exposed personal data, GDPR generally requires notifying the supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to put individuals at risk.
Companies covered by Germany's NIS2 rules must send an early report within 24 hours of becoming aware of a significant security incident under § 32 BSIG. A payment fraud without compromised systems or personal data may trigger neither, so each case needs its own assessment.
How AI voice cloning and deepfakes increase the risk
A familiar voice or face on a call is no longer proof of who is speaking. In 2019 the CEO of a UK energy company believed he was speaking with the chief executive of his German parent company and transferred €220,000 to a supposed Hungarian supplier. The funds moved on through accounts in Hungary and Mexico, and the insurer, Euler Hermes, covered the loss.
In a 2023 McAfee experiment, three seconds of audio was enough to produce a clone with an 85% voice match, and keynotes, interviews and earnings calls provide far more material than that. Attackers combine that with research from public sources such as commercial register entries, annual reports and LinkedIn profiles, which tell them who approves payments and when executives are travelling. In a typical sequence, an email announces a confidential acquisition, a call with a cloned voice confirms it, and a messenger text adds time pressure.
Video is no safer. In 2024 an employee at Arup's Hong Kong office transferred about $25.6 million after a video call in which the other participants were deepfakes.
German insurers report that fake video and audio recordings are now common in Fake President cases. Verification therefore has to rest on something an attacker cannot copy, such as a callback to a number from your own directory, not the voice or face on the call.
How to calculate the potential financial impact
Take a manufacturer where one person in finance can release up to €400,000 without a second approval. The company has fidelity cover with a €50,000 deductible and a €250,000 sublimit for social engineering.
| Item | Noticed late | Reported within hours |
|---|---|---|
| Fraudulent transfer | €400,000 | €400,000 |
| Recovered through bank recall (30% assumed if reported quickly) | €0 | €120,000 |
| Insurance payout (€50,000 deductible, €250,000 sublimit) | €250,000 | €230,000 |
| Legal, forensic and internal response costs | €73,500 | €73,500 |
| Cost the company keeps | €223,500 | €123,500 |
| Cost without social engineering cover | €473,500 | €353,500 |
All figures are illustrative, and many companies recover nothing.
How companies can prevent CEO fraud losses
The controls that work interrupt the payment instead of relying on someone spotting the email. A well-researched CEO fraud email often has no typos or suspicious links, so annual, email-focused training that teaches people to look for them does little against it. What helps is a payment process that holds up even when the request looks genuine:
- Independent callbacks: verify every unusual payment request by calling a number from your internal directory or vendor master data, never one supplied in the request.
- Dual approval: require two authorized people above a defined threshold and for every first payment to a new account. Both approvers can be deceived, so combine it with callbacks.
- Changed bank details: treat any change to supplier bank details as high-risk and confirm it through a previously known contact before saving it.
- No executive override: document that confidentiality or urgency never justifies skipping verification, including when the CEO asks.
- Fast reporting: give staff one simple reporting path and thank them for false alarms.
- Email authentication: enforce SPF, DKIM and DMARC at p=reject. This blocks spoofing of your exact domain but not lookalike domains or mail from a compromised mailbox.
- Insurance review: check whether fidelity or cyber cover includes social engineering, and at which sublimit.
How revel8 protects against CEO fraud across all channels
Controls only work if people can use them under pressure. The revel8 Awareness Playlist runs highly personalized CEO fraud simulations built with OSINT, so each attack uses the executive names and details a real attacker would find in public sources. The scenarios follow the latest attack methods and run across channels. An attack can start with an email and escalate to a call with a cloned CEO voice or a deepfake video meeting, so finance teams practise the callback under realistic time pressure before a real attacker tests them.
Results are reported at group level, which supports a works agreement with the works council. Book a demo to see a simulation, or hear a cloned voice yourself with the free voice phishing tool.
