Reporter Who Brought Down Wirecard Details Sprawling ‘Corporate Espionage’ Operation

As Germany finally officially drops its investigation into the Financial Times over the paper’s pursuit of Wirecard, a campaign for which it was eventually vindicated, the Financial Times investigative reporter who broke the story is opening up about the experience of trying to take down a veritable corporate titan, and how both Wirecard and elements within the German government tried to silence him and the FT.

The above-mentioned investigation is perhaps the most egregious example of this conduct. While Wirecard was carrying on a massive fraud in southeast Asia, conjuring billions of dollars in profits via an elaborate shell game, its now-former CEO Markus Braun was working to strike a deal with Deutsche Bank that could have served as a neat coverup.

In a statement released yesterday, Munich prosecutors said the information reported by McCrum and a colleague was “basically correct”. BaFin, the German financial watchdog that recommended the investigation, said it had no objections to dropping the investigation into the FT, though BaFin says it’s still looking into possible manipulation by short-sellers.

In a story that’s, in some ways, reminiscent of a certain actress’s story about how Harvey Weinstein cowed her into keeping quiet about a sexual assault perpetrated by him, McCrum recounts how German regulators, and later prosecutors, accused him of an illegal conspiracy. Wall Street analysts accused him of unscrupulously working with short sellers. He was stalked by shadowy figures. His emails were hacked, and swarms of twitter bots slandered him online and taunted him about “going to jail”. At times, white-shoe law firms demanded that his employer, the FT, fire him immediately.

At times, McCrum wrote, it felt like “the world had gone mad”. But he persevered, mostly because he had a high degree of confidence in his reporting, and because he and the FT’s editors and lawyers had braced for a long, difficult road from the beginning.

I’d investigated Wirecard since 2014, following a tip that something was awry with the accounts. Together with the FT’s investigations team editor Paul Murphy and in-house libel lawyer Nigel Hanson, we had learnt what to expect from scrutinising the company: furious online abuse, hacking, electronic eavesdropping, physical surveillance and some of London’s most expensive lawyers.

After publishing their first major report on leaked allegations of rampant fraud at the company, Jan Marsalek, the WIrecard COO who is currently a fugitive from justice, started finding ways to push back against McCrum and his reporting by identifying the reporter’s sources and trying to influence them.

It was amid this tumult that Paul Murphy, who at the time edited FT Alphaville, took an odd phone call. A stock market speculator and gossip who Murphy spoke to in private on a pretty regular basis — call him Bill — wanted to make an introduction. Was Murphy really sure about “the stuff on Wirecard” on FT Alphaville, he asked? Bill said he was in touch with someone who vehemently disagreed. His name was Jan Marsalek.

Marsalek, then just 36 years old, was the chief operating officer of Wirecard and the mastermind of its dirty-tricks operation. A suave dealmaker who lived half his life in private jets and luxury hotels, he thrived where the worlds of business, crime, politics and spycraft intersect, a solid gold credit card tucked in the pocket of his designer suit. We now know that he had a range of secret-service contacts in Russia and Austria, as well as deploying at least a dozen private investigators in multiple countries. Documents seen by the FT indicate Wirecard had a broad toolkit at its disposal, ranging from a cast of social-media sock-puppets spouting propaganda to physical surveillance to sophisticated eavesdropping kit used to mirror iPhones.

However he’d done it, Marsalek had identified one of Murphy’s regular sources — and hoped to use him to influence the FT’s reporting.

Pretty soon, strangers were approaching FT reporters in public, and offering them thousands of dollars to remove critical posts, while also trying to cynically plant positive news that might help bolster the stock.

Within days, Marsalek tried a different route into the FT. Bryce Elder, an equities specialist on the paper, returned from a Mayfair lunch and sat down next to Murphy in the newsroom. “A strange thing just happened to me,” he said. “I was offered money to quietly remove the Wirecard posts from Alphaville. Of course, I told him where to go but he said there’s a takeover bid coming for Wirecard.”

After that incident, Wirecard’s tactics became much more sophisticated, and Marsalek’s behavior even more brazen. Once, Marsalek personally confirmed a phony rumor about an upcoming deal between Wirecard and a major rival based in France.

Dan McCrum

The FT didn’t take the bait, but McCrum and his editors were rattled nonetheless.

In April 2016, rumours started to circulate among London stock market traders that the FT was about to report that Wirecard was in takeover talks, and that the newspaper would issue a correction and an apology for its past coverage. Elder, who keeps his ear close to this rumour mill, was quickly told the terms of the supposed bid: Wirecard would merge with its French rival Ingenico. He also received a name and number to contact for verification of the deal: Jan Marsalek. Marsalek, who was in Moscow at the time, answered his call and confirmed the takeover: Wirecard had supposedly reached heads of agreement with Ingenico in a transaction designed to create a European payment-processing powerhouse. The price would be €60 per share, 70 per cent above the prevailing market price — a bid premium that would stun investors. But as Marsalek spoke, calls were simultaneously going into Ingenico executives from our Paris office. The French were adamant: there were no talks, there was no deal, the story was fictitious. Ingenico even produced an on-the-record statement.

At the FT we were dumbfounded. A senior executive at a large publicly listed European company had brazenly tried to spoof our journalists into running a completely fabricated, highly price-sensitive story. This was simply outside of our experience and, while it cemented our conviction that something was up, it was also deeply intimidating. What other tactics would the company try, I wondered.

Wirecard’s next salvo would strike even closer to home. It included a leaked cache of documents including hacked correspondence from hedge funds betting against Wirecard, as well as copies of McCrum’s emails and doctored chat logs to make it look like the FT was in cahoots with investors, all part of a nefarious conspiracy to pick on an innocent German payments-processing giant.

In December I found out, when screenshots of emails between me and a corporate investigator were posted online for all to see. More worryingly, they appeared along with a collection of doctored chat-message transcripts, presented as evidence that I was synchronising the publication of Wirecard-related content with various hedge funds. Wirecard’s associates, helped by an Indian hacker team, had invented their own “whistleblower” who published this cache of supposed evidence as a file called Zatarra Leaks. It included hacked correspondence between hedge funds, clandestine surveillance photos of investors at their homes — and my emails. This was accompanied by a rabid conspiracy about London-based traders and corrupt journalists ganging up on an innocent German technology company. Panicked, I replaced all my personal electronics and spent days setting elaborate passwords on every device. On the advice of Sam Jones, who covered the security services for the FT, I attached a timer to my WiFi router to turn it off at night and reduce the opportunity for attack.

When the paper pressed on undeterred, Marsalek arranged an interview with McCrum and his editor through a back-channel. The rumor was that he was planning to offer them $10 million to drop the investigation.

In early 2018, Murphy was lunching with one of his regular “bid-gossip” contacts at Signor Sassi, a splashy Italian restaurant near Harrods, when Wirecard came up in conversation. “You know they will pay you good money to stop writing about them,” the market contact stated. Murphy smiled, dismissing the idea. “No, I’m serious, they will pay you proper money,” he insisted. “They will pay you $10m. Go and talk to Bill. He’ll help you.”

Our immediate assumption was that this was a trap — a sting to demonstrate an FT journalist could be bribed. If there was going to be a lunch with Marsalek, we had to monitor it covertly. The meal in question was arranged with surprising speed — for February 16 2018 — and, ultimately, took place at a steak restaurant at 45 Park Lane, where the prices naturally limit the number of people dining on any given day. Along with Marsalek came Bill and his son, plus a mysterious character called Sina Taleb, who couldn’t quite explain why he was there. Nearby, presenting themselves as three “ladies who lunch”, were Cynthia O’Murchu and Sarah O’Connor from the FT investigations team, as well as Camilla Hodgson, then a trainee FT reporter. They discreetly videoed proceedings with a high-tech handbag, while Murphy was covertly mic’d up

It was for naught: Marsalek didn’t offer Murphy $10m. It may be that a last-minute venue switch exposed our amateur surveillance, or he wanted Murphy to make the incriminating “ask”. Marsalek did voice his belief, based on what he claimed was his direct experience, that journalists could be easily bought. And he repeatedly pressed his line that, knowingly or otherwise, I was working with short-sellers to damage Wirecard stock.

During that lunch, McCrum said, Marsalek openly admitted that he was running a spy operation into the FT.

What Marsalek also admitted to, albeit indirectly, was running a spying operation against us. (“Maybe friends of mine did it,” he said.) And he explained, almost candidly, why this was needed: a misinformed or malicious FT story represented an “existential threat” to Wirecard, which, like any financial institution, had to retain the trust of those it did business with. “If we lose our correspondent banking relationships, the business would go down almost overnight,” he said.

In October 2018, McCrum and one of his colleagues finally met in person with a whistleblower in Singapore who leaked a cache of documents to the FT that offered clear proof of manufactured cash flows via a process known as “round tripping”. When the FT moved to publish its next report, editors were surprised when, just hours before it went live, contacts started asking questions about an impending story. Floored by the possibility that they might have a leak, despite all the precautions taken, McCrum and his editor swiftly realized that the leak had come from Wirecard. It was clear Marsalek was now trying to frame the FT for working with speculators.

At Sweetings, he’d taken a call from a market trader, who said he’d heard there was a Wirecard article coming at 1pm and wondered what we were reporting. We sat and rolled through the names of those who knew we were planning to publish that day: the two of us, Nigel the lawyer, Lionel the editor. That was it. The copy wasn’t even in our content-management system yet. There was no leak from the FT. The penny dropped: any leak must have come from Wirecard. Alerted by our questions, it had spread the news through the London market and once again was about to accuse us of collaborating with market speculators. The evidence was in the reference by Murphy’s caller to publishing at 1pm. We were never going to publish at that time; 1pm was simply the deadline given for comment. Right on cue, a letter arrived from Schillings: “Our client has been informed of large and unusual short positions being taken out this morning against it, in anticipation of the publication of damaging information or allegations about it which would negatively impact its share price, as previous Financial Times articles have done . . . The repeated pattern of collusion with market players and, particularly, the timing of the short positions being taken out coinciding with Mr McCrum’s approaches, is particularly suspicious . . . ”

Even more amazing: Almost the entirety of the German business establishment, including BaFin, the German financial regulator, sided with Wirecard over the FT. Soon Munich prosecutors had opened a criminal investigation into McCrum. False claims that McCrum and a colleague had tried to bribe the company’s southeast asian partners also spread. BaFin followed up the investigation with something even more extraordinary: a ban on short-selling in Wirecard shares. This, combined with news that Japan’s SoftBank – back in the news late this week – had just backed Wirecard to the tune of more than $1 billion.

Wirecard shares came roaring back. And yet, despite the company’s seeming invulnerability, Wirecard’s efforts to target critics and shortsellers only intensified. Soon, the company hired a former head of Libyan intelligence, who in turn worked with an old contact from MI5 to build a team of nearly 30 operatives to surveil not just McCrum, but a whole gaggle of reporters and investors bound by the common thread that they were all Wirecard skeptics.

The list of targets included Hedge Fund legend Crispin Odey.

Overseeing the surveillance effort was a maverick Libyan, Rami El Obeidi. He was briefly the head of foreign intelligence in the transitional government installed after the country’s leader Colonel Gaddafi was killed in 2011. He liked to be addressed as “The Doctor” and always stayed at the Dorchester when in London, meeting there with officials from the UK’s Financial Conduct Authority to press a case that I was crookedly conspiring with short-sellers to bring Wirecard down.

It was “Dr Rami” who brought in an ex-special forces guy from Manchester called Greg Raynor to work the Wirecard case. He, in turn, reached out to an ex-MI5 counter-terrorism operative, Hayley Elvins, and together they assembled a collection of 28 private investigators to follow me, my colleagues and a baffling array of investors and hedge fund bosses, including Crispin Odey.

It was pretty clear by now that the FT had become a huge moneymaking machine for these black operations pressing back against our reporting. Arcanum Global, owned by Ron Wahid and advised by a string of former senior military, policing and intelligence leaders, had a £3.2m contract with Wirecard. Elsewhere Charlie Palmer, partner in the public relations arm of FTI Consulting, failed to get the Mail on Sunday to reprint nonsense written by newspapers in the Philippines.

In October 2019, McCrum and the FT finally published the story that sealed Wirecard’s fake. After spending months trying to track down Wirecard’s Southeast Asian “partners” – and running into dead end after dead end – the paper published a story claiming most of Wirecard’s revenues from the region, ostensibly its most profitable operation, were fraudulent.

It only took another 8 months of dithering from the German authorities before Wirecard finally collapsed in the face of an auditor report confirming $2.1 billion was missing from Wirecard’s balance sheet.

Now, Marsalek is an international fugitive, and McCrum has clinched the biggest corporate takedown by a crusading journalist since the fall of Theranos.