CEO fraud: manager liable for 50 million euros

The call from the boss that never was

In a judgment of 31 July 2026 (8 SLa 603/25), the Regional Labour Court of Cologne decided a case that concerns every finance department. A senior executive was responsible, as "Head of Global Treasury", for the strategic and operational management of his employer's finances. He fell victim to so-called CEO fraud, where fraudsters pose as the boss and induce employees to make payments. The story they served up fitted his position: his manager was said to be planning to set up a new company in Asia, and he himself was to become its chief financial officer.

The first contact came through the number listed for his manager in the company telephone directory. This is made possible by so-called caller ID spoofing, where callers falsify the number displayed. He received the further payment instructions via a messenger service on his private mobile number. Within 25 days he arranged almost 60 transfers with a total volume of more than 50 million euros. During that time he did not once check in person with his actual manager.

Summary dismissal and damages claim

When the events came to light, the employer terminated the employment relationship without notice and claimed damages in the amount of the transfers made. The Regional Labour Court found in its favour on both counts: the summary dismissal is effective on account of gross negligence, and the damages claim succeeded.

A person acts with gross negligence if they disregard the simplest precautions that should be obvious to anyone. The accusation against the employee can be summed up in one sentence: at no point did he verify matters personally with his manager. A call back on the known number or a brief conversation would have cleared the matter up. That would have been expected even for a single transfer, let alone for almost 60 transfers over 25 days.

When employees are liable for damage

Employees are not automatically liable in full for damage they cause at work. The case law of the Federal Labour Court (BAG) grades liability according to the degree of fault. Anyone acting intentionally is fully liable, and in principle the same applies in cases of gross negligence. In cases of ordinary negligence the damage is apportioned, and in cases of the slightest negligence the employee is not liable at all. Lawyers call these the principles of limited employee liability.

Even in cases of gross negligence, the court may ease liability in an individual case. In doing so it weighs up all the circumstances, including the size of the loss, the employee's income and whether insurance covers the damage. With more than 50 million euros at stake, such relief would have seemed likely, because no salary in the world stretches to such a sum. That things turned out differently is down to the insurance.

D&O insurance leads to full liability

Even before the employment relationship began, the employer had taken out D&O insurance for the employee with cover of up to 150 million US dollars. D&O stands for directors and officers. It refers to liability insurance for executives, intended to protect them from the financial consequences of poor professional decisions. The company pays the premium, the executive is insured.

It was precisely this policy that proved the employee's undoing. The court refused to ease his liability because D&O insurance financed by the employer protects the employee in a similar way to statutory liability insurance. There was therefore no reason to depart from full liability on grounds of employee protection. The thinking behind this: limited employee liability is meant to prevent an employee being financially ruined by a mistake at work. In the court's view, anyone who is insured does not need that protection. The insurance that was supposed to safeguard the manager thus became the argument for his full liability.

The decision is not yet final: the Regional Labour Court allowed an appeal on points of law, and the case is pending before the Federal Labour Court under file number 2 AZR 164/26. There the key question is likely to be whether D&O insurance financed by the employer rules out any easing of employee liability. Until then the position is this: the combination of gross negligence and D&O insurance can cost an executive the entire amount of the loss.

What this means for companies

For management and finance departments, the decision has two sides. The first concerns the loss after a successful CEO fraud. Anyone who has taken out D&O insurance for their executives can, following this decision, claim the full loss from the executive in cases of gross negligence. What the insurer covers of that depends on the insurance contract. It is therefore sensible to look at the policy before anything happens: who is insured, how high is the cover, which exclusions apply.

The second side matters more, because it applies before any loss arises. The case shows the pattern: a call from the manager's genuine number, a plausible story with career prospects, then instructions via a private channel, and nobody asks any questions. What controls the company had put in place remains unclear. Three rules, however, address precisely the point the court held against the employee:

• Payment instructions are confirmed via a channel you choose yourself, for example by calling back on the known number.
• Transfers above a defined amount are approved by two people.
• Instructions sent via private messenger do not trigger a transfer, but a query.

What executives can learn from this

For the executive, the case is a bitter one: the victim of a fraud, summarily dismissed and, on top of that, faced with a claim for more than 50 million euros. The fact that he himself was deceived did not help him in court. For gross negligence it is enough that the obvious precaution was missing. Bad intent is not required.

The lesson is uncomfortable but simple. Anyone approving payments should have instructions confirmed via a channel they choose themselves. A supposed boss who orders payments of millions by messenger to a private mobile deserves mistrust, even if he dangles a board position. And after this decision, the employer's D&O insurance is precisely the reason for full liability.