A German court recently held a manager personally liable for millions of euros in damages following a case of CEO fraud. The company did not carry the bill. The employee who approved the payment did. The reason was not simple negligence in the usual sense. There had simply never been a documented policy for who within the organisation is allowed to authorise payments, and how those approvals are checked. That missing policy, not the fraud itself, decided who ended up paying the price.
What happened in this case
The case centred on a classic form of CEO fraud. An employee received a message that appeared to come from senior management, with an urgent request to transfer a large sum to an external account. The message looked urgent and convincing enough to be acted on without further consultation. Only later did it become clear it was fraud, by which time the damage was already done.
The court did not only look at the fraudster, who was probably unreachable anyway. It looked mainly at the organisation itself. Was there a procedure that should have stopped this payment? There wasn’t, and that gap was held personally against the manager.
Why this goes further than a clever phishing email
CEO fraud does not rely on viruses or complicated hacking techniques. It relies on trust, time pressure and hierarchy. Someone who believes they are carrying out an instruction from the director is unlikely to push back quickly. Spam filters and secure email systems catch some of these attempts, but a well-written message at the right moment always slips through.
The real weakness lies in the question of who is allowed to approve a payment, and whether there is always a second check on that. If that question has never been answered, nothing protects an employee when things go wrong. And nothing protects the management from the consequences either.
Policy comes before technology
At Motics, in cases like this we look at policy first and technology second. You can buy the best security software available and still be vulnerable, as long as no one has written down who in your company is allowed to approve a payment above a certain amount. Good payment policy does not need to be complicated. It should include at least:
- a clear amount above which a second person must review and approve the payment
- a fixed way to verify an unusual or urgent request, for example by calling a known number instead of replying to the email
- agreements on what employees should do when something needs to happen quickly, since fraud often relies on urgency
- a clear owner responsible for keeping these agreements up to date
This does not need to become a thick protocol. One clear page that everyone knows and follows works better than an extensive document that sits in a drawer.
How to address this now
Start by measuring, not by inventing rules. First map out how payments are actually approved in practice today, regardless of what may once have been agreed. Ask the people who process payments daily how they currently decide whether something is legitimate. Often the actual practice differs from what management assumes is happening.
Then write down what is and isn’t allowed, in plain language, without turning it into a legal document. Take the time to explain this to everyone involved in payments. Not as a control measure that signals distrust, but as protection, for the company and for the people carrying it out. Give explicit permission to pause and verify a payment, even if it appears to come from the director personally. Someone who is afraid to push back against the boss will not stop fraud.
Finally, make sure this policy is demonstrable: a dated document showing when it was established, who knows it, and when it was last updated. The feeling that you always do it this way is not enough on its own.
What this means for you as a director
This German case goes further than one unfortunate employee. It shows how courts increasingly look at responsibility within companies. The person who actually makes the mistake is no longer the only one in the spotlight. The person who should have put a workable framework in place comes into view too. As a director, you are the one who sets that framework. This is not a task for the ICT department or the bookkeeper alone, it is a governance responsibility. It starts with something simple: writing down who may approve which payment, and checking that regularly.
This fits a broader movement, visible among other things around NIS2, where companies are increasingly expected to demonstrate that they manage their risks. That starts with documented agreements about who is responsible for what, on paper and dated.
A few questions we’re often asked
Does this risk apply to smaller businesses too, or mainly to large organisations?
Smaller businesses are particularly exposed here, because payment processes are often arranged informally and rely on short lines between management and bookkeeping. The smaller the company, the greater the chance that one person can make a large payment without a second check. The vulnerability lies in how that process is set up, regardless of the size of the organisation.
Doesn’t cyber insurance protect us against this kind of damage?
Insurance can limit the financial damage once something goes wrong. Insurers, however, increasingly check whether an organisation had taken reasonable precautions before paying out, and a missing payment protocol can make that payout more difficult.
Do I need to overhaul my entire payment process now?
Usually not. Most companies already have a reasonably sound practice, it just isn’t written down anywhere and has never been made explicit. The task is to capture what already works well and close the loose ends, not to start from zero.
How do I prevent this policy from only existing on paper?
Involve the people who work with it daily when drafting it, so it fits their actual work instead of becoming an extra layer of bureaucracy. Also schedule a fixed moment, for example once a year, to check whether practice still matches what has been written down.
Curious how your own company stands on this front? We’re happy to think along about a payment policy that fits how your organisation actually works, and to help you make it demonstrable.
