The clearest accounting fraud red flags are not buried in a footnote. In the Wirecard case they were structural: profits that never arrived as cash the company held itself, €1.9 billion said to sit in trust accounts run by someone else, a profit engine built on partners outsiders could not visit, and a company that went after the people asking questions instead of answering them.
Wirecard was a member of the DAX, Germany's index of its largest listed companies, and was audited every year by one of the four largest accounting firms. None of that stopped its own board announcing, on 22 June 2020, that the €1.9 billion most likely did not exist. The film above tells the story. This page pulls out the checks an ordinary investor, lender or business owner can actually run.
What are the red flags of accounting fraud?
Five recur in the Wirecard case: reported profit that does not turn into cash, cash held by a third party rather than the company, profit concentrated in a few hard-to-verify partners, results that are delayed or withdrawn, and a company that attacks critics. Wirecard showed all five before its €1.9 billion hole was admitted in June 2020.
None of these proves fraud on its own. Plenty of honest companies hold money with third parties, use partners, or file late. What makes them red flags is that each one widens the gap between what the company says and what an outsider can independently check. Fraud lives in that gap, and Wirecard's partner business lived almost entirely inside it.
The five, one at a time, with the document behind each.
Red flag 1: Profit that never becomes cash the company holds
Check the cash flow statement against the income statement. The SEC's beginners' guide to financial statements puts it plainly: "While an income statement can tell you whether a company made a profit, a cash flow statement can tell you whether the company generated cash." A company can report rising profit for years while its own bank balance tells a different story.
Wirecard's version was specific. The profit from its partner business was not described as cash in Wirecard's own accounts. It was said to be held in trust accounts for Wirecard's benefit, and the company's 22 June 2020 statement confirms it had reported those balances "as an asset in its financial accounts". An asset you can only see on someone else's letterhead is the first thing to question.
Red flag 2: Money held by someone else, confirmed by a letter
A third party's letter is only as good as the third party. On 6 January 2026 a Singapore court sentenced the trustee R Shanmugaratnam to 10 years and James Henry O'Sullivan to 6.5 years. The Singapore Police Force says the trustee's letters falsely represented that his firm, Citadelle, held over €1.1 billion of Wirecard funds in escrow.
The trustee has said he will appeal. The point for anyone reading accounts is the mechanism: for years, the evidence that the money existed was a document produced by a small firm, about money in accounts the company did not control. When the money was said to have moved to two Philippine banks, the governor of the Philippine central bank said that "None of the missing $2.1 billion of German firm Wirecard entered the Philippine financial system," as reported by GMA News on 21 June 2020.
Red flag 3: Profit from partners nobody can visit
Ask where the profit is earned, and whether anyone outside the company has seen it. Wirecard's high-margin profit came largely through "third party acquiring", where licensed partner companies processed payments in markets where Wirecard had no licence. In its own June 2020 statement, the board said that "previous descriptions of the so called Third Party Acquiring business by the company are not correct."
Using partners is normal. Depending on them for most of your profit, while the partners are small, hard to find and never visited by investors, is not. If a company's best numbers come from the part of the business with the least outside evidence, that is where the questions belong.
Red flag 4: Results that are delayed, then withdrawn
A late or withdrawn set of results is information. On 18 June 2020 Wirecard was due to publish its annual accounts and did not, because its auditor could not confirm the €1.9 billion. Four days later the board withdrew its preliminary 2019 results, its first-quarter 2020 results and its forecasts for 2020 and 2025, and warned that "Potential effects on the annual financial accounts of previous years cannot be excluded."
An auditor declining to sign, or a company retracting numbers it had already confirmed, is the moment the gap between story and evidence becomes visible to everyone. Investors who waited for that signal were already too late: the shares lost most of their value within days.
Red flag 5: A company that attacks its critics
A company with nothing to hide wants the question answered. In February 2019, after Financial Times reporting on Wirecard's Singapore office, Germany's regulator BaFin issued a general decree banning new short positions in Wirecard shares from 18 February to 18 April 2019, about two months. The reporters themselves were then investigated.
Munich prosecutors later closed that investigation. The general rule holds well beyond Germany: when a company answers a specific, checkable question with lawsuits, complaints to regulators or attacks on the person asking, rather than with the evidence, the response tells you more than the accounts do.
How did Wirecard fake its profits?
By reporting income it could not show. Wirecard booked profit from partner companies that outsiders could not verify, said the cash was held in trust accounts managed by others, and relied on trustee letters to confirm it. Its board admitted in June 2020 that €1.9 billion in those accounts most likely did not exist.
The visible business was real. Wirecard did process card payments and earned fees on them. What inflated it into a company once valued among Germany's largest was the partner business layered on top, which existed mainly as revenue figures, trust balances and letters.
That is why the accounting looked clean for so long. Every number had a document behind it. What was missing was anyone checking the document against the real world, which in this case meant asking the banks directly.
Can an audit catch accounting fraud?
Only if the auditor checks with the source. The US auditing standard on confirmation, AS 2310, effective for fiscal years ending on or after 15 June 2025, says: "The auditor should send the confirmation request directly to the confirming party and obtain the confirmation response directly from the confirming party."
The same standard requires confirmation procedures specifically for cash held by third parties. That is the exact category Wirecard's missing money sat in. When the question finally reached the Philippine banks in June 2020, both said they had never held the money, and the hole was out in the open within the week.
Germany's audit oversight body, APAS, later found failings in EY's audits of Wirecard for 2016 to 2018. Legal Tribune Online reported in April 2023 that the firm was fined €500,000 and barred for two years from taking on new statutory audits of public-interest companies. An audit opinion is a useful signal. It is not proof that anyone asked the bank.
How can an investor spot fake profits?
Run 3 checks that cost nothing. Compare operating cash flow with reported profit over 3 to 5 years. Find out where the company's cash is actually held and by whom. Then read how management responds to specific public criticism, because evasion, attacks on critics or retracted numbers are cheaper to see than any fraud.
None of these needs a forensic accountant. They need the annual report, the cash flow statement, and a willingness to treat "it is confirmed by a document" as a starting point rather than an answer.
The same discipline applies to a small business. If you run one, or keep the books for one, the core job is matching what the ledger says to what the bank statement says, every month. Our startup finance terms explained covers the vocabulary, and where $464 billion of AI spending went on the books applies the same "follow the cash" reading to the biggest numbers in tech right now.
What happened to Wirecard's executives?
No one at the top has been convicted in Germany yet. Former chief executive Markus Braun has been on trial in Munich since 8 December 2022, as Al Jazeera reported at the opening. He denies every charge, and at the time of writing there is no verdict. Closing arguments are due to begin on 19 October 2026.
Braun's defence is that he was a victim, not a perpetrator: that the partner business was real and that others around Jan Marsalek stole from it. That case deserves to be heard in full, and the court has not yet ruled on it.
Jan Marsalek, the former chief operating officer who left Austria on a private flight to Belarus in June 2020, has never been tried for anything. In Singapore, the trustee who signed the escrow letters has been sentenced to ten years and has said he will appeal.
The honest hard part
The hard part is that every red flag on this page was visible in hindsight and arguable at the time. Third-party acquiring is a legitimate business. Trust accounts are a legitimate tool. Short-sellers do sometimes attack honest companies. Wirecard's defenders made exactly these points, and they were not foolish points to make.
The second hard part is that the people with the most power to check, the auditor, the regulator and the stock index, all leaned on each other's judgement. An ordinary investor cannot phone a bank in Manila. What an ordinary investor can do is notice when a company's best numbers are the ones nobody outside it can verify, and size their trust accordingly.
The third is that the legal story is still being written. A Munich court has yet to rule on Braun, and nothing on this page should be read as a finding against him.
