A German appeals court has ordered a corporate treasury chief to personally repay millions sent to fraudsters posing as his bosses. It held that a directors and officers insurance policy paid for by his employer removes the protection German law normally gives employees who cause damage at work. The July 31 judgment by the Landesarbeitsgericht Köln, the higher labor court in Cologne, was brought to wider attention Friday by heise online. It is under appeal at Germany’s Federal Labor Court. If upheld, it would change how companies think about payment controls and who their D&O policies cover.

What Happened

The case involves CEO fraud, a scam in which criminals impersonate senior executives to pressure an employee into urgent, confidential payments. It is a variant of business email compromise. According to the published judgment (case 8 SLa 603/25), the employee was head of global treasury at the German arm of a multinational group. Neither he nor the company is named.

On July 11, 2024, he received a call from someone posing as the group’s chief financial officer. The conversation moved to WhatsApp and private email on his personal phone, and a fake chief executive and a fake lawyer later joined a WhatsApp group. Between July 15 and Aug. 9, 2024, he made 59 transfers in euros and dollars to outside accounts. The largest was 1.977 million euros. All were executed manually outside the company’s normal SAP payment system, although the group’s approval rules call for a four-eyes, or two-person, sign-off. Heise puts the total loss at more than 50 million euros. The judgment lists the transfers individually.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

The fraud ended when police contacted the company on Aug. 9, 2024. He was dismissed in September 2024. The appeals court upheld the dismissal and ordered him to repay the transfers, minus sums the company has recovered. It also declared him liable for further losses.

The Court’s Reasoning

The court found gross negligence from July 18, 2024, onward, rather than from the first transfer. It pointed to his move onto private channels the company did not use, a mismatch between the calling number and the WhatsApp contact, and weeks without contacting the supposed executives directly. He had also taken part in a deepfake CEO-fraud training video in late May 2024 whose message was to call back before acting. In a chat message on July 18, he acknowledged having sent about 9 million to 10 million euros without proof or reasonable details.

German case law usually limits how much an employee must repay, even after serious mistakes, when the damage far exceeds what the person could ever pay. The court held that this relief falls away here. The employer financed a D&O policy covering him for up to $150 million per claim, so the risk of personal ruin was insured. D&O insurance is coverage a company buys to protect senior staff against personal claims over decisions made on the job.

The court rejected his arguments that poor training, IT security gaps or weak controls at the company shared the blame. It found he had ignored the training’s core instruction and broken documented rules himself. It admitted an appeal because the role of D&O cover in employee liability is “umstritten,” or disputed, and of fundamental importance. The case is pending at the Federal Labor Court as 8 AZR 164/26.

Why It Matters

For boards, the ruling links three decisions they often treat separately: payment approval rules, fraud training and whom the D&O policy covers. Heise noted that many companies include chief information security officers, IT heads and other senior staff in their D&O cover. Under this reasoning, they could face unlimited liability if they release access or money after a fake call. Heise also noted that the company, not the employee, paid the premiums. Whether the insurer actually pays depends on the liability becoming final.

The ruling also shows the evidence courts weigh. Clear written rules on approvals and communication channels, and records showing staff were trained, decided this case against the employee.

What to Watch

  • The Federal Labor Court’s handling of case 8 AZR 164/26; neither the judgment nor heise’s report gives a hearing date.
  • Whether D&O insurers respond by changing policy terms for social-engineering losses or for non-board staff.
  • Whether companies revisit call-back rules and bans on private messaging for payment approvals in light of the ruling.