Whistleblower retaliation: what it is, what the law says and how to prevent it

In 2018 Pav Gill was Head of Legal for Wirecard in Asia-Pacific. He found evidence of fraud inside the business, raised it through the company, and within months he was out of the company and the investigation he had started was shut down. The fraud he reported was later confirmed to be one of the largest in European corporate history, and Wirecard collapsed in 2020. The report was right. The retaliation worked first.

That is the pattern this guide is about. Not the dramatic version, though Wirecard and Boeing both make an appearance, but the ordinary one: a person raises a concern, the people responsible for the problem find out, and the person's working life gets harder in ways that are easy to deny and hard to prove. It is the single most common reason employees give for not reporting wrongdoing, and the law in the UK, the EU and the US has been rebuilt over the last decade to stop it.

This guide covers what whistleblower retaliation is, including the subtle forms that most policies miss, how common it still is, what the law says in the three big jurisdictions, what the Boeing cases taught regulators, and the eight things a program needs so that a report does not turn into a second investigation about what happened to the reporter.

What whistleblower retaliation is

Retaliation is any adverse treatment of a person because they raised a concern. The concern can be about fraud, safety, harassment, a breach of law or a cover-up; the treatment can come from the employer, a manager, a colleague or a contractor. The test in every modern framework is causal, not formal: it does not matter what the treatment is called, only whether the report was a reason for it.

The EU Whistleblowing Directive lists fifteen forms, and the list is worth reading in full because most organizations only recognize the first three. Dismissal, suspension or lay-off. Demotion or withholding promotion. Transfer of duties, a change of location, a cut in wages or hours. Withholding training. A negative performance assessment or employment reference. Disciplinary measures or penalties. Coercion, intimidation, harassment or ostracism. Discrimination or unfair treatment. Failing to convert a temporary contract, or ending one early. Harm to reputation, including on social media, or financial loss. Blacklisting across a sector. Early termination of a goods or services contract. Cancelling a license or permit. Psychiatric or medical referrals. The last one is on the list because it happens.

The US Department of Labor's list adds the quiet ones: excluding someone from meetings or training, isolating them, mocking them, falsely accusing them of poor performance, or making the job so difficult that they resign. These are the forms that survive a policy saying retaliation is prohibited, because each one can be explained on its own. The pattern only appears when somebody is looking for it.

Why it happens

Retaliation is rarely a decision taken at the top. It is a reflex taken in the middle. A concern lands with the manager whose team, budget or judgment it questions. That manager has every incentive to treat the report as a performance problem, a loyalty problem or a personality problem, and almost none to treat it as information. If the reporting route runs through that manager, or if the manager can find out who reported, the reflex has everything it needs.

The organizations that retaliate least are not the ones with the strongest policy wording. They are the ones where the report never reaches the person it concerns, where the people who handle it are not in that person's chain of command, and where someone is tasked with watching what happens to the reporter afterwards.

How common it still is

Very. The Ethics and Compliance Initiative's global survey of more than 70,000 employees in 42 countries found that 46 percent of those who reported misconduct experienced retaliation, unchanged from the survey before it. In the UK, the charity Protect reported that 71 percent of the people who called its advice line in 2025 had been victimized, dismissed, suspended or forced to resign after raising a concern, and that 38 percent said their concern was not acted on at all. Its caseload rose 8 percent in a year.

The fear shows up before the report is ever made. The 2024 Eurobarometer survey on corruption found that 31 percent of EU citizens gave the lack of protection for people who report as a reason not to report at all. Industry benchmarks tell the same story from the other side: in NAVEX's 2025 benchmark, which pools reports from thousands of organizations, complaints of retaliation were 3 percent of all reports received and were substantiated 18 percent of the time, against 46 percent for reports overall. Retaliation is both widespread and hard to prove, which is exactly why the law now presumes it.

What Boeing taught regulators

Two Boeing cases in 2024 put retaliation on the front page. John Barnett, a former quality manager at the 787 plant in South Carolina, had raised concerns about defective parts and debris left near wiring since 2017 and had an open retaliation case against the company. He died on 9 March 2024, in the middle of giving evidence in that case. His family's claim against Boeing was settled in 2025, on terms that remained confidential and that the court had still not approved by spring 2026.

Five weeks after Barnett's death, Sam Salehpour, a Boeing quality engineer, told a US Senate committee that gaps in the 787 fuselage were being left unshimmed and that when he raised it he was sidelined, threatened and moved off the program. The Federal Aviation Administration said it received 126 whistleblower reports about Boeing between January and May 2024, against 11 in the whole of 2023. The Department of Labor had logged 32 retaliation complaints against the company in the three years before. The lesson regulators drew was not about aircraft. It was that a company can have a reporting program, a code of conduct and a retaliation policy and still have a culture where the people who report are the ones who leave.

Confide's earlier coverage of the Boeing retaliation allegations, the later whistleblower claims and the door-plug blowout follows each case as it unfolded.

What the law says

United Kingdom

The Public Interest Disclosure Act 1998, now part of the Employment Rights Act 1996, gives a worker the right not to be subjected to any detriment by the employer, or by colleagues acting for it, on the ground that the worker made a protected disclosure. Dismissal for that reason is automatically unfair. There is no qualifying period of employment, and the usual cap on compensation for unfair dismissal does not apply. A protected disclosure is one the worker reasonably believes is in the public interest and tends to show a crime, a breach of a legal obligation, a miscarriage of justice, a danger to health or safety, damage to the environment, or the concealment of any of these. Since 6 April 2026 it also covers sexual harassment, under the Employment Rights Act 2025.

The framework is under review. In October 2026 the government opened a consultation, closing in January 2027, on a statutory duty for employers with 50 or more staff to have whistleblowing procedures, backed by civil penalties, together with longer windows for interim relief, wider cover for the self-employed and non-executives, and a reward scheme for economic crime whistleblowers. Tribunal claims citing whistleblowing roughly doubled between late 2024 and late 2025.

European Union

Directive 2019/1937 requires every member state to prohibit retaliation in all of the forms listed above, including threats and attempts. Its most important provision is the reversal of the burden of proof: once a person shows that they reported and then suffered a detriment, the detriment is presumed to be retaliation, and it is for the employer to prove it was justified on other grounds. Remedies include interim relief, reinstatement and full compensation, and member states must impose effective, proportionate and dissuasive penalties on anyone who retaliates, obstructs a report or breaches a reporter's confidentiality. Every member state now has a transposing law; the Court of Justice fined Poland in 2024 and Germany, Czechia, Hungary, Luxembourg and Estonia in March 2025 for being late.

United States

There is no single statute. The Department of Labor enforces the anti-retaliation provisions of 25 separate laws, from workplace safety to securities, rail, aviation and food safety, and received a record number of complaints, more than 4,400, in the year to September 2026. Under Sarbanes-Oxley a complaint must be filed within 180 days. Under Dodd-Frank a retaliated-against whistleblower can recover double back pay, and the Securities and Exchange Commission, which paid more than 60 million dollars to 48 whistleblowers in its 2025 financial year, can bring its own action against the employer. In February 2024 the Supreme Court held unanimously, in Murray v. UBS, that a whistleblower does not have to prove the employer intended to retaliate: it is enough that the report was a contributing factor in the adverse decision, after which the employer must prove by clear and convincing evidence that it would have acted the same way regardless.

Eight things that prevent it

The Department of Labor's recommended practice for anti-retaliation programs, the UK government's guidance for employers and the EU Directive converge on the same shape. A program that has all eight of these will rarely see retaliation, and will see it when it happens.

1. A named owner and a plain statement. Someone at board level is accountable for the reporting program, and the policy says in one sentence that retaliation against anyone who raises a concern is misconduct. The statement matters less than the name.
2. A route that does not pass through the line manager. Reports go to people outside the reporter's chain of command. Anonymous reporting is available, with two-way follow-up so an anonymous reporter can answer questions and receive updates without identifying themselves.
3. The subject of the report locked out. Anyone named in a report, and anyone in their reporting line, cannot see it, cannot be assigned to it and is not told who made it. This is the single control that removes the reflex.
4. A victimization risk assessment at intake. At the moment a report arrives, someone asks: who will work out that this person reported, and what could they do about it? The answer shapes who is told what, and when.
5. Scheduled check-ins with the reporter. Thirty, ninety and one hundred and eighty days after the report, someone asks the reporter whether anything has changed in their work, and records the answer. Retaliation is slow, and the check-in is how it gets noticed while it can still be reversed.
6. A separate route for reporting retaliation itself. A complaint of retaliation is a new case, investigated by someone other than the team that handled the original report, with its own outcome and its own record.
7. Managers trained on the reflex. Most retaliation is a manager's first reaction, not a plan. Training that names the subtle forms, explains the presumption in the law and says what to do when a concern lands with you changes the reaction.
8. Numbers the board sees. How many reports, how many complaints of retaliation, how many substantiated, how long each took, and whether the people who reported are still in their jobs a year later. A program that cannot answer the last question does not know whether it works.

How Confide is built for it

Confide was built by a whistleblower, so the controls above are not add-ons. Anonymous reporting with two-way messaging means the reporter can answer Echo's follow-up questions and read updates without ever being identified. Anyone named in a report is locked out of it automatically. Every access to a case is written to an immutable record, so the question of who saw a report, and when, has an answer. Follow-up tasks live inside the case, so a check-in with the reporter is scheduled when the case opens, not remembered later. And the board report shows retaliation complaints and their outcomes beside every other category.

The investigation guide covers what happens to the report itself. This guide is about what happens to the person who made it, and the answer should be: nothing.

Whistleblower retaliation FAQ

What counts as whistleblower retaliation?

Any adverse treatment because a person raised a concern: dismissal, demotion, pay or hours cut, transfer, a negative review or reference, withheld training or promotion, discipline, harassment, isolation, blacklisting, a non-renewed contract, or a medical referral. The EU Directive lists fifteen forms and the US Department of Labor adds the subtle ones. The question is always whether the report was a reason, not what the treatment is called.

Is retaliation against a whistleblower illegal in the UK?

Yes. A worker has the right not to suffer any detriment for making a protected disclosure, and dismissal for that reason is automatically unfair with no qualifying period and no cap on compensation. The government is consulting until January 2027 on a further duty for employers with 50 or more staff to have whistleblowing procedures.

Who has to prove retaliation?

In the EU, once a reporter shows they reported and then suffered a detriment, retaliation is presumed and the employer must prove the detriment was justified on other grounds. In the US, under the 2024 Supreme Court decision in Murray v. UBS, the reporter shows the report was a contributing factor and the employer must then prove by clear and convincing evidence that it would have acted the same way. In the UK the worker shows the disclosure was a reason, and in dismissal cases the employer must show the real reason.

Can an anonymous reporter be retaliated against?

Only if their identity is worked out, which is why anonymity has to survive the follow-up. A system that lets an anonymous reporter answer questions and receive updates without logging in under their name, and that locks the people named in the report out of it, removes the two usual ways identity leaks. Reporters who choose anonymity should keep the same legal protection if they are later identified.

How should an organization respond to a complaint of retaliation?

Treat it as a new case. Record it, assess the immediate risk to the person, assign it to someone outside the team that handled the original report, investigate it on its own evidence, decide, and tell the person the outcome. Report the number and outcome of retaliation complaints to the board alongside every other category.

The report is the easy part

Organizations spend most of their effort on receiving reports and almost none on what happens to the people who make them. The law has moved the other way: it now presumes retaliation, removes the caps, and in the EU and soon the UK makes a reporting system a duty. The practical test of a program is not how many reports it receives. It is whether the person who made the last one is still there, still working, and would do it again.