The calls came from Germany, from a number I did not know, and I missed both of them. The message was the same each time. Hello, is this Pav Gill. We understand you are being told to go to Jakarta.
Don't go. You won't come back. It was a few months after the law firm's preliminary report on our finance team, and, as it turned out, a few days before the end of my time at Wirecard.
I was Wirecard's first Head of Legal for Asia-Pacific, based in Singapore. By then I had spent months inside an investigation into the company's own accounts and watched the board hand that investigation to the executive it implicated. The trip to Jakarta was described as a rebranding exercise.
I had already given the company two law firms with their quotes. I did not need to be in the room, and I did not get on the plane.
Joining Wirecard
I joined in September 2017. Wirecard had just bought Citibank's merchant acquiring business in Asia-Pacific and needed licenses across the region. The legal and compliance work was being done out of Munich, and they needed someone on the ground. I was headhunted for it: the first head of legal the region had ever had, covering 11 markets.
My first day was in Munich. It was Oktoberfest. When I flew back to Singapore nobody knew why I was there, so I did not get a laptop. The second thing I noticed was the size of the function.
The company had 13 legal and compliance staff globally, and I was the thirteenth. For a business processing billions in payments that made no sense. Internal audit was smaller still: about one and a half people.
None of it looked like fraud. Wirecard was listed and reputable, and there was no serious red flag when I walked in. What looked odd was smaller.
The man running finance for the region, Edo Kurniawan, flew to Munich every month to beg for wages for the whole of Asia-Pacific, at a company valued in the billions. The subsidiaries were loss-making, yet the Asian side was announcing EBITDA (earnings before interest, tax, depreciation and amortization) in the hundreds of millions. Where was the money coming from?
What Bobby told me
In early 2018 a colleague in the finance team asked to see me in confidence. We met away from the office, in a cafe. I later gave this person the name Bobby so that nobody could work out who it was, or even whether Bobby was a man or a woman.
Bobby was senior, and shaken, with the kind of fear you cannot fake. Bobby did not want to carry out certain transactions any further, because Bobby believed they were illegal.
Bobby would not go to HR. Inside Wirecard, HR was seen as the spies of management. So Bobby came to the lawyer.
What Bobby described was round-tripping. Different Wirecard entities would transact with unknown third-party companies, and those transactions and customer relationships were booked under accounts receivable. Bobby told me the man running the region's finances was teaching staff how to get the paperwork past the auditors.
I was not looking for dirt on the company. It is usually when the smell is so bad, or when someone comes to you. Someone came to me.
Project Tiger
I opened an investigation with our head of compliance, a former prosecutor, and reported it to Munich. I argued that an outside firm should look at the evidence and write the report, so that nobody could say Pav simply did not like the finance guy. Rajah & Tann took the work.
The matter was called Project Tiger. My own file was Project Phoenix.
I was given access to 85 gigabytes of raw inbox data for the people under suspicion and spent a weekend in the sidekicks' inboxes. Some of them were emailing company logos to themselves. It was not sophisticated, which upset me more than it should have.
There was a hydraulic hose company in Malaysia called FlexiFlex invoicing a Wirecard entity in Indonesia, in euros, for payment services. A hose company does not provide payment services.
Rajah & Tann's preliminary report went to the company on 4 May 2018. It was a laundry list: forgery, round-tripping, money laundering risk, suspicious transactions. Nobody was fired.
Nobody was suspended. Instead a global email went out announcing Edo's promotion.
I still thought this was a few bad eggs in one office. It never crossed my mind that it went all the way to the board.
How the company answered
The general counsel in Munich had not been told any of this. I had been assured throughout that she knew. When she found out, she took it to the board. That is where things turned.
Markus Braun's reaction, as it reached me, was irritation that his time was being wasted on a problem of that size. Jan Marsalek's was different. Asia was his baby, he said.
He wanted the investigation, and he wanted me to stand down. The board gave it to him.
How do you tell the second most powerful person in the company that they can't investigate themselves, because they are a person of interest?
The law firm stayed, because changing it would look suspect. Wirecard had no whistleblowing procedure when I joined. It put one in place in the middle of my investigation. When I asked where the reports went, the answer was: straight to Jan Marsalek.
In Singapore the local director would shout that if I knew what was good for me I would play ball. He asked to see me every Thursday. Each Thursday he had an update on the situation, including against me, which he would share next Tuesday. That went on for months.
Someone was hired to work under me whose main interest, it turned out, was my investigation. When I tried to remove that person, a complaint went to HR that I was doing it because my advances had been rejected. The complaint took three months to investigate.
Then came Jakarta. Whether I went in two weeks, two days or two months, I had to go. Edo told me that Wirecard had been known to make people disappear. That was the week of the two missed calls.
I was being followed, and not subtly. At first I thought they were low-budget. Then I understood that they wanted me to know.
The company also paid an investigations firm to find out who the whistleblower was. The firm gave them the wrong person.
I have said on a podcast that the company spent several months trying to make my life difficult, including trying to kill me at the end of it. That is what I believe. I cannot prove the last part and I am not going to try here.
What I can tell you is what I was told: do not get on that plane. I did not.
Leaving
Refusing the trip gave the company what it had been looking for, a legitimate reason to force me out. On a Friday an email came from the head of the Singapore office: I want to see you in my office on Tuesday. I already knew what that meant.
Resign, or be fired. I resigned, in the autumn of 2018, about a year after I had started.
The law firm had been telling me not to. The more they looked at the evidence, the more obvious it was becoming. It was a race against time, and the company won it.
I left with the data. Wirecard was in the habit of forging documents, and I needed my own correspondence and notes in case the version of events turned against me.
I needed some kind of objective forensic data with me as a shield, not so much as a sword.
Four months later I joined Wise as its first APAC counsel.
My mother
My mother, Sokhbir Kaur, raised me alone in public housing in Singapore. I am her only child. At some point in 2018 I had to tell her what was going on, in case anything happened to me.
When Jakarta came up she told me I was not going and that she would take my passport. I pointed out that this was a criminal offense. She was not moved.
What she did next she did without telling me. In October 2018, under an alias, from the sofa at home, she started writing to journalists. The company was not letting us move on. I was the sole breadwinner.
Enough was enough, and she was going to teach this company a lesson. Clare Rewcastle Brown was the first to answer. Clare said the Financial Times had been following Wirecard for years without making much progress, and referred us there.
Then my mother told me we were meeting the FT that weekend at the airport. I was not pleased. I did not speak to journalists. I did not trust them.
But her logic held. Go to a police station and you expose who you are, with no idea whether the file sits in a drawer for years. Singapore is hypersensitive to foreign press, so if the FT reported it, the authorities here would have to act.
Stefania Palma met us at Changi airport and reported back to Dan McCrum that we were legitimate. Dan came down the next week for three days. We went through about 70 percent of what I had. I kept the other 30 percent.
Between that meeting and the first article was about four months, and those months are no man's land. Before the article ran we also sent a dossier of the key contracts, with an explainer, to the regulators in Germany and Singapore and to the auditors. Either nobody read it or nobody wanted to look.
My mother had a stroke. If anyone asks whether I was ever scared through any of this, the answer is yes, and it was because of her. It was not anything else.
30 January 2019
The FT's first story ran on 30 January 2019: an executive at Wirecard suspected of using forged contracts. The shares fell by as much as 25 percent. Two more followed, on 1 February and 7 February. The share price was the only thing that really mattered to the company, and that was the most painful place to hit it.
The response of BaFin, Germany's financial regulator, was that this was not a Wirecard Germany problem. It was a short-selling problem, and an Asian problem. On 18 February 2019 BaFin banned net short positions in Wirecard until 18 April.
On 10 April 2019 it filed a criminal complaint against Dan McCrum, Stefania Palma and a group of short sellers. Munich prosecutors dropped it on 3 September 2020.
Singapore acted. On 8 February 2019 the police raided Wirecard's entities here. For a long time it was the only jurisdiction that did.
Two weeks after BaFin went after the journalists, on 24 April 2019, a SoftBank affiliate agreed to put €900 million into Wirecard through a convertible bond. Nobody was asking questions. On 15 October 2019 the FT published internal documents, and six days later the supervisory board commissioned a special audit from KPMG.
KPMG's report, on 28 April 2020, said it could not verify about €1 billion of third-party-acquirer transactions. KPMG never contacted me, or anyone else who had spoken to the FT.
On 18 June 2020 EY refused to sign the 2019 accounts, citing missing evidence for €1.9 billion in escrow balances. That night Jan Marsalek flew by private jet from Bad Vöslau to Minsk. Markus Braun resigned on 19 June.
On 22 June the company said there was a prevailing likelihood that the €1.9 billion did not exist, and Braun surrendered to prosecutors in Munich. On 25 June 2020 Wirecard filed for insolvency, about a year and a half after the first article.
I felt pride that day. Not because a company went down, but because the truth prevailed.
What everyone missed
A study for the European Parliament in October 2020 said that all five lines of defense had failed at Wirecard. This is how it looked from Singapore.
The board
Until the end of June 2018 the supervisory board had five members and, for most of the company's existence, no audit or risk committee. Inside the company it was known as the friends and friendlies of the executive board. When the Singapore findings reached it, it handed the investigation to the executive they implicated. I had one question for the board then and I have it now.
If you have seen a company grow for 15 years, and only three companies are responsible for 100 percent of your profits, had you not at any point during those 15 years wanted to know who these three companies are?
Internal audit
About one and a half people for a group that averaged 5,154 staff in 2018. Invoices in euros from a Malaysian hose company, for payment services. If I could look at that and know something was wrong, there is no excuse.
EY
A big four firm, ten years, saying there was nothing going on. In 2016, 2017 and 2018 EY did not obtain confirmation of the escrow balances directly from the bank, OCBC. It relied on letters from the trustee. Fritz Güntzler of the Bundestag inquiry put it this way in June 2021: many red lights were driven through, and checking whether the money is there is the easiest item in an audit.
BaFin
BaFin supervised Wirecard Bank, not the group, so the group escaped prudential supervision. In February 2016, when the Zatarra dossier alleged money laundering, BaFin and the Munich prosecutors investigated the short sellers, not the claims. In 2019 they investigated the journalists.
It was the journalists who did the job of the prosecutors and the regulator. BaFin's president and his deputy were forced out on 29 January 2021.
The escrow letters
The €1.9 billion was supposed to sit in escrow with trustees. Singapore court records show that EY asked the trustee, Citadelle, for balances by email and accepted letters drafted on Marsalek's wording. R. Shanmugaratnam of Citadelle was convicted in Singapore of falsifying balance confirmation letters claiming Citadelle held more than €1.1 billion, and is appealing.
The Bundestag committee's report of June 2021, about 4,500 pages, called it a collective oversight failure. The law that followed, the FISG (Germany's Financial Market Integrity Strengthening Act), gave BaFin direct enforcement powers and made audit committees mandatory for listed companies. It passed on 20 May 2021, the day I put my name to the story.
Where it stands in November 2026
The criminal trial of Markus Braun, Oliver Bellenhaus and Stephan von Erffa opened at the Munich regional court on 8 December 2022. Day 289 was 28 October 2026. There is no verdict.
In October 2026 the court refused a defense motion to suspend the trial and signaled a final deadline for evidence motions. No date for a verdict has been set. Braun has been in pre-trial detention since July 2020 and denies everything.
Jan Marsalek is in Moscow. In March 2024 Der Spiegel, ZDF, Der Standard and The Insider identified him as a Russian intelligence asset recruited in July 2014. In September 2025 The Insider reported him living in Moscow with Russian citizenship under another name.
In Singapore, James Aga Wardhana and Chai Ai Lim were convicted in June 2023 and sentenced to 21 and 10 months. Henry Yeo Chiew Hai got 12 months. On 6 January 2026 R. Shanmugaratnam was jailed for 10 years and James Henry O'Sullivan for six and a half.
Both are appealing. Edo Kurniawan is at large, with an Interpol Red Notice.
EY was fined €500,000 by APAS, the German audit regulator, in March 2023 and banned for two years from taking on new public-interest audits. Five of its auditors were fined, seven more gave up their licenses, and EY dropped its appeal in March 2024.
The Munich court contacted me for the first time in May 2024. No government has thanked me. I never received a cent, and a verbal thank you would have done.
I do not go to Jakarta. I do not go to Russia.
What I built
The question I kept coming back to was why it had to be me. Why did a listed company with a supervisory board, a big four auditor and a regulator depend on one lawyer in Singapore and his mother? In September 2023 Ryan Dougherty and I founded Confide to build something that works for companies, for the people inside them and for lawmakers.
The name is the point. Anyone in a speak-up situation has the same problem: they do not know who to confide in. Bobby did not.
What Wirecard taught me is that receiving a report is the easy part. A form, an email address, a phone line on a poster: that is a glorified inbox. Things go wrong after that. The question is what happens in the next 48 to 72 hours, and whether there is an audit trail of it.
So Confide is built around those hours.
- Anonymity first, because the biggest fear is always being exposed and retaliated against. A reporter can answer questions and read updates without giving their name.
- Case managers who sit above middle management, because the people who handle a report cannot be the people it is about.
- If a user is named in a report, their access to it is revoked automatically. At Wirecard the reports went to Marsalek.
- A record of every access and action, because the audit trail is the check and balance.
- If you switch it on, Echo, our AI agent, asks the reporter follow-up questions at intake, so more of the facts are there from the start.
And the first question a case manager should ask is the one Wirecard's board never did: assuming this is true, and I do nothing, what happens to the company?
If Confide had been in Wirecard, I would have seen the correspondence and the flow. Wirecard's defense all the way was that this was an Asian problem. The record would have shown exactly where the Asian problem reported to.
That is what Confide's whistleblowing system does. The aim is simple. Fewer of me.
Would I do it again
People ask. The answer is yes, and the same way. Wirecard is a very rare case of successful whistleblowing.
The missing €1.9 billion was never found, but courts in Singapore have convicted those who faked the records, and the company is gone. Its former chief executive is on trial, its former chief operating officer is in Moscow, and the law in Germany changed. It cost more than it should have, and it cost my mother more than it cost me.
To anyone sitting where I sat in 2018 I would say what I had to learn: if you have the truth, why are you the one living in fear? To any board, something simpler. Do not upset moms.
Wirecard scandal FAQ
What was the Wirecard scandal?
Wirecard was a German payments company listed in the DAX 30, Germany's index of its 30 largest listed companies, with a peak market value of about €24 billion in September 2018. On 18 June 2020 its auditor EY refused to sign the 2019 accounts because evidence for €1.9 billion in escrow balances was missing. The company admitted the money probably did not exist and filed for insolvency on 25 June 2020. A Bundestag inquiry later called it a collective oversight failure.
Who was the Wirecard whistleblower?
Pav Gill, Wirecard's first Head of Legal for Asia-Pacific, based in Singapore from September 2017. A finance colleague told him about round-tripping and forged contracts in 2018; he commissioned an investigation by Rajah & Tann, was forced out in the autumn of 2018, and his documents became the Financial Times stories that began on 30 January 2019. His mother, Sokhbir Kaur, made the first contact with journalists under an alias. He revealed his identity on 20 May 2021 and founded Confide in 2023.
How much money went missing at Wirecard?
The headline figure is €1.9 billion, the escrow balances Wirecard said in June 2020 probably did not exist. The losses are larger. Prosecutors say banks lent about €1.7 billion and bondholders about €1.4 billion on the strength of false accounts, with a reported loss of about €3 billion.
Creditor claims in the insolvency exceed €12.5 billion, and about 50,000 shareholders claim around €8.5 billion. Santander bought the European technology platform for about €100 million.
What happened to Markus Braun and Jan Marsalek?
Markus Braun, chief executive from 2002, resigned on 19 June 2020, surrendered to Munich prosecutors on 22 June and has been in pre-trial detention since July 2020. His trial for fraud, breach of trust, market manipulation and false accounts opened on 8 December 2022 and had no verdict after 289 hearing days by late October 2026. He denies everything. Jan Marsalek flew to Minsk on the night EY refused to sign, was identified in 2024 as a Russian intelligence asset, and is reported to be living in Moscow.
What happened to the auditors?
EY had audited Wirecard for a decade and relied on trustee letters rather than bank confirmations for the escrow balances. In March 2023 the German audit regulator APAS fined EY €500,000, banned it for two years from taking on new public-interest audits, and fined five of its auditors between €23,000 and €300,000; seven more surrendered their licenses. EY dropped its appeal in March 2024.
