German CFO Held Personally Liable for €50M BEC Fraud Loss Despite Insurance Coverage

The Quick Take

• A German court ruled a CFO personally liable for €50 million in damages from a business email compromise fraud, setting a landmark D&O liability precedent
• The ruling came despite the company holding directors and officers insurance, as the court found the CFO failed to implement adequate fraud prevention controls
• The case could redefine the scope of executive personal liability for cyber fraud losses in German corporate law

A German court has issued a landmark ruling holding a company's chief financial officer personally liable for €50 million in damages resulting from a business email compromise attack — a fraud where criminals impersonate senior executives via spoofed emails to trick finance teams into transferring large sums to fraudulent accounts. The FAZ report highlights that the ruling was made despite the company holding a directors and officers insurance policy, indicating the court found grounds to pierce the coverage and attach personal liability to the CFO. The case centers on whether the CFO exercised adequate duty of care by implementing the internal controls and verification procedures that would have prevented the unauthorized transfer.

The market implications of this ruling are immediate for the D&O insurance sector and corporate governance practices across Germany and potentially the broader EU. If CFOs face personal liability for cyber fraud losses that exceed or bypass insurance coverage, demand for enhanced D&O policies with explicit cyber risk provisions will increase sharply. Companies will also accelerate investment in multi-factor payment authorization systems and callback verification procedures that create audit trails demonstrating compliance with duty-of-care obligations. Law firms specializing in corporate liability and cyber fraud defense are already likely to see increased mandate flow as boards reassess their exposure under similar fact patterns.

Investors and risk managers should track how German insurance associations respond to this ruling in terms of policy exclusion language and premium repricing for CFOs who cannot demonstrate modern internal controls. Watch whether other European courts in Austria, Switzerland, and the Netherlands adopt similar personal liability reasoning when reviewing BEC fraud cases under their own corporate law frameworks. The macro variable determining the systemic significance of this ruling is the rate of BEC fraud in corporate finance: if attack volumes continue rising while personal liability increases, the effective cost of inadequate cybersecurity governance rises dramatically and will reshape how boards approach technology risk management.

Synthesized from 1 source.