Any employee who falls for professionally forged payment instructions from supposed superiors risks not only losing their job but, in certain circumstances, also facing personal liability for damages running into millions. This is demonstrated by a sensational ruling from the Cologne Regional Labour Court. The ruling increases the liability risks for senior executives in particular: in the court’s view, D&O insurance financed by the employer can result in the principles of limited employee liability being overridden. However, the final word has not yet been spoken. An appeal is pending before the Federal Labour Court.
The case: transfers of millions following a fictitious transaction
The claimant had been employed as Head of Global Treasury at an international company since 2018. His employer had insured him under a directors’ and officers’ (D&O) insurance policy with cover of up to 150 million US dollars per insured event.
In July 2024, the claimant fell victim to an elaborate fraud scheme. The perpetrators posed, amongst other things, as his line manager and as a solicitor from a renowned law firm. Under the pretence of setting up a new holding company, they requested alleged capital contributions. According to the claimant, the first telephone contact was made via his superior’s supposed mobile number, which had been manipulated using caller ID spoofing.
Further communication was shifted to private email addresses and WhatsApp. Within around 25 days, the claimant arranged for nearly 60 payments totalling approximately 50 million euros. In doing so, the company’s applicable authorisation and documentation procedures were not followed. After the fraud was uncovered, the employer terminated the employment contract summarily without notice and, by way of a counterclaim, sought compensation for the irrecoverable loss.
The decision of the Cologne Regional Labour Court
The Cologne Regional Labour Court held that the extraordinary dismissal pursuant to Section 626(1) of the German Civil Code (BGB) was valid. The claimant had, in any event, breached his obligations under the employment contract through gross negligence from 18 July 2024 onwards.
The court considered it decisive that numerous warning signs had accumulated in the course of the communications: private communication channels, exceptionally high payment amounts, missing transaction documents, particular pressure to maintain confidentiality, and deviations from internal approval processes. In light of these circumstances, at the very latest, the claimant should have sought personal confirmation from his actual line manager.
An aggravating factor was that the claimant had taken part in a training video on the subject of CEO fraud just a few weeks earlier. That video had specifically highlighted the need to personally verify details with the supposed client as a key protective measure. Nevertheless, the claimant continued to make the transfers without carrying out this verification.
The court also upheld the employer’s claim for damages under Section 280(1) of the German Civil Code (BGB) in conjunction with the employment contract. A finance manager in this position could be expected not to authorise payment instructions involving exceptional sums without personal verification, adequate documentation and compliance with internal control mechanisms.
It is true that, in the case of work-related activities, an employee is generally liable in accordance with the rules governing internal compensation for damages. Under these rules, the employee is not normally liable in cases of slight negligence, is liable on a pro rata basis in cases of moderate negligence, and is generally fully liable in cases of gross negligence. However, even in cases of gross negligence, a reduction in liability may be warranted, particularly if the potential damage is grossly disproportionate to the employee’s remuneration and would threaten the employee’s economic livelihood.
In this specific case, however, the Cologne Regional Labour Court rejected such a limitation of liability.
The key finding: D&O insurance supersedes limited liability
In the court’s view, the D&O insurance taken out and financed by the employer superseded the principles of limited employee liability. The court held that, due to the insurance cover, the employee was not exposed to the risk of a personal claim that would destroy his livelihood. Consequently, at least in cases of gross negligence, a key justification for limiting liability was removed. The Regional Labour Court further held that the insurance should also be taken into account for those transfers where gross negligence could not yet be established.
This view is by no means self-evident. In a separate CEO fraud case, the Hessian Regional Labour Court had previously ruled, in its judgement of 8 April 2025 (file reference 12 SLa 177/24), that voluntary D&O insurance did not override the principles of limited employee liability. It limited the liability of an authorised signatory acting with gross negligence to six months’ gross salary. In its reasoning, it emphasised that voluntary insurance – unlike statutory compulsory insurance – generally follows existing liability rather than creating it in the first place.
It is also a matter of debate in legal literature whether D&O cover may lead to the removal of the liability privilege under employment law. One argument against the Cologne court’s view is, in particular, that the specific insurance cover depends on the respective insurance terms and conditions. D&O policies regularly contain exclusions for intentional or wilful breaches of duty. Extending liability solely on the basis of potentially existing cover could therefore expose the employee to risk, even though the insurer might subsequently refuse to pay out.
Assessment and practical implications
The ruling by the Cologne Regional Labour Court significantly shifts the risk of CEO fraud towards the employee in question. Employees with extensive payment authorisation are particularly at risk of liability if they ignore recognisable warning signs or circumvent internal approval, control and documentation requirements.
For companies, the judgement also demonstrates that technical security measures alone are not sufficient. Binding verification processes are required, in particular personal follow-up calls using known contact details, a consistent dual-control principle and clear escalation rules for exceptional or confidential payments. Training should not merely be conducted in an abstract manner, but should be linked to verifiable organisational control mechanisms.
Whether employer-funded D&O insurance actually removes the limitation of liability under employment law, however, has not yet been conclusively clarified by the highest courts. Due to the conflicting views of the Cologne Regional Labour Court and the Hessian Regional Labour Court, the pending appeal is of considerable fundamental importance. Pending the decision of the Federal Labour Court, it remains unclear whether D&O insurance merely covers existing liability or whether it can itself lead to an extension of the employee’s personal liability.