He Helped Expose Wirecard’s Fraud. Now His Startup Tries to Make Whistleblowing Safer

In September 2017, Singapore-based lawyer Pav Gill took a job at Wirecard, a high-flying German payments business worth tens of billions of euros. Not long after he started, he heard from a colleague that an executive at Wirecard Asia, the region Gill was responsible for, had allegedly been teaching staff how to trick auditors into thinking the firm had money it didn’t have.

Gill quietly began an investigation, codenamed Project Phoenix. The results were damning: Wirecard had been fudging its numbers. But when the board of directors caught wind of his work they got “very upset,” says Gill. He was ordered to stand down, and his investigation came to nothing.

The head of Wirecard Asia began to make Gill’s life “pretty horrible,” he claims, yelling at him in front of colleagues and attacking the quality of his work. He was effectively forced out. But before he left, in September 2018, he loaded a harddrive with an 85GB payload of email data tied to the investigation. It was filled, he says, with “irrefutable” proof of wrongdoing.

Even after Gill left, Wirecard continued to haunt him. At job interviews, he felt the questions were disproportionately focused on the reason for his departure. Gill also began to suspect the firm was having both him and his mother followed (Wirecard had previously surveilled its detractors, but this was never proven in Gill’s case). But he never intended to leak the email data he’d extracted. It was a defensive maneuver. “As a lawyer, it is ingrained that you are not meant to leak, no matter how bad the situation,” says Gill.

In the end it was his mother, Sokhbir Kaur, who took action. Without Gill’s knowledge, she had been liaising with the Financial Times, which had been investigating Wirecard for years. She had snatched the whistle and blown it on Gill’s behalf. He was beside himself. But after some debate, he agreed to give the reporters the data: Why should they be the ones living in fear when the truth was on their side?

The first story based on Gill’s data was published in January 2019. By April 2020, a KPMG audit had found that the “lion’s share” of Wirecard’s profits could not be verified. Later, EY, the company’s original auditor, discovered that €1.9 billion was missing, because the money had never existed. By June 2020, Wirecard had collapsed into insolvency. Gill had played an indispensable role. Five years after leaving, Gill says he has “no regrets” about blowing the whistle, but that it did lead to a great deal of hardship. So now he’s trying to make the process safer.

Gill is the cofounder of Confide, a startup aiming to help businesses detect and act on misconduct earlier—and stop them “taking revenge” on the employees that report it. Confide, cofounded with Ryan Dougherty, who Gill had hired at two previous companies, has developed a software platform that allows employees to file anonymous reports. The service creates a paper trail visible to both the whistleblower and the business accused of misbehavior—but one that’s stored on third-party infrastructure to prevent it being doctored.

If a business fails to address a problem reported by a whistleblower, or tries to kick it under the rug, the individual can take that paper trail to the press or to law enforcement. The existence of a tamperproof, externally-stored and anonymously created record should shield whistleblowers from the kind of harassment that Gill encountered, he argues.

A second-order effect, says Gill, might be to normalize reporting misconduct and thereby recast the act of whistleblowing. It’s partly an issue of terminology; blowing the whistle implies whinging or complaining. But a standardized process for reporting could help to change the impression that whistleblowing is a form of biting the hand that feeds.

Existing reporting platforms such as EQS and NAVEX have tended to focus on large organizations in the financial services industry, says Gill, whereas Confide will look further afield—to sectors including healthcare, mining, and air travel in which “doing the wrong thing can have life-or-death consequences.”

Confide charges businesses an annual fee to use the platform, with extras if they want to outsource the handling and processing of reports. When WIRED interviewed Gill in the fall of 2023, a basic version of Confide was due to launch in December 2023, to coincide with new EU rules that require businesses to give employees simple channels for reporting wrongdoing. More features were set to follow in early 2024.

In the Wirecard case, the decision to report misconduct to the press put a stop to the fraud. But Gill’s ambition is for Confide to guide people down a different path. The press is “extremely powerful,” he says, but should only be used as a “last resort” once somebody has lost faith that a corporation will do the right thing.

“We are not trying to solve the problem of crime,” Gill says. It’s about giving businesses a chance to correct their behavior and protecting those that report it. “Every now and then, I ask myself why it had to be me that exposed Wirecard,” says Gill. He’s still scarred by the experience, but he hopes that in Confide he’s created something that will save others from feeling the same way by preventing the whistleblower from ever needing to go public. The end goal, Gill says, is to stop companies “becoming Wirecard 2.0”.

This article was originally published in the March/April 2024 edition of WIRED UK magazine.