A German group of companies has been the target of a fraud which can be repeated easily elsewhere as long as a direct debiting system among banks and customers is installed. The case revealed represents a damage of over DM150 000, but it is yet unknown whether the fraud was perpetrated systematically against a number of other potential victims. The prosecutor has been asked to start investigations.Direct debiting is, in Germany as in many countries, a computer-based routine between the banks and the banks' clients. A bank executes direct debit orders through the system, and the money transfer will be finally settled if the holder of the target account does not refuse the debiting within six weeks.The controller of a group of nine companies in Northern Germany observed in May of this year that some accounts were overdrawn. He looked at individual transactions and became suspicious. An audit produced evidence that a limited company, being not in business relations and yet unknown, had drawn assets of over DM150 000 in rather small portions from the different accounts which were kept in the names of these nine companies. He was able to return most of the debits to the banks who now are sitting on the damage. The perpetrator collected the money and closed the company; telephone lines are dead and mail comes back.It has to be highlighted that -- in absence of a day-to-day controlling of financial movements -- the case was revealed by chance. The target was ideal: most of the companies are involved on outsourcing business -- they administer clients' cash movements through their own accounts. The amount of daily movements is high, and the size of the whole group (less than 250 employees) made it unlikely that there was a daily check of all transactions.This leads to the conclusion that a perpetrator might be rather successful if he manages to collect a considerable number of bank account numbers of companies with the following characteristics: Not too big (computer-based day-to-day checks are unlikely). Not too small but with a great number of money movements (visual checks are impossible).Apart from an immediate audit there was a quite simple security measure implemented. The account numbers are shown on business papers, are reserved for incoming assets only. Any debit to these accounts can be refused immediately, the individual case may be checked later. Another set of accounts has been established for outgoing money. These accounts are not shown on business paper. Movements here are verified in the short-term so that unjustified debits can be returned within a six week period which German banks provide.