Rail Industry Risks Deutschlandticket: Potential Damages Up to €500 Million
Internal documents available to heise paint a disastrous picture of the Deutschlandticket. The damage caused by the disagreement in the industry is immense.
(Image: Firn/Shutterstock.com)
The Deutschlandticket is regarded as a flagship project for the transport revolution: Around 14 million people use the monthly subscription for public transport throughout Germany. It was implemented in record time for a major project. But there are repeated cases of fraud.
Our research reveals the true extent of fraud with the Deutschlandticket and proves that the transport companies have not been able to agree on a joint strategy against systematic abuse for 18 months despite early knowledge of the abuses. Instead, they have relied on compensation payments from the federal and state governments.
Many heise-investigativ investigations are only possible thanks to anonymous information from whistleblowers.
If you have knowledge of a grievance that the public should know about, you can send us information and material. Please use our anonymous and secure mailbox.
As internal documents exclusively available to heise online show, those responsible knew early on that there were various loopholes in the Deutschlandticket that were conducive to abuse. As early as 2023, the transport companies registered a "monthly difference of 60,000 to 1,000,000 tickets between reported sales and user numbers determined by market research" – a clear indication of massive fraud. At the beginning of 2024, the decision-makers had forecasts that predicted annual losses in the three-digit million range due to manipulation and counterfeiting.
Nevertheless, concrete countermeasures were largely absent. Confidential meeting minutes of the Association of German Transport Companies (VDV) document structural failure. A central problem here is the lack of overarching responsibility. Instead of pulling together, the transport companies involved are pursuing their own interests. Several attempts to establish uniform safety standards have so far failed due to lengthy coordination processes and a lack of willingness to cooperate.
Only since further cases of fraud became known in parallel to the political debate on the future of the Deutschlandticket have those involved started to move. According to the minutes, the growing financial losses caused by the gaping security holes in the distribution and control systems "cannot be communicated to either society or politics".
A case of fraud recently made public by heise online shed light on some of the structural problems with the Deutschlandticket: the unauthorized ticket store "D-ticket.su" was able to sell thousands of tickets with a valid crypto key for months. How the store came into possession of this key is still unclear.
These tickets attracted attention due to the suspicious marking "Senior", which does not exist in the nationwide fare system. In a subsequent check, Deutsche Bahn found around 50,000 such tickets in its control logs – but the number of unreported cases is likely to be considerably higher.
Staff shortages: inactivity due to understaffing
According to confidential VDV meeting minutes from February 18, 2025, the responsible Deutschlandtarifverbund GmbH (DTVG) was already aware of the abuse in December 2024. Nevertheless, "the incorrect keys were only "removed from the system" in February 2025 under pressure from DTVG".
The reason for the delay is as sobering as it is alarming: "The ticket key was not blocked in December 2024 due to vacation and illness of the responsible employee. DTVG does not have a back-up for these cases due to tight staffing levels."
To make matters worse, the DTVG was unable to impose any sanctions on the actual key holder, Vetter Verkehrsbetriebe from Saxony-Anhalt: "The possibility of taking action against the contractual partner is not legally enforceable due to the inadequate contractual situation. The transport company in question did not comment for a very long time on the incident and whether there was any abuse."
Two-track ticket landscape
However, this is not the only problem that facilitates cases of fraud with the Deutschlandticket. In order to quickly introduce the ticket, which is valid throughout Germany, and also to integrate smaller transport companies, two ticketing systems were implemented: The UIC procedure of the International Union of Railways in its simplest form as a static barcode, as was also used by the unauthorized site D-ticket.su, and the much more complex VDV-KA procedure (core application). The latter uses centralized key management, special secure access modules for ticket signing and central, tamper-proof recording of all issued tickets.
The DTVG-managed area has serious security deficiencies: Instead of centrally controlling crypto keys for ticket signatures, transportation companies generate their private keys independently and only store the public counterparts on a DTVG SharePoint server. Anyone who gains access to a valid private key can generate any number of tickets.
TĂśV Rheinland already came to the conclusion at the end of 2023 that the VDV system was technically better positioned than the DTVG system. The latter has considerable security gaps, particularly in the area of key management (public key infrastructure) and revocation lists.
However, there is currently no comprehensive "Germany-wide accessible blocking list" for individual tickets, meaning that in the case of D-ticket.su, all tickets signed with the key in question had to be blocked. This was regardless of whether they were legitimate purchasers from Vetter Verkehrsbetriebe or owners of counterfeit tickets. The transport companies involved were only informed of the incident at the end of January, until then the store concerned was able to continue selling tickets with the key that had to be blocked.
