Capillary report says EUR 3.04 million fraud used impersonation

Capillary Technologies India Limited said KPMG’s October 2026 forensic report found four disputed payments totalling EUR 30.411699 lakh were most consistent with payment-diversion fraud through executive and legal-professional impersonation, social engineering, a lookalike domain and off-channel communications. The review did not support a technical-compromise explanation for two examined laptops or corporate accounts.

What did KPMG find about Capillary’s disputed payments?

KPMG found that four disputed payments totalling EUR 30.411699 lakh, made by Session M Czech Republic s.r.o. from 26 June 2026 to 2 July 2026, were most consistent with a multi-stage payment-diversion fraud. Capillary received KPMG’s forensic report on 30 October 2026 and disclosed its receipt to the exchanges on 31 October 2026.

The reported mechanism involved people impersonating executives and legal professionals in connection with a purported confidential acquisition. The communications included a non-disclosure agreement, invoices, payment requests, beneficiary banking details and payment confirmations. KPMG said the approach used secrecy and urgency, formal-looking documents, WhatsApp and personal email to induce authorised payment activity.

Three payments went to ZZDJB CO LIMITED at HSBC Hong Kong and one went to ZHONGXIAN TRADING PTE. LTD at UOB Singapore. KPMG assessed the multiple-beneficiary fund-diversion hypothesis as supported because transaction and banking records evidenced the first-hop payments. However, the review did not establish onward fund movements, beneficial ownership, beneficiary-bank intelligence or recovery status.

Was Capillary’s technology compromised in the payment fraud?

No, KPMG found no evidence in the material reviewed that malware, endpoint compromise, corporate mailbox compromise, successful unauthorised access or traditional email spoofing caused the four payments. Its work examined two forensic laptop images, mailbox and authentication records, communications, transaction documents, Google Workspace-related logs, Google Takeout exports and open-source intelligence material.

For the two examined laptops, KPMG identified no incident-related malware, unauthorised remote-access tools, persistence mechanisms, credential-theft utilities or malicious scripts. That finding meant endpoint involvement was not supported by the evidence reviewed. It did not establish that a technical compromise was impossible on every company system or device.

KPMG also found no evidence in supplied records of successful unauthorised corporate mailbox access, malicious forwarding, mailbox-rule manipulation or account takeover. This contrasted with the payment finding: transaction and banking records supported the first-hop diversion, while the reviewed endpoint and identity records did not support a corporate account-compromise root cause.

The report specified significant limitations. Complete virtual private network, network, proxy, firewall, packet-capture, memory and some endpoint-security telemetry were unavailable. KPMG therefore said the absence of identified compromise should not be treated as definitive proof that compromise never occurred during the review period.

How did the lookalike domain feature in the Capillary fraud?

KPMG found that relevant messages were sent from law-ogier.co.uk, an operational lookalike domain, rather than infrastructure forged to appear as the legitimate ogier.com domain. It therefore supported lookalike-domain impersonation but did not identify traditional email spoofing. The domain was part of the fraud communications surrounding the four payments between 26 June and 2 July 2026.

The reviewed messages passed available Sender Policy Framework, or SPF, and DomainKeys Identified Mail, or DKIM, checks for law-ogier.co.uk. SPF specifies permitted email-sending servers, while DKIM uses a signature to validate a domain’s handling of a message. KPMG said authentication for the lookalike domain did not establish that the purported sender or underlying payment instruction was legitimate.

KPMG’s assessment was that the email-impersonation hypothesis was supported in its lookalike-domain form, while traditional spoofing was not identified. Its management interpretation was that email authentication alone cannot establish the legitimacy of a business instruction. In this case, the domain was paired with documents and communications presented as relating to a confidential transaction.

WhatsApp and personal email reduced Capillary’s organisational visibility and limited the native records available for the October 2026 review. KPMG said information about roles, approval patterns and payment processes may have come from public information, prior interactions, exposed documents or other sources. The review did not establish how that information was obtained or whether any insider was involved.

Did KPMG confirm deepfake use in the Capillary case?

No, KPMG could neither substantiate nor refute deepfake voice or video use because original audio, video, telecommunications metadata and mobile-device artefacts were unavailable. It classified deepfake-assisted impersonation as an unverified allegation, although the wider impersonation and payment-diversion mechanism was consistent with the evidence reviewed.

No forensic acquisition was performed on the personal mobile device or devices used for WhatsApp communications. KPMG also lacked original call artefacts, call-detail records and native audio-video files. Those gaps prevented technical testing of alleged voice or video manipulation associated with the 26 June to 2 July 2026 payment period.

The evidence limitations also affected review of payment approvals. Complete bank-portal audit trails, maker-checker records, workflow logs and approval timestamps were unavailable, so KPMG could not independently validate the end-to-end approval process. Slack logs were also unavailable, leaving communications conducted only through that platform outside the assessment.

KPMG made no attribution to a specific person, group or threat actor in its October 2026 report. It said open-source intelligence was contextual and was not proof of identity, ownership, control or responsibility. The work was not a statutory audit, legal opinion, compliance certification or criminal-liability assessment.

What control changes did KPMG suggest Capillary consider?

KPMG said Capillary management may consider whether beneficiary validation, callback, escalation, treasury and approval processes provide sufficient assurance for high-value payments involving newly introduced counterparties. The suggestion followed its finding that the evidenced risk was impersonators exploiting authority, secrecy, urgency, non-standard channels and formal-looking documents rather than a proven endpoint or mailbox breach.

The report also suggested independent verification of executive payment requests and transaction approvals, particularly when instructions arrive through personal email, voice or video calls, caller identification, profile images or messaging platforms outside established corporate channels. In the four disputed payments, personal email and WhatsApp reduced the records available to investigators.

KPMG did not make a definitive assessment of Capillary’s payment-governance, beneficiary-validation or approval-control effectiveness. Missing workflow records, approval logs and bank-portal audit evidence prevented that conclusion. Similarly, the financial review established first-hop transfers only, not recovery or the ultimate destination of EUR 30.411699 lakh.

Conclusion

Capillary’s disclosure frames the EUR 30.411699 lakh incident as an evidenced payment-diversion fraud based on impersonation, a lookalike domain and off-channel communications. KPMG supported the occurrence of the four initial transfers, but did not support a technical-compromise explanation involving the two reviewed laptops or corporate mailboxes.

The next disclosed step is consideration of KPMG’s report by Capillary’s Audit Committee and Board. Management may consider enhanced verification and approval procedures, while onward fund tracing, recovery, beneficial ownership, the deepfake allegation and the effectiveness of existing payment controls remain unresolved because relevant banking, device, call and workflow records were unavailable.