Capillary Technologies reports €3.04 million payment fraud

Capillary Technologies India Limited received a KPMG forensic report on a payment-diversion fraud involving four disputed payments worth €3.04 million at Session M Czech Republic s.r.o. The report found a pattern of executive and legal-professional impersonation, a lookalike domain and off-channel communications, while leaving the destination and recoverability of funds unresolved.

What did KPMG find in Capillary's forensic audit?

KPMG's forensic review found evidence consistent with a multi-stage social-engineering scheme that induced payments from Capillary's Czech step-down subsidiary. The investigation covered four disputed payments, totalling EUR 3,041,169.90, executed by Session M Czech Republic s.r.o. between June 26, 2026 and July 2, 2026.

Three payments were sent to ZZDJB CO LIMITED, which held an account at HSBC Hong Kong. A fourth payment went to ZHONGXIAN TRADING PTE. LTD., which held an account at UOB Singapore. The report identified the apparent impersonation of senior company executives and legal professionals as a central feature of the events.

The findings also referred to the use of the lookalike domain law-ogier.co.uk and communications conducted outside established corporate channels. According to the report, the apparent scheme used authority, confidentiality and urgency to make payment requests appear legitimate and to press for action.

How did the payment-diversion scheme operate?

The available evidence indicates that the fraud relied primarily on social engineering rather than a confirmed breach of Capillary's technical systems. Formal-looking communications and the impersonation of people appearing to hold executive or legal authority were used to support the disputed payment instructions.

The use of personal email accounts and WhatsApp channels reduced organisational visibility and limited the evidence available for the review. KPMG noted that these non-standard channels can make it harder for businesses to verify whether urgent payment requests originate from authorised personnel.

The forensic work included the review of laptop images, mailbox and authentication records, communications and transaction documents. However, KPMG said it could not independently validate the complete end-to-end payment approval process because bank-portal audit trails, maker-checker records and workflow logs were unavailable.

This limitation matters because payment controls depend not only on documented policies but also on the records showing how a particular transaction was initiated, checked and approved. The report therefore describes the apparent mechanics of the diversion but does not establish every step in the approval chain.

Was there a confirmed cyber breach or deepfake attack?

KPMG did not establish that malware, endpoint compromise, mailbox compromise, successful unauthorised access or traditional email spoofing caused the incident. The report's findings instead point to the exploitation of trust and communication practices through external personas and off-channel contact.

The possible use of deepfake audio or video remains unverified. KPMG could neither substantiate nor rule out that allegation because original recordings, telecommunications metadata and relevant mobile-device evidence were not available for examination.

This distinction is significant for Capillary's internal-control response. A payment fraud involving impersonation may require stronger verification procedures even where a review does not identify a technical compromise in the systems or artefacts examined.

The report also did not identify the individuals responsible, the beneficial owners of the recipient accounts or the ultimate movement of the funds. It did not determine whether the money can be recovered. These remain material unresolved issues in the case.

How did Capillary respond to the suspected transactions?

Capillary initiated the forensic audit after its Audit Committee approved the exercise on July 31, 2026, following suspected fraudulent and unauthorised banking transactions. The company appointed KPMG Assurance and Consulting Services LLP to examine the transactions, review relevant records and banking processes, assess internal financial controls, determine the root cause and recommend corrective measures.

Capillary had said that the forensic audit was initiated by the company and not by a regulatory or enforcement agency. The final report was received on October 30, 2026 and circulated to the Audit Committee and Board of Directors for review and discussion at upcoming meetings.

KPMG recommended stronger beneficiary-validation procedures, including independent callbacks and escalation mechanisms for high-value payments and transactions involving new counterparties. It also highlighted the need for independent verification of executive payment requests, especially where requests are confidential, time-sensitive or received outside ordinary channels.

The findings give the board a documented basis to consider control changes, but the disclosure does not state what actions have been approved. Capillary's next formal update may clarify the measures adopted after the Audit Committee and board have considered the report.

What does the report mean for investors and operations?

The report establishes a financial exposure of EUR 3.04 million across four disputed payments, but it does not establish the final destination of the funds or whether recovery is possible. Those unanswered points are relevant to the ultimate financial effect on Capillary and its subsidiary.

For investors, the disclosure provides more detail on the reported incident while also setting boundaries on what the forensic evidence supports. The company has not disclosed a share-price reaction, a recovery estimate or a quantified financial-control impact in the information provided, so those effects cannot be independently measured from the report.

For corporate operations, the case illustrates the risk that payment processes can face when high-value instructions are accompanied by apparent senior authority and urgency. The reported weaknesses relate to verification, audit visibility and the availability of approval records rather than to a confirmed malware or infrastructure intrusion.

The broader lesson for companies handling cross-border payments is that new beneficiaries and unusual payment instructions require checks that do not rely solely on the communication channel used by the requester. KPMG's recommendation for callbacks and escalation is aimed at creating an independent confirmation step before funds are released.

Conclusion

Capillary's forensic report outlines an apparent payment-diversion fraud involving EUR 3.04 million at its Czech subsidiary, with impersonation, a lookalike legal domain and off-channel communication identified as the core features. It does not confirm a technical breach or deepfake use, and it leaves the responsible parties, fund trail and recovery prospects undetermined.

The immediate point to watch is the review by Capillary's Audit Committee and Board of Directors, which received the report on October 30, 2026. Their recorded response to KPMG's recommendations, including any strengthened beneficiary checks and payment-approval controls, will indicate how the company addresses the identified risks.