Capillary says €3.04 million fraud relied on impersonation | Market News & Analysis

Capillary Technologies India Limited said KPMG Česká republika, s.r.o.'s October 2026 forensic review found four disputed payments totalling €3,041,169.90 were most consistent with payment-diversion fraud using executive and legal-professional impersonation, a lookalike domain and off-channel communications. The reviewed evidence did not support malware, mailbox compromise or unauthorised systems access as the cause.

How did the Capillary payment-diversion fraud work?

The fraud affecting Capillary’s stepdown subsidiary, Session M Czech Republic s.r.o., involved four disputed payments executed from 26 June 2026 to 2 July 2026. KPMG assessed the available evidence as most consistent with a multi-stage scheme in which external parties impersonated a senior executive and an outside legal professional while presenting a purported confidential acquisition transaction.

The communications used a purported non-disclosure agreement, invoices, payment requests, beneficiary banking details and payment confirmations to support the instructions. KPMG identified confidentiality and urgency pressure, WhatsApp and personal email as the principal communication mechanisms. Its conclusion was that these methods induced authorised payment activity rather than showing that an attacker technically controlled Capillary systems or accounts.

KPMG established the first-hop payments from supplied transaction and banking records. However, it did not establish the ultimate movement of funds, beneficial ownership of the receiving entities, beneficiary-bank intelligence or recovery status. The review also did not attribute the fraud to a specific individual, group or threat actor.

Did Capillary systems or email accounts suffer a breach?

No, KPMG found no evidence in the reviewed records that a technical compromise of Capillary corporate accounts or the two examined laptops caused the four payments. The investigation reviewed two forensic laptop images, mailbox and authentication records, communications, transaction documentation, Google Workspace-related logs, Google Takeout exports and open-source intelligence material.

On the two reviewed laptops, KPMG identified no incident-related malware, unauthorised remote-access tools, persistence, credential-theft utilities or malicious scripts. It also found no evidence in supplied records of successful unauthorised mailbox access, malicious forwarding, mailbox-rule manipulation or account takeover. The findings therefore did not support endpoint involvement or mailbox compromise as the root cause.

KPMG cautioned that this conclusion was bounded by the records and artefacts reviewed and was not proof that compromise was impossible or never occurred. Complete virtual private network, network, proxy, firewall, packet-capture, memory and some endpoint-security backend telemetry were unavailable. Slack logs were also unavailable, leaving communications solely on that channel outside the assessment.

What role did the lookalike email domain play?

KPMG found that relevant messages came from law-ogier.co.uk, an operational lookalike domain, rather than forged infrastructure representing the legitimate ogier.com domain. This supported lookalike-domain impersonation but did not support a finding of traditional email spoofing.

The reviewed messages passed available Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) checks for the lookalike sending domain. KPMG’s management interpretation was that email authentication for a sending domain does not establish the legitimacy of the sender or the underlying business instruction. The distinction is important because the checks applied to law-ogier.co.uk rather than ogier.com.

KPMG’s hypothesis assessment therefore supported email impersonation through the lookalike domain while recording that traditional spoofing was not identified. The report instead described external personas using a similar domain, formal-looking documents and non-standard communication channels. That mechanism differed from the technical-compromise explanation that the reviewed materials did not support.

Were deepfakes or insider involvement established?

No, KPMG could neither substantiate nor refute the allegation that deepfake voice or video was used in the four-payment incident. Original audio and video, telecommunications metadata, call-detail records and native mobile-call artefacts were unavailable. No forensic acquisition was undertaken of the personal mobile device or devices used for WhatsApp communications.

KPMG recommended that management treat deepfake use as an unverified allegation while strengthening executive verification regardless. The absence of original mobile and call evidence meant that the investigation could not technically determine whether voice or video material had been manipulated. The broader payment-diversion hypothesis was nonetheless supported by reviewed transaction and communication records.

The review also did not establish insider involvement or the source of the fraudsters’ apparent knowledge of organisational roles, approval patterns and payment processes. KPMG said that knowledge may have come from public information, prior interaction, exposed documents or other sources. It stated that open-source intelligence was contextual and did not prove identity, ownership, control or responsibility.

What payment-control actions did Capillary identify?

Capillary said it had further strengthened payment controls and was actively pursuing recovery and legal remedies in its 31 October 2026 disclosure. KPMG identified the immediate business risk as external personas exploiting authority, secrecy, urgency, formal documents and communications outside normal corporate channels.

The report said management may consider whether beneficiary validation, callback, escalation, treasury and approval procedures provide sufficient assurance for high-value transactions involving newly introduced counterparties. It also highlighted independent verification for executive payment requests and approvals, particularly where instructions arrive through personal email, voice or video calls, caller identification, profile images or messaging platforms outside established corporate channels.

KPMG could not provide a definitive assessment of payment-governance, beneficiary-validation or approval-control effectiveness. Complete bank-portal audit trails, maker-checker records, workflow logs and approval timestamps were unavailable, so the end-to-end approval process was not independently validated. Its recommended management conclusion was consequently subject to those evidence limitations.

KPMG’s October 2026 assessment places the four disputed payments, totalling €3,041,169.90, in a social-engineering and payment-diversion context rather than a demonstrated cyber intrusion into Capillary accounts, mailboxes or the two examined endpoints. The supported mechanisms were executive and legal-professional impersonation, the law-ogier.co.uk lookalike domain, urgency and secrecy, and communications through WhatsApp and personal email.

The matters to watch are Capillary’s stated pursuit of recovery and legal remedies, together with any enhanced verification and payment-control actions management adopts. Further conclusions on deepfake use, fund movements, beneficial ownership and the approval workflow would require the mobile, call, bank-portal and workflow records that KPMG said were unavailable.

Frequently Asked Questions

Did your stocks survive the war?

See what broke. See what stood.