.png)
Capillary Technologies India has received a forensic audit report identifying a payment-diversion fraud involving approximately €3.04 million at its step-down subsidiary in the Czech Republic, with the findings pointing to social engineering and the impersonation of senior executives and legal professionals.
The report, prepared by KPMG Assurance and Consulting Services LLP, examined four disputed payments totalling €3.041 million made between June 26 and July 2, 2026, by Session M Czech Republic s.r.o. Three payments were made to ZZDJB CO LIMITED, with an account at HSBC Hong Kong, while another was made to ZHONGXIAN TRADING PTE. LTD., with an account at UOB Singapore.
According to the report, the incident followed a pattern consistent with the impersonation of company executives and legal advisers. The purported transaction was supported by documents including a non-disclosure agreement, invoices, payment requests, beneficiary details and payment confirmations.
The investigation also identified the use of a lookalike domain, law-ogier.co.uk, and communications conducted outside established channels. These elements were consistent with a scheme relying on apparent authority, confidentiality and urgency to induce payments.
However, the report did not establish that malware, endpoint compromise, mailbox compromise, successful unauthorised access or traditional email spoofing had caused the incident.
The possible use of deepfake audio or video could neither be substantiated nor ruled out because original recordings, telecommunications metadata and relevant mobile-device evidence were unavailable. The report also did not establish the ultimate movement of the funds, the beneficial ownership of the recipient accounts or whether the money could be recovered. It did not identify the individuals responsible.
Audit initiated in July
Capillary had disclosed on July 31 that its Audit Committee had approved the initiation of a forensic audit into suspected fraudulent and unauthorised banking transactions. The company had appointed KPMG Assurance and Consulting Services LLP to examine the transactions, review relevant records and banking processes, assess internal financial controls, determine the root cause and recommend corrective measures.
The company said at the time that the audit had been initiated by Capillary and not by a regulatory or enforcement agency.
In its subsequent disclosure, Capillary said it received the forensic audit report on October 30 and forwarded it to the Audit Committee and the board for review. The findings are to be discussed at upcoming meetings.
Focus on payment controls
The report identified social engineering and the exploitation of trust, secrecy and urgency as central features of the incident, rather than demonstrating a conventional technical breach of the company's systems.
It recommended strengthening beneficiary-validation procedures, including independent callbacks and escalation mechanisms for high-value payments and payments involving new counterparties.
The report also noted limitations in assessing the end-to-end payment approval process because bank-portal audit trails and maker-checker and workflow logs were unavailable. Accordingly, the available evidence did not permit an independent validation of the complete payment-approval process.
The findings outline the apparent mechanics of the payment-diversion scheme but leave key questions unresolved, including the ultimate destination of the funds, the identities of those responsible and the prospects of recovery.
English (US) ·