Capillary’s Czech arm paid €3.04m to impostors; KPMG found no break-in
What Capillary Technologies’ NSE filings and KPMG’s forensic summary say about €3.04m its Czech subsidiary paid to people posing as an executive and a lawyer, 26 June to 2 July.
Session M Czech Republic, a subsidiary Capillary Technologies had owned for eight weeks, made four payments totalling €3,041,169.90 between 26 June and 2 July to accounts at HSBC in Hong Kong and UOB in Singapore. KPMG’s forensic summary, filed by Capillary on 31 October, says no one broke in: the evidence “does not support a finding that malware, endpoint compromise, corporate mailbox compromise, successful unauthorized access or traditional email spoofing caused the payments”.1 Staff were talked into paying.
01How the money left without a break-in
KPMG describes “executive and legal-professional impersonation” around a “purported confidential acquisition transaction”, backed by an NDA, invoices, payment requests, beneficiary bank details and payment confirmations. The emails came from law-ogier.co.uk, a look-alike of the law firm Ogier’s real domain, ogier.com, and passed SPF and DKIM checks for that look-alike domain. The rest ran over WhatsApp and personal email. KPMG’s point: “Email authentication alone does not establish legitimacy of the underlying sender or business instruction.”1
Capillary’s first disclosure, on 6 July, said the fraudsters used “very advanced deep-fake methodologies like voice cloning, signature forging”.2 KPMG could neither substantiate nor refute deepfake use, because the original audio, video, call records and the phones used for WhatsApp were not available. Bank-portal audit trails and maker-checker records were not available either, so the approval process was “not independently validated”.1
Four payments in seven days, two months after Capillary took control of the subsidiary
The Session M Czech Republic payment fraud, from Capillary's NSE filings, 1 May to 2 November 2026
Show tableHide table
| Date | Event | Detail |
|---|---|---|
| 1 May 2026 | Capillary takes control | Session M Inc. and its Czech arm, bought from Mastercard for US$6.86m in total |
| 26 Jun 2026 | First of four payments | Pretext: a confidential acquisition |
| 2 Jul 2026 | Last payment | €3,041,169.90 in all: three to HSBC Hong Kong, one to UOB Singapore |
| 6 Jul 2026 | Disclosed to NSE and BSE | About €3.0m; €0.45m recovered; deepfake claimed |
| 31 Jul 2026 | KPMG audit begins | Started by Capillary's audit committee, not a regulator |
| 4 Aug 2026 | ₹33.39 crore written off | Exceptional item in the April–June results; €0.43m frozen |
| 31 Oct 2026 | KPMG summary filed | No malware, mailbox takeover or spoofing found |
| 2 Nov 2026 | Awaiting the insurer | Claim under a crime insurance policy |
Source: Capillary Technologies NSE filings; KPMG forensic summary · as of 6 November 2026
02What it cost, and what is still open
Capillary booked the loss as an exceptional item of ₹333.86 million (₹33.39 crore) in the quarter to 30 June. Accounts holding about €0.43m were frozen after the quarter, and a claim has been made under its crime insurance policy.3 On 2 November it said the investigation “has been concluded without any adverse findings” and that it “awaits the recovery from insurance company, if any”.4
The two accounts of the report differ in emphasis. Capillary’s own summary says the report “establishes the absence of questioned employee involvement or wrong doing”.5 KPMG’s summary says it “does not establish the source” of the fraudsters’ knowledge of roles and payment processes, “or insider involvement”, and that tracing beyond the first hop and recovery are outside its scope.1
03The checks KPMG points to
KPMG names independent verification for payment requests that arrive by personal email, calls, video or messaging apps, and a review of callback, beneficiary-validation and approval steps for large payments to new counterparties.1 In practice: call back on a number you already hold, never one in the message; two approvers for a new beneficiary; and treat a domain that passes SPF and DKIM as proof only of who owns that domain.
Other cases show the pattern. On 28 October Intellect Design Arena said an employee’s mailbox at its Canadian subsidiary was taken over and used to send a customer fake payment instructions; no money left Intellect’s accounts.6 Separately, US prosecutors said on 5 November that three people used AI to impersonate chief executives and attorneys to take about US$129m from companies, the Associated Press reported. Nothing connects that case to Capillary.7
Sources
- Capillary Technologies, Receipt of Forensic Audit Report, with KPMG's Project Cluewire executive summary (Annexure A), NSE — 31 October 2026
- Capillary Technologies, Disclosure under Regulation 30: cyber-enabled banking fraud at a step-down subsidiary, NSE — 6 July 2026
- Capillary Technologies, results for the quarter to 30 June 2026 (consolidated; notes 8 and 10), NSE — 4 August 2026
- Capillary Technologies, results for the quarter to 30 September 2026 (consolidated; notes 6 and 8), NSE — 2 November 2026
- Capillary Technologies, Forensic Audit Report and its summary (filed under Fraud/Default/Arrest), NSE — 31 October 2026
- Intellect Design Arena, Intimation of cyber security incident, NSE — 28 October 2026
- SecurityWeek (Associated Press), 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million — 6 November 2026
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
