KPMG Audit Links Capillary's €3 Mn Fraud to External Scam

A forensic audit by KPMG has concluded that the €3.04 Mn banking fraud at SessionM Czech Republic, a subsidiary of Capillary Technologies, was most consistent with an external payment-diversion scam. According to an exchange filing by Capillary, the fraudsters impersonated a senior executive and an external lawyer.

The filing says the scheme likely relied on a lookalike email domain, social engineering, and communications over WhatsApp and personal email accounts. KPMG found no evidence of malware, unauthorised access, mailbox compromise, account takeover or traditional email spoofing in the systems and records it examined. It also found no sign of employee involvement.

Deepfake question stays open

When the fraud was first disclosed, Capillary said advanced deepfake methods had been used. The audit could neither confirm nor rule that out, because original recordings, mobile-device data and call records were not available.

Of the four disputed transactions, three went to ZZDJB CO LIMITED at HSBC Hong Kong and one to ZHONGXIAN TRADING PTE. LTD at UOB Singapore. KPMG established these initial transfers but did not trace where the money went next, identify the ultimate beneficiaries or assess the chances of recovery. Missing bank-portal and workflow records also meant it could not independently verify the company's payment approval processes.

Recovery and next steps

KPMG classed the incident as primarily a social-engineering-led fraud. Capillary says it has strengthened its payment controls and is pursuing recovery and legal remedies. Earlier, the company said it had recovered €450K and that other suspected accounts had been put on hold by banks. The subsidiary also held a cyber and crime insurance policy, and Capillary is assessing how much it can recover through it.

The company has maintained that customer data and its technology infrastructure were not compromised. SessionM, bought from Mastercard in February for $20 Mn, was Capillary's most recent acquisition.

The findings show that a fraud can cause major losses without any technical intrusion, simply by exploiting payment approval habits and trust in familiar-looking messages. For companies integrating newly acquired units, they point to verification of payment changes as a key control.