---
title: "Capillary’s Czech arm paid €3.04m to impostors; KPMG found no break-in"
summary: "What Capillary Technologies’ NSE filings and KPMG’s forensic summary say about €3.04m its Czech subsidiary paid to people posing as an executive and a lawyer, 26 June to 2 July."
url: https://www.thetechbag.com/blog/capillary-czech-arm-3-04m-euros-impostors
format: Note
desk: "Security"
area: "Email & phishing"
region: India
published: 2026-11-06
facts_checked: 2026-11-06
author: TechBag (The TechBag Journal)
tags: ["Capillary Technologies","Session M","Czech Republic","KPMG","forensic audit","payment diversion fraud","business email compromise","lookalike domain","executive impersonation","deepfake","WhatsApp","SPF","DKIM","callback verification","crime insurance","SEBI LODR Regulation 30","Intellect Design Arena"]
cover: https://www.thetechbag.com/blog/covers/capillary-czech-arm-3-04m-euros-impostors.png
---

# Capillary’s Czech arm paid €3.04m to impostors; KPMG found no break-in

*What Capillary Technologies’ NSE filings and KPMG’s forensic summary say about €3.04m its Czech subsidiary paid to people posing as an executive and a lawyer, 26 June to 2 July.*

Note · Security · Email & phishing · By TechBag · Published 2026-11-06 · Facts checked 2026-11-06 · Canonical: https://www.thetechbag.com/blog/capillary-czech-arm-3-04m-euros-impostors

Session M Czech Republic, a subsidiary Capillary Technologies had owned for eight weeks, made four payments totalling €3,041,169.90 between 26 June and 2 July to accounts at HSBC in Hong Kong and UOB in Singapore. KPMG’s forensic summary, filed by Capillary on 31 October, says no one broke in: the evidence “does not support a finding that malware, endpoint compromise, corporate mailbox compromise, successful unauthorized access or traditional email spoofing caused the payments”.[1] Staff were talked into paying.

## How the money left without a break-in

KPMG describes “executive and legal-professional impersonation” around a “purported confidential acquisition transaction”, backed by an NDA, invoices, payment requests, beneficiary bank details and payment confirmations. The emails came from `law-ogier.co.uk`, a look-alike of the law firm Ogier’s real domain, `ogier.com`, and passed SPF and DKIM checks for that look-alike domain. The rest ran over WhatsApp and personal email. KPMG’s point: “Email authentication alone does not establish legitimacy of the underlying sender or business instruction.”[1]

Capillary’s first disclosure, on 6 July, said the fraudsters used “very advanced deep-fake methodologies like voice cloning, signature forging”.[2] KPMG could neither substantiate nor refute deepfake use, because the original audio, video, call records and the phones used for WhatsApp were not available. Bank-portal audit trails and maker-checker records were not available either, so the approval process was “not independently validated”.[1]

**Figure: Four payments in seven days, two months after Capillary took control of the subsidiary**

*The Session M Czech Republic payment fraud, from Capillary's NSE filings, 1 May to 2 November 2026*

| Date | Event | Detail |
| --- | --- | --- |
| 1 May 2026 | Capillary takes control | Session M Inc. and its Czech arm, bought from Mastercard for US$6.86m in total |
| 26 Jun 2026 | First of four payments | Pretext: a confidential acquisition |
| 2 Jul 2026 | Last payment | €3,041,169.90 in all: three to HSBC Hong Kong, one to UOB Singapore |
| 6 Jul 2026 | Disclosed to NSE and BSE | About €3.0m; €0.45m recovered; deepfake claimed |
| 31 Jul 2026 | KPMG audit begins | Started by Capillary's audit committee, not a regulator |
| 4 Aug 2026 | ₹33.39 crore written off | Exceptional item in the April–June results; €0.43m frozen |
| 31 Oct 2026 | KPMG summary filed | No malware, mailbox takeover or spoofing found |
| 2 Nov 2026 | Awaiting the insurer | Claim under a crime insurance policy |

Source: Capillary Technologies NSE filings; KPMG forensic summary · as of 6 November 2026

## What it cost, and what is still open

Capillary booked the loss as an exceptional item of ₹333.86 million (₹33.39 crore) in the quarter to 30 June. Accounts holding about €0.43m were frozen after the quarter, and a claim has been made under its crime insurance policy.[3] On 2 November it said the investigation “has been concluded without any adverse findings” and that it “awaits the recovery from insurance company, if any”.[4]

TechBag countAgainst the quarter

The loss equals 13% of the ₹256.64 crore of revenue Capillary reported for April to June. It turned a ₹24.80 crore profit before exceptional items and tax into a ₹9.55 crore loss after tax.[3]

The two accounts of the report differ in emphasis. Capillary’s own summary says the report “establishes the absence of questioned employee involvement or wrong doing”.[5] KPMG’s summary says it “does not establish the source” of the fraudsters’ knowledge of roles and payment processes, “or insider involvement”, and that tracing beyond the first hop and recovery are outside its scope.[1]

## The checks KPMG points to

KPMG names independent verification for payment requests that arrive by personal email, calls, video or messaging apps, and a review of callback, beneficiary-validation and approval steps for large payments to new counterparties.[1] In practice: call back on a number you already hold, never one in the message; two approvers for a new beneficiary; and treat a domain that passes SPF and DKIM as proof only of who owns that domain.

Other cases show the pattern. On 28 October Intellect Design Arena said an employee’s mailbox at its Canadian subsidiary was taken over and used to send a customer fake payment instructions; no money left Intellect’s accounts.[6] Separately, US prosecutors said on 5 November that three people used AI to impersonate chief executives and attorneys to take about US$129m from companies, the Associated Press reported. Nothing connects that case to Capillary.[7]

How we did this

Figures as of 6 November 2026, 7pm IST

Every Capillary figure is from its own NSE filings; KPMG’s findings are from the summary Capillary filed, not the full report, which is not public. Crore figures and the 13% are our arithmetic on figures Capillary reports in rupee millions. The receiving companies’ names are left out: KPMG traced only the first hop. The deepfake claim is Capillary’s and remains unverified.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Capillary Technologies, Receipt of Forensic Audit Report, with KPMG's Project Cluewire executive summary (Annexure A), NSE](https://nsearchives.nseindia.com/corporate/CAPILLARY12_31102026083756_Intimation_Forensic_Audit_Report.pdf) — 31 October 2026
2. [Capillary Technologies, Disclosure under Regulation 30: cyber-enabled banking fraud at a step-down subsidiary, NSE](https://nsearchives.nseindia.com/corporate/CAPILLARY12_06072026161819_Disclosure_to_Stock_exchanges-Regulation_30_.pdf) — 6 July 2026
3. [Capillary Technologies, results for the quarter to 30 June 2026 (consolidated; notes 8 and 10), NSE](https://nsearchives.nseindia.com/corporate/CAPILLARY12_04082026132740_outcome_of_Board_meeting_and_results.pdf) — 4 August 2026
4. [Capillary Technologies, results for the quarter to 30 September 2026 (consolidated; notes 6 and 8), NSE](https://nsearchives.nseindia.com/corporate/CAPILLARY12_02112026121518_Intimation_Outcome_Board_Meeting.pdf) — 2 November 2026
5. [Capillary Technologies, Forensic Audit Report and its summary (filed under Fraud/Default/Arrest), NSE](https://nsearchives.nseindia.com/corporate/CAPILLARY12_31102026115318_Intimation_forensic_audit_report_and_summary.pdf) — 31 October 2026
6. [Intellect Design Arena, Intimation of cyber security incident, NSE](https://nsearchives.nseindia.com/corporate/INTELLECT_28102026162052_Cybersecurity_incident.pdf) — 28 October 2026
7. [SecurityWeek (Associated Press), 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million](https://www.securityweek.com/3-charged-in-scheme-to-use-ai-to-impersonate-ceos-and-attorneys-to-steal-129-million/) — 6 November 2026

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [Binance’s US$6.34bn theft ran from a fake job test through an internal AI tool](https://www.thetechbag.com/blog/binance-6-34bn-fake-job-test-internal-ai-tool) — Persuasion before any hacking, at far larger scale: Binance’s US$6.34bn theft began with a fake job test given to one engineer.

Go deeper on TechBag

- [Email security guide](https://www.thetechbag.com/browse/security/email-security) — filters that look past SPF and DKIM at who is really writing and what they ask for
- [Abnormal Inbound Email Security](https://www.thetechbag.com/abnormal/abnormal-inbound-email) — a filter built around impersonation and payment-request fraud
- [Aquila I Digital Risk Protection](https://www.thetechbag.com/aquilai/aquilai-digital-risk-protection) — watches for lookalike domains of your own brand; here the fake domain copied a law firm’s