Forensic Audit Links Capillary Technologies Fraud to External Breach

A forensic audit by KPMG has determined that a €3.04 million banking fraud at Capillary Technologies’ subsidiary, SessionM Czech Republic, resulted from an external payment-diversion scheme. The investigation concluded that perpetrators likely used social engineering, lookalike email domains, and impersonation tactics to target the firm.

Key Takeaways

• External breach confirmed: The investigation identified the incident as a social-engineering-led fraud rather than an internal system failure.
• Impersonation tactics used: Attackers impersonated a senior executive and an external lawyer through WhatsApp and personal email accounts.
• No internal involvement: The audit found no evidence of employee collusion or internal malware within the company’s systems.
• Unknown beneficiaries: While the audit tracked the initial transfers to accounts in Hong Kong and Singapore, the ultimate beneficiaries remain unidentified.
• Limited forensic data: Investigators could not rule out the use of deepfake technology due to the unavailability of original call records and mobile data.

Investigation Findings

Capillary Technologies, a SaaS company, reported the findings in an exchange filing following a comprehensive review by KPMG Assurance and Consulting Services LLP. The audit examined the company’s banking processes and financial controls after the unauthorized transactions occurred in July. While the report identified the use of lookalike domains, it found no evidence of traditional email spoofing, mailbox compromise, or unauthorized system access.

The fraud involved four distinct transactions. Three payments were directed to ZZDJB CO LIMITED at HSBC Hong Kong, and one payment was sent to ZHONGXIAN TRADING PTE. LTD at UOB Singapore. The audit could not independently verify the company’s payment approval processes because certain bank-portal and workflow records were missing.

Recovery Efforts

Capillary Technologies stated that it is pursuing legal remedies and recovery efforts regarding the missing funds. The company has also implemented strengthened payment controls to prevent future incidents. The audit did not assess the likelihood of financial recovery.