Capillary's 3 million euro loss came down to a lookalike domain and WhatsApp, KPMG finds. The deepfake question stays open

For three months, the official story of how Capillary Technologies lost about 3 million euros was a deepfake. On July 6 the Bengaluru based loyalty software company told the stock exchanges that fraudsters had used "very advanced deep-fake methodologies like voice cloning, signature forging, social engineering" to impersonate key managers at an overseas subsidiary, The Economic Times reported. On October 31 the company filed a summary of KPMG's forensic report, and it tells a plainer story: a lookalike law firm domain, a fake confidential deal, and a lot of WhatsApp.

What happened

Between June 26 and July 2, 2026, Session M Czech Republic s.r.o., a step down subsidiary of Capillary, made four payments abroad totalling EUR 3,041,169.90, according to the filing as reported by CNBC TV18 and ETLegalWorld. Three went to an account held by ZZDJB CO LIMITED at HSBC in Hong Kong, and one to ZHONGXIAN TRADING PTE. LTD at UOB in Singapore. Inc42 reports that the SessionM business came from Mastercard, which Capillary bought in February for $20 Mn.

Capillary's audit committee approved the forensic audit on July 31 and appointed KPMG Assurance and Consulting Services. The company said then that the audit was its own decision, not one ordered by a regulator or enforcement agency. It received the final report on October 30 and has sent it to the audit committee and board, which will discuss it at coming meetings.

What KPMG found

KPMG said the evidence was most consistent with a multi stage payment diversion fraud built on impersonating company executives and legal professionals. Staff were persuaded that Capillary was working on a confidential, time sensitive acquisition. The story came with a non disclosure agreement, invoices, payment requests, beneficiary bank details and even payment confirmations, CNBC TV18 reported.

The emails came from law-ogier.co.uk, a working lookalike of the legitimate ogier.com domain. Because the attackers owned that domain, their mail passed the standard SPF and DKIM sender checks. KPMG pointed out that passing those checks only proves a message came from the domain it claims, not that the sender or the payment instruction is genuine. Much of the pressure was applied over WhatsApp and personal email, which, the report says, cut the company's visibility of what was happening.

Just as important is what the auditors did not find. The report found no evidence of malware, endpoint compromise, mailbox compromise, successful unauthorised access or traditional email spoofing, and Inc42 reports it found no evidence of employee involvement. KPMG also cautioned that the absence of a compromise in the material it reviewed does not prove none occurred, and that it had not established how the fraudsters learned the company's approval patterns.

The deepfake question is still open

On the claim that started it all, the report is careful. KPMG could neither substantiate nor rule out the use of deepfake audio or video, because original recordings, call and telecom metadata and the relevant mobile devices were not available. It did not examine the personal phones used for WhatsApp. So the July disclosure is neither confirmed nor contradicted. What the evidence does show is that the attack would have worked without any synthetic voice at all.

There are other gaps. KPMG did not have bank portal audit trails, maker checker or workflow logs, Slack records or complete network data, so it could not independently test how the payments were approved. It did not trace the money beyond the first two receiving accounts, identify their beneficial owners, assess the chances of recovery or name anyone responsible. Capillary says it has tightened payment controls and is pursuing recovery and legal remedies, according to Inc42.

Why this matters beyond one company

The Capillary case is a useful correction to how these incidents are often told. A deepfake makes a better headline, but the parts of this attack that are confirmed are old: a convincing pretext, urgency and secrecy, a domain one word away from a real one, and conversations moved to channels the company does not log. None of that is stopped by a firewall or an email gateway, because nothing technical was broken.

KPMG's recommendations follow from that. It asked for stronger beneficiary validation, with independent callbacks on a known number and an escalation path for high value payments and for any payment to a new counterparty. Put simply, a request to send money to someone new should be checked through a channel the requester does not control, however senior or urgent the request looks.

For listed Indian companies with overseas subsidiaries picked up through acquisitions, the lesson is about logs as much as controls. KPMG could not rebuild the approval chain because the records were not there, and could not settle the deepfake question because the evidence lived on personal phones. A company that cannot reconstruct how a payment was approved will struggle to explain it to its board, its auditors or its shareholders, whatever the attacker used.