Impersonation, not a technical break-in, most likely cost a Capillary Technologies subsidiary more than 3 million euros, according to a forensic report by KPMG that the company summarized in an exchange filing on Saturday, October 31. Capillary said the evidence was most consistent with an external payment-diversion fraud involving impersonation of a senior executive and an external lawyer, social engineering, a lookalike email domain, and communications through WhatsApp and personal email accounts.
The loss fell on Session M Czech Republic s.r.o., a step-down subsidiary of the customer engagement and loyalty software company. It made four payments abroad between June 26 and July 2 totaling 3,041,169.90 euros. Three payments went to ZZDJB CO LIMITED at HSBC Hong Kong, while the fourth went to ZHONGXIAN TRADING PTE. LTD at UOB Singapore. According to the filing summary, the fraudsters convinced staff that Capillary was planning a confidential, time-sensitive acquisition.
The messages at the center of the scheme came from law-ogier.co.uk, a domain designed to look like the legitimate ogier.com domain. KPMG found no traditional email spoofing in the messages, which passed the standard SPF and DKIM sender checks. More broadly, the investigation found no evidence of malware, unauthorized access, mailbox compromise, account takeover, or employee involvement in the systems and records it examined.
The report also leaves important questions open. KPMG could neither establish nor rule out the use of deepfake audio or video, because original recordings, mobile-device data, and call records were unavailable. It did not trace the subsequent movement of the money, identify the ultimate beneficiaries, or assess the prospects of recovery. It also could not independently verify how the payments were approved, because bank-portal approval logs, Slack records, and complete network data were missing. KPMG did not name an individual or group behind the fraud, and it noted that finding no compromise in the records reviewed was not proof that none occurred.
Capillary first announced a KPMG investigation into what it called a cyber-enabled banking fraud on July 31. SessionM, the loyalty platform business behind the Czech subsidiary, was acquired from Mastercard in February for 20 million dollars, according to Inc42. Capillary said it has strengthened its payment controls and is pursuing recovery efforts and legal remedies. Its shares ended 3.4 percent lower on Friday, October 30, extending losses for a third straight session.
For enterprise IT and finance teams, the case is a reminder that the weakest point in a payment process may not be software at all. A registered lookalike domain can pass authentication checks that were designed to stop spoofing, and moving a conversation to WhatsApp or a personal inbox takes it outside corporate logging and review. The defenses that matter here are procedural: independent, out-of-band verification of new payment instructions, a hard rule against approving transfers from off-channel messages, and a second approval path that cannot be satisfied by the same conversation that requested the money. None of those controls requires a breach to fail — only a convincing story, told urgently and in confidence.