KPMG Could Not Confirm the Deepfake in Capillary's €3 Million Fraud
Security / news
KPMG Could Not Confirm the Deepfake in Capillary's €3 Million Fraud
Capillary Technologies blamed deepfake cloning in July, but the forensic audit it filed on Oct. 31 calls the loss a payment-diversion scam and says the missing recordings and phone data leave deepfakes unproven.
Capillary Technologies told investors in July that fraudsters used "advanced deepfake methods including cloning, signature forging, social engineering" to impersonate senior management and divert about €3 million. The KPMG forensic audit the company filed with exchanges on Oct. 31 reaches a narrower conclusion, according to Inc42's account of the filing: the loss was "most consistent with an external payment-diversion scam".
What KPMG found and could not find
KPMG Assurance and Consulting Services LLP, hired after the Audit Committee approved a forensic audit on July 31, put the fraud at €3.04 million. Its summary calls the incident "primarily a social-engineering-led fraud". The likely route was a lookalike email domain, impersonation of a senior executive and an external lawyer, and messages over WhatsApp and personal email.
On deepfakes, KPMG could neither establish nor rule them out. The original recordings, mobile-device data and call records were not available, Inc42 reported. In the systems KPMG examined it found no evidence of malware, unauthorised access, mailbox compromise, account takeover or traditional email spoofing. That caveat matters: a finding limited to examined systems says nothing about the personal accounts and phones where the conversations happened.
The audit found no evidence of employee involvement. It also could not verify how the payments were approved, because bank-portal and workflow records were missing.
| Disputed payments | Beneficiary | Bank |
|---|---|---|
| Three | ZZDJB CO LIMITED | HSBC, Hong Kong |
| One | ZHONGXIAN TRADING PTE. LTD | UOB, Singapore |
KPMG did not trace funds past the first transfers, identify the ultimate beneficiaries or assess recovery prospects, per Inc42.
What Capillary said in July
The company's disclosure came on July 6, 2026, with the attack placed just before July 3. Sahi's report on the audit appointment gives the suspected loss as about €3.0 million, or ₹32.70 crore, taken from an overseas step-down subsidiary. About €450,000 (₹4.90 crore) was recovered immediately. Banks put the remaining €2.55 million (₹27.80 crore) on hold.
Sahi described the incident as a "boss scam" using voice cloning and signature forgery. Inc42 reports that Capillary also said its customer data and technology infrastructure stayed uncompromised, and that the subsidiary was covered by a cyber and crime insurance policy.
The subsidiary was unnamed in July. Inc42 names it in its October report as SessionM Czech Republic, a step-down subsidiary of Capillary. The Sahi report does not name it, so the identification rests on Inc42 alone.
What is still open
The October filing does not settle how much is recoverable. Inc42 says the amount still on hold is yet to be determined. Capillary said in the filing that it has strengthened payment controls and is pursuing recovery and legal remedies.
The gap between July's wording and October's matters for other finance teams. A deepfake story points a company toward detection tools. A payment-diversion finding points toward callback verification of any change in beneficiary details. For other Indian finance-sector incidents, see the Rs 300 crore reported stolen from small NBFCs and the AU Small Finance Bank leak claim.
Capillary's next disclosure should say how much of the €2.55 million banks are still holding, which neither KPMG's findings nor the company's October filing quantify, according to Inc42.
Sources
More in Security
- 01Ivanti Connect Secure Zero-Day Chain Gave Root on a Patched VPN, and the Integrity Checker Misses ItVolexity dates exploitation to October 3, ten days before Ivanti's advisory; the root escalation step has no CVE and no fix in the sources reviewed.
- 02Alpine Logged GitLab CVE-2026-97229 Attacks Nine Days Before CISA Listed ItAlpine's incident report shows the CVSS 10.0 flaw was exploited against its own server on Oct. 20 and 21, and that two GitLab 19.3 builds it ran still carried the bug.
- 03Linux TCP Flaw CVE-2026-98432 Still Unpatched on RHEL and UbuntuThe kernel team scores the use-after-free 9.8, Anthropic says its model wrote a root exploit for it, and the two biggest enterprise distributions have no fixed kernel.
- 04AU Small Finance Bank Probes Leak Claim on Salesforce PlatformThe bank confirms an investigation into limited vehicle-loan data, while a group claiming Aadhaar, PAN and credit reports has released no samples.