A forensic audit by KPMG has found that the €3.04 Mn banking fraud at Capillary Technologies’ subsidiary SessionM Czech Republic was most consistent with an external payment-diversion scam involving impersonation of a senior executive and an external lawyer.

Capillary, in an exchange filing today, said the fraud likely involved a lookalike email domain, social engineering and communications through WhatsApp and personal email accounts.

The investigation found no evidence of malware, unauthorised access, mailbox compromise, account takeover or traditional email spoofing in the systems and records examined. It also did not identify any evidence of employee involvement. However, the audit could neither establish nor rule out the use of deepfake audio or video, as original recordings, mobile-device data and call records were unavailable.

Of the four disputed transactions, three payments went to ZZDJB CO LIMITED at HSBC Hong Kong, while the fourth was transferred to ZHONGXIAN TRADING PTE. LTD at UOB Singapore.

While the investigation established the initial transfers, it did not trace the subsequent movement of funds, identify the ultimate beneficiaries or assess the prospects of recovery. It also could not independently verify the company’s payment approval processes due to missing bank-portal and workflow records.

KPMG concluded that the incident was primarily a social-engineering-led fraud. Capillary said it has strengthened payment controls and is pursuing recovery efforts and legal remedies.

7 Cr) at one of its step-down subsidiaries, SaaS company Capillary Technologies said it has initiated a forensic audit to investigate the suspected fraudulent and unauthorised banking transactions.

Source link