Impersonation, not hacking, most likely cost Capillary Technologies’ Czech subsidiary more than €3 million, a forensic report by KPMG has found, according to the company’s exchange filing on Saturday, October 31.
The company shared a summary of the findings that cost its Czech subsidary 3,041,169.90 euros on the exchanges on Saturday.
What KPMG found?
KPMG said the evidence was “most consistent with” a payment-diversion fraud built on impersonation of executives and legal professionals, social engineering, a lookalike web domain and off-channel messages. It found no sign that malware, a compromised mailbox or email spoofing caused the payments.
Session M Czech Republic s.r.o., a step-down subsidiary of Capillary, made four payments abroad between June 26 and July 2, this year. Capillary had announced a KPMG investigation into a “cyber-enabled banking fraud” on July 31.
What happened Then?
The fraudsters convinced staff that Capillary was planning a confidential, time-sensitive acquisition. They backed the claim with a non-disclosure agreement, invoices, payment requests, bank details and payment confirmations. They also used WhatsApp and personal email, which, KPMG said, reduced the company’s visibility of the exchanges.
The report said the emails came from law-ogier.co.uk, which was designed to be a working lookalike of the legitimate ogier.com domain. KPMG said in the report that it had found no traditional spoofing, and the messages passed standard sender checks known as SPF and DKIM. It further said that passing such checks does not prove a sender or payment instruction is genuine.
KPMG, however, could neither prove nor rule out claims that deepfake voice or video was used. It had no original audio, video or call data, and did not examine the personal phones used for WhatsApp, according to the filing.
Three payments went to ZZDJB CO LIMITED at HSBC Hong Kong whilw another one went to ZHONGXIAN TRADING PTE. LTD at UOB Singapore. Tracing the money beyond these first accounts, identifying the owners or recovering it fell outside the scope of the review the filing said.
KPMG did not name an individual or group behind the fraud.
The report further noted that KPMG also lacked bank-portal approval logs, Slack records and complete network data, so it could not independently check how the payments were approved.
KPMG noted that the absence of compromise in the records it reviewed was not proof that none occurred, and the report did not establish how the fraudsters learned the company’s approval patterns.
How Have Capillary Technologies Shares Performed?
The shares of Capillary Technologies ended 3.4% lower at the end of trade on Friday October 30, extending the company’s loses for the third straight session. The stock ended at ₹504, well below its IPO price of ₹577, having made its stock market debut last year. The stock is down 25% so far for the year.
Also Read: Can India afford tax cuts right now?
Capillary Technologies fraud: KPMG finds impersonation likely behind 3-million-euro loss at Czech unit