Capillary Technologies subsidiary loses €3.04 million in social engineering fraud

How the fraud unfolded

SessionM Czech Republic, a subsidiary of Capillary Technologies, was defrauded of €3.04 million in a scheme involving impersonation of a senior executive and an external lawyer. According to Inc42, the attackers likely used a lookalike email domain, WhatsApp, and personal email accounts to execute the fraud, which took place just before the weekend of July 3, 2026.

KPMG’s forensic audit concluded that the incident was primarily a social-engineering-led scam, with no evidence of malware, unauthorised access, or employee involvement. However, the audit could not rule out the use of deepfake audio or video, as call records and mobile-device data were unavailable for review.

Funds diverted to Hong Kong and Singapore

The fraudulent transactions were sent to two entities: €3.04 million was transferred to ZZDJB CO LIMITED at HSBC Hong Kong and ZHONGXIAN TRADING PTE. LTD at UOB Singapore. While Capillary Technologies recovered €450,000 and traced the suspect accounts, the audit did not follow the subsequent movement of funds or identify the ultimate beneficiaries.

The company has taken legal steps to recover the remaining funds and has strengthened its payment controls to prevent similar incidents.

Financial performance unaffected

Despite the fraud, Capillary Technologies reported strong financial results for FY26. Its net profit surged 296% to ₹52.4 crore, while operating revenue rose 23% to ₹734.6 crore. In Q4 FY26 alone, net profit grew multifold to ₹43.4 crore, and operating revenue increased 25% year-over-year to ₹191.3 crore.

The company stated that customer data and its technology infrastructure remained uncompromised.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This incident highlights how social engineering frauds increasingly bypass technical safeguards by exploiting human trust. For founders and operators—particularly those with global subsidiaries—it underscores three hard lessons:

1. Payment controls must evolve: Even mature SaaS businesses with strong cybersecurity can fall victim to impersonation scams. Multi-factor authentication for payments is no longer optional, and secondary approvals for high-value transactions should be table stakes. The attack’s timing (just before a weekend) suggests attackers are exploiting windows when teams are less vigilant—a playbook worth guarding against.

2. Subsidiaries are soft targets: SessionM Czech Republic is a small part of Capillary’s global operations, but fraudsters treated it as an entry point. Founders should map their weakest links—not just the biggest entities—and apply uniform controls across all subsidiaries, regardless of size or geography.

3. Recovery is uncertain, even with forensic proof: While Capillary recovered €450,000, the audit’s gaps (missing call records, no deepfake confirmation) weaken legal leverage. The funds’ movement to Hong Kong and Singapore—jurisdictions with varying degrees of cooperation—further complicates recovery. This serves as a reminder that losses from fraud are often irreversible, making prevention the only reliable strategy.

Key takeaways

• Social engineering frauds targeting executive impersonation bypass technical controls, underscoring the need for multi-layered payment verification even in subsidiaries.
• Recovery of diverted funds is uncertain; legal and banking interventions may limit losses but cannot guarantee full restitution.
• Forensic audits can clear internal teams but may leave gaps—especially when external communications (calls, personal devices) are not preserved.

Related on Lazyfounder

• More business news