Capillary Technologies says KPMG report points to payment fraud at Czech unit

Capillary Technologies India Limited said in a filing with the National Stock Exchange on 31 October 2026 that it received the final forensic audit report from KPMG on 30 October 2026. The report concerns what the company calls a cyber-enabled banking fraud at a step-down subsidiary, Session M Czech Republic s.r.o. According to the report, four disputed payments totalling EUR 3,041,169.90 were made between 26 June 2026 and 2 July 2026.

What Happened

The company said it had told the exchange on 31 July 2026 that KPMG had begun a forensic audit. It said the final report has been sent to the members of its Audit Committee and Board of Directors, and will be placed before them at their next meetings. A summary of the key findings was attached to the filing.

According to that summary, the evidence is "most consistent with a multi-stage payment-diversion fraud" based on impersonation of executives and an outside adviser, social engineering, a lookalike email domain and communications outside company channels. The report says three payments went to an account at HSBC Hong Kong and one to an account at UOB Singapore.

The report says it found no evidence of malware on the two laptops reviewed, and no evidence of unauthorised access to company mailboxes. It says no traditional email spoofing was identified. On the possible use of deepfake voice or video, it says this "could neither be substantiated nor refuted" because the original audio, video and call records were not available.

The report lists limits on its work. It says it traced only the first payments and not where the money went next, who owns the receiving accounts, or whether any of it can be recovered. It says no individual, group or threat actor was identified, and that bank-portal audit trails and approval records were not available, so the company's payment-approval process could not be independently assessed. It also says it is not a legal opinion or a finding of criminal liability.

What It Means

For shareholders, the filing gives the first detailed account of how the subsidiary's money was diverted, as described by the auditor engaged by the company. The findings are KPMG's, as set out in a summary the company chose to share, and the full report has not been made public.

The report says the main business risk was people being persuaded to authorise payments, not a break-in to company systems. It suggests extra checks on high-value payment requests, especially those that arrive through personal email or messaging apps. The filing does not say whether any money has been recovered or whether a police complaint has been filed.

Readers who face a cyber fraud can report it at https://cybercrime.gov.in or on helpline 1930.

Oquilia Data: Capillary Technologies India Ltd. (NSE: CAPILLARY)

Closes adjusted for splits and bonuses; returns exclude dividends; insider figures from BSE filings. Facts from NSE's files, not investment advice.

Source: Company filing on NSE