--- title: "€3 Million Gone: How Deepfakes Fooled a Company's Own Bank" published: 2026-07-12T00:02:37.774Z updated: 2026-10-11T06:12:57.876Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/capillary-tech-deepfake-banking-fraud-voice-cloning --- # €3 Million Gone: How Deepfakes Fooled a Company's Own Bank **Cite as:** €3 Million Gone: How Deepfakes Fooled a Company's Own Bank, Trust Onion, 2026-10-11. https://trustonion.io/blog/capillary-tech-deepfake-banking-fraud-voice-cloning In June 2026, Capillary Technologies disclosed that an overseas subsidiary had lost approximately €3 million after attackers used voice cloning, forged signatures, and social engineering to impersonate the company's own executives. By the time anyone realized what had happened, the money was already moving to unauthorized accounts. The voice on the call sounded exactly like a Capillary Technologies executive. It wasn't. Capillary Technologies is a Bengaluru-based SaaS company with institutional backing and professional finance teams. Its overseas subsidiary had processes in place. None of that stopped a cloned voice and some forged paperwork from moving €3 million out the door. At the time of disclosure, the company had recovered €0.45 million, leaving roughly €2.55 million still missing. This kind of fraud is no longer theoretical. In February 2024, engineering firm Arup lost $25 million when an employee joined a video call where every other participant was a deepfake. In the Capillary case, attackers didn't even need video. ## How the Fraud Worked The attack combined three techniques, none novel on their own, but together they worked. Voice cloning produced audio that sounded like Capillary's key managerial personnel. Modern tools can generate a convincing replica from as little as 20 to 30 seconds of audio, and earnings calls, conference presentations, YouTube videos, and LinkedIn posts all work as source material. Forged signatures added a paper trail that looked legitimate. When a voice says "transfer the funds" and a document arrives with a matching signature, the pressure to comply is real. Social engineering tied it together: the attackers knew enough about the company, its personnel, and its subsidiary structure to make the requests feel routine. That's not luck. That's research. According to the World Economic Forum, deepfake fraud attempts increased 500% in 2024. The technology keeps getting cheaper, and the gap between what's real and what sounds real keeps narrowing. Employees fall for this not because they're negligent, but because humans are wired to trust familiar voices. When a call sounds like a known executive and arrives with supporting documents, questioning it feels unnatural. Attackers research company structures in advance precisely because they know this. ## The Verification Problem Every fraud like this comes down to the same failure: someone couldn't verify they were actually talking to who they thought they were talking to. Phone numbers can be spoofed. Email accounts can be compromised. Voices can be cloned. Signatures can be forged. What holds up is a shared secret: information only the real person would know, not publicly available, and rotated frequently enough to be useless if stolen. Trust Onion gives finance and operations teams exactly that: three rotating codewords, calculated locally on authorized devices, that change every 60 seconds. Before approving a wire transfer or acting on an executive instruction, staff ask: "What are the words?" If the caller can't answer, the request stops there. The words are never sent to a server, work offline, and expire on a 60-second rotation. "Before I process this transfer, what are the words?" is a sentence that stops a cloned voice cold. For teams that need to verify physical presence, a Proofie™ is a selfie signed using a passkey in the Trust Onion app. Verification checks the passkey signature against the full public key, the original photo's SHA-256 hash and byte length, and the signed record, including time and What3Words location. A valid Proofie establishes that whoever created the signed record possessed the private key at proof creation; compare the verified full signing key with the person's public key in your shared Trust Onion group. A subsidiary receives what sounds like an urgent instruction from headquarters. The voice is convincing. The paperwork looks right. The window to think clearly is short. Three words close that window on the attacker. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Capillary Technologies lost approximately €3 million through voice cloning and forged signatures alone, with only €0.45 million recovered at the time of disclosure. - Modern voice cloning tools can produce a convincing replica from as little as 20 to 30 seconds of audio, using public sources such as earnings calls, conference presentations, or LinkedIn videos. - According to the World Economic Forum, deepfake fraud attempts increased 500% in 2024, making businesses of every size and funding level potential targets. ## Frequently asked questions ### How did deepfake fraud steal 3 million euros from Capillary Technologies? Attackers used cloned executive voices and forged signatures to trick an overseas subsidiary into authorizing fraudulent transfers. The familiar-sounding audio combined with legitimate-looking paperwork made the requests appear routine. As of disclosure, only €0.45 million had been recovered. ### How little audio does someone need to clone a voice? Modern voice cloning tools can produce convincing replicas from as little as 20 to 30 seconds of audio. Public sources like earnings calls, conference presentations, YouTube videos, and LinkedIn posts all provide enough usable material for attackers. ### How common is deepfake fraud against businesses? According to the World Economic Forum, deepfake fraud attempts increased 500% in 2024. The technology is becoming cheaper and more accessible, making businesses of all sizes potential targets, including well-funded companies with professional finance teams. ### What is the best way for businesses to verify identity and prevent voice cloning fraud? Shared secrets are currently one of the most reliable defenses: private information only the real person would know, not publicly available, and rotated frequently enough to be useless if stolen. Callback procedures through independently verified numbers add another layer, though a successful callback alone does not confirm the original caller was legitimate. ### Why do employees fall for deepfake voice scams even with security processes in place? Humans are wired to trust familiar voices. When a call sounds like a known executive and arrives with supporting documents, questioning it feels unnatural. Attackers research company structures and personnel in advance to make fraudulent requests feel completely routine. ## More from Trust Onion Give your finance and operations teams a simple two-factor check for high-stakes requests. Before any wire, vendor change, or executive instruction gets actioned, staff ask: "What are the words?" The three codewords rotate every 60 seconds and are known only by authorized people. Trust Onion is free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger.