--- title: "Capillary Tech Loses €3 Million in Deepfake Banking Fraud" published: 2026-08-26T19:47:30.014Z updated: 2026-10-11T06:13:11.174Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/capillary-tech-loses-3-million-in-deepfake-banking-fraud --- # Capillary Tech Loses €3 Million in Deepfake Banking Fraud **Cite as:** Capillary Tech Loses €3 Million in Deepfake Banking Fraud, Trust Onion, 2026-10-11. https://trustonion.io/case-studies/capillary-tech-loses-3-million-in-deepfake-banking-fraud Capillary Technologies, a Bengaluru-based SaaS company, lost approximately €3 million (₹32.7 crore) after fraudsters used deepfake voice cloning, forged signatures, and social engineering to impersonate key managerial personnel at a recently acquired overseas subsidiary. Of that amount, €0.45 million has been recovered; the company continues working with law enforcement and banks to pursue the remaining €2.55 million. ## Incident facts - **Incident date:** July 2026 - **Location:** Bengaluru, India - **Victim type:** organization - **Attack type:** voice_cloning - **Outcome:** resolved - **Financial impact:** €3 million (₹32.7 crore) ## Timeline - **Event:** Capillary Technologies had recently completed the acquisition of an overseas step-down subsidiary, leaving staff there still learning to recognize unfamiliar leadership voices and authority figures. That familiarity gap gave the attackers their opening. - **Event:** Attackers combined deepfake voice cloning, forged signatures, and social engineering to impersonate key managerial personnel and instruct staff at the overseas subsidiary to transfer funds to unauthorized third-party bank accounts. - **Event:** Approximately €3 million (₹32.7 crore) moved out of the overseas subsidiary's accounts to unauthorized third parties before the fraud was detected. - **Event:** Capillary Technologies detected the fraud and disclosed it publicly, then engaged law enforcement, cybercrime authorities, and banking institutions to investigate and begin recovery efforts. - **Event:** Capillary Technologies recovered €0.45 million of the stolen funds and continues working with cybercrime authorities and banks to freeze additional accounts and pursue the remaining approximately €2.55 million. ## How the attack worked Fraudsters targeted a recently acquired overseas step-down subsidiary of Capillary Technologies at the worst possible moment: post-acquisition integration, when employees are still learning what new leadership sounds like and how it communicates. AI-generated voice cloning let them impersonate key managerial personnel convincingly over the phone. Forged signatures added a documentary layer that made the instructions look legitimate on paper. Social engineering stitched it together, making the scenario feel routine rather than alarming. Because each element reinforced the others, no single verification failure caused the breach. Staff at the overseas unit received what appeared to be authorized instructions from executives they recognized by voice and by name, directing them to transfer funds to what turned out to be unauthorized third-party accounts. A cloned voice alone might have raised doubt; paired with forged documents and a plausible narrative, it did not. ## Damage assessment The direct loss totaled approximately €3 million, equivalent to roughly ₹32.7 crore, taken from accounts held by Capillary Technologies' overseas subsidiary. Of that amount, €0.45 million has been recovered through coordination with banks and law enforcement, leaving an outstanding loss of approximately €2.55 million at the time of disclosure. The incident forced Capillary Technologies to engage law enforcement agencies, cybercrime authorities, and multiple banking institutions across jurisdictions at once, consuming management attention and legal resources. The public disclosure places the incident in the permanent record, and the company will have to answer questions about internal controls and verification protocols at acquired entities. ## How verification helps When a caller claims to be a company executive and instructs staff to move funds, one question stops the attack: "What are the words?" A real executive knows the current three codewords. A fraudster with a cloned voice does not, and has no way to find out. No forged document and no amount of social engineering can produce the correct answer. Note that calling back on a number provided by the requester is not a safe substitute, because attackers can control those numbers; always use a contact sourced independently from a known directory or official record. In a post-acquisition environment like the one Capillary Technologies was navigating, codeword verification matters most precisely because voice recognition is least reliable. Trust Onion's three rotating codewords are calculated locally on each authorized device, rotate every 60 seconds, and have no server to hack. For teams that also need to verify identity visually, a Proofie™ is a selfie signed by your passkey at the moment you take it; use the Trust Onion app to verify the signature and compare the full signing key against the person's public key in your shared group. Building the codeword challenge into the fund transfer approval process costs nothing and takes seconds. ## Key lessons - Newly acquired subsidiaries are high-value targets during integration periods, when employees are still learning to recognize unfamiliar leadership voices and are less likely to question instructions from executives they have not yet worked with directly. - AI voice cloning combined with forged documents and social engineering creates a layered deception that cannot be defeated by any single check, only by a pre-established challenge that a cloned voice cannot satisfy. - Any process that authorizes fund transfers over the phone needs a challenge-based identity step: Trust Onion's three rotating codewords, shared only among authorized team members, stop the attack before a single euro moves. ## Key takeaways - Capillary Technologies lost €3 million (₹32.7 crore) after attackers combined AI voice cloning, forged signatures, and social engineering to impersonate executives at a recently acquired overseas subsidiary. - Only €0.45 million of the stolen funds has been recovered despite coordination with law enforcement, cybercrime authorities, and banks across jurisdictions. - A codeword verification step applied before any fund transfer authorization would have exposed the cloned voice on the first call; staff simply ask "What are the words?" and a fraudster cannot answer. ## Frequently asked questions ### What happened in the Capillary Technologies deepfake fraud incident? Fraudsters used AI-generated voice cloning, forged signatures, and social engineering to impersonate key managerial personnel at a recently acquired overseas subsidiary of Capillary Technologies, deceiving staff into authorizing fund transfers totaling approximately €3 million to unauthorized third-party bank accounts. ### How much money did Capillary Technologies lose? Capillary Technologies lost approximately €3 million, equivalent to roughly ₹32.7 crore. As of disclosure, €0.45 million had been recovered, leaving an outstanding loss of approximately €2.55 million. ### How could this deepfake banking fraud have been prevented? A codeword verification protocol would have stopped it. Staff ask any caller authorizing a transfer, "What are the words?" A cloned voice cannot answer. Trust Onion's three codewords rotate every 60 seconds and are calculated locally with no server to hack. Calling back on a requester-supplied number is not a safe alternative; attackers can control those numbers. ### Why was the overseas subsidiary especially vulnerable? The subsidiary had been recently acquired, placing staff in an integration period where they were still learning to recognize the voices and communication styles of new leadership. Fraudsters exploited that familiarity gap, knowing employees would be less confident questioning instructions from executives they had not yet worked with directly. ### What methods did the attackers use beyond voice cloning? Attackers used forged signatures to add documentary legitimacy to their instructions, and applied social engineering to make the scenario feel routine and authorized. The combination of all three methods made the fraud harder to detect than any single method alone would have been. ### How does Trust Onion work for a business team? Trust Onion gives a team three private codewords that rotate every 60 seconds. Before approving a wire, changing vendor details, or acting on an executive instruction by phone, a staff member asks, "What are the words?" Only someone with an authorized device can answer. The words work offline and cannot be cloned or guessed. Trust Onion is free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger.