In a significant financial setback, a Hong Kong-based multinational company fell victim to a sophisticated deepfake scam, resulting in a loss of HK$200 million (US$25.6 million), as reported by the South China Morning Post. The scam involved the use of deepfake technology to simulate a multi-person video conference, with digitally recreated versions of the company’s chief financial officer and other employees instructing an unwitting staff member to transfer funds.

This incident, the first of its kind in Hong Kong, has raised concerns about the growing threat of AI-driven scams. The perpetrators managed to convincingly replicate the appearances and voices of targeted individuals using publicly available video and audio footage. The identity of the affected company remains undisclosed, with Hong Kong police currently conducting an investigation into the matter.

The scam unfolded when an employee in the company’s finance department received a phishing message, purportedly from the UK-based chief financial officer, instructing them to execute a secret transaction. Despite initial doubts, the employee succumbed to the scam after participating in a group video call where the CFO and other fabricated individuals were present. The fraudulent transfers totaling HK$200 million went unnoticed for about a week until the company discovered the deception, prompting law enforcement involvement.

Acting senior superintendent Baron Chan Shun-ching highlighted the novelty of this scam, particularly in its use of a multi-person video conference setting for deception. The scammers strategically refrained from direct interaction with the victim beyond a self-introduction, adding an extra layer of credibility to their scheme.

To address the growing threat of AI-driven scams, the Hong Kong police have recommended practical measures for verifying the authenticity of individuals in video calls. These include requesting movements or identity-confirming questions, especially when financial transactions are involved.

In response to the incident, the police are planning to enhance their alert system for the Faster Payment System (FPS), aiming to provide warnings for transactions linked to known scams. This initiative is set to broaden its coverage to include a wider range of electronic and in-person transactions by the second half of the year.

As the global landscape faces evolving tactics of cybercriminals, this deepfake scam serves as a stark reminder of the importance of implementing robust security measures and increasing public awareness to counteract the risks associated with AI-driven fraud.