Finance worker pays out $25 million after video call with deepfake ‘chief financial officer’

A finance worker at a multinational firm was tricked into paying out $25 million to fraudsters using deepfake technology to pose as the company’s chief financial officer in a video conference call, according to Hong Kong police.

The elaborate scam saw the worker duped into attending a video call with what he thought were several other members of staff, but all of whom were in fact deepfake recreations, Hong Kong police said at a briefing on Friday.

“(In the) multi-person video conference, it turns out that everyone [he saw] was fake,” senior superintendent Baron Chan Shun-ching told the city’s public broadcaster RTHK.

Chan said the worker had grown suspicious after he received a message that was purportedly from the company’s UK-based chief financial officer. Initially, the worker suspected it was a phishing email, as it talked of the need for a secret transaction to be carried out.

However, the worker put aside his early doubts after the video call because other people in attendance had looked and sounded just like colleagues he recognized, Chan said.

At some point someone’s going to train an LLM on material from successful scams to autonomously generate new scams, then wire the money to server farms to run more copies of itself.

This story sounds suss, but I want it to be true because

The scam involving the fake CFO was only discovered when the employee later checked with the corporation’s head office.

A surprise teleconference resulting in the transfer of $25 million dollars? You can bet your ass I'm going to verify that transaction by calling the CFO on his direct line before any money is sent.

Ohhhh, that's why I have to take those monthly security training quizzes, lol. I haven't seen one on AI deepfakes though, I'm sure they're coming.

I'm surprised there was no further validation or approval for that kind of money beyond "find the right person and socially engineer them."

The worker mysteriously quit his job after a few days to go live on a tropical island. He was last heard as saying “Yeah the boss totally told me to transfer the money to this account, that AI is so lifelike”.

Perhaps it should be a company policy that any demand to pay by phone/text/video conf must be authenticated by the office worker hanging up and calling the appropriate company officer on a non-published phone number. The workers immediate supervisor should also be involved in anything out of the ordinary. With a well known policy that calling the company officer will never result in any trouble for the office worker.