A global corporation incurred losses of HK\(200 million (US\)25.6 million) due to a fraudulent scheme involving deepfake technology, where individuals at its Hong Kong division were deceived. One notable incident included a digitally manipulated video of the company’s chief financial officer authorizing fund transfers during a video conference call, as reported by the police.
The participants in the video calls, except for the victim, were all fictitious representations created using deepfake technology. By manipulating publicly available video and other content, the scammers effectively replicated the appearance of the meeting’s attendees.
This case, deemed the first of its kind in Hong Kong due to its scale and complexity, was brought to light by the authorities. However, specific details regarding the company and the employees implicated were not disclosed.
Acting senior superintendent Baron Chan Shun-ching emphasized the novelty of this situation compared to previous scams, where victims were typically deceived in one-on-one video calls. In this instance, the scammers orchestrated a multi-person video conference where every participant was a fabricated persona. The authenticity of these representations, both visually and audibly, contributed to the success of the fraudulent scheme.
The incident was triggered when an employee in the finance department received a phishing message in mid-January, purportedly from the company’s CFO based in the UK, instructing them to execute a confidential transaction. Despite initial skepticism, the employee was swayed after participating in the group video conference, where the CFO and other seemingly genuine individuals were present.
Following the scammers’ directives during the meeting, the employee unwittingly transferred HK$200 million to five Hong Kong bank accounts. It took about a week for the employee to realize the deception after contacting the company headquarters.
Investigations revealed that the scammers utilized deepfake technology to fabricate the meeting participants, leveraging publicly available video and audio clips to mimic their targets convincingly. By imitating the victims’ voices and providing scripted instructions, the scammers effectively misled the employee.
The perpetrators maintained communication with the victim through various channels, including instant messaging platforms, emails, and one-on-one video calls. Additional employees at the branch were also targeted using similar tactics, although specific details of these encounters were not fully disclosed.
Authorities are actively investigating the matter, with a focus on raising public awareness about the evolving use of deepfake technology by scammers. Senior Inspector Tyler Chan Chi-wing advised vigilance in verifying the authenticity of individuals appearing on screens, suggesting methods such as requesting movement or posing questions to confirm identities and promptly raising concerns if monetary transactions are requested.
In a bid to enhance fraud prevention measures, the police announced plans to expand their alert system for the Faster Payment System (FPS) to caution users about transferring funds to accounts associated with scams. This initiative will encompass a wide range of banking services and is set to be implemented across various platforms by the second half of the year, including mobile applications, ATMs, and bank branches. Users who input scam-related account details into the police’s Scameter search engine database will receive alerts to prevent potential financial losses.
