Scammers Steal Over $25 Million By Using AI Deepfake Video Call To Convince Suspicious Employee That A Phishing Email Is Legitimate

Scammers stole over $25 million from a multinational business by utilizing cutting-edge real-time video deepfake technology to convince an employee in the firm’s accounts-payable department that the worker had properly validated a payment request previously sent to him via email.

According to police in Hong Kong, the worker (whose identity police did not reveal) had received a request by email to issue a $200 Million Hong Kong Dollar payment (equivalent to approximately $25.6 Million USD at the time of the theft and at present). The worker however, was aware of phishing scams, and was suspicious that the request from the firm’s CFO to issue the $25 Million payment was fraudulent.

As the CFO was based in the United Kingdom, and there was no way for the Hong Kong based employee to ask the CFO in person to validate the request, the employee asked for the video call to ensure that the payment request was legitimate.

In fact, it should be noted, many businesses around the world have instructed employees to do precisely what the aforementioned employee did – that is, request a video call for confirmation – if facing similar circumstances.

The criminals, however, were extremely sophisticated – and well prepared. They orchestrated a video conference call with the employee during which the employee saw, and heard, what he thought were multiple colleagues – but, what were in fact, AI-generated deepfakes. After seeing and hearing “people” whose faces and voices he recognized, and verifying with “them” that the payment request was legitimate, the employee was satisfied that all was kosher, and issued the payment as had been requested from him.

The fraudulent nature of the request, and the fact that the company (which police have still not named) had just lost over $25 Million, was discovered only after the employee later mentioned the payment to operations personnel at the company’s headquarters.

Senior Superintendent of police, Baron Chan Shun-ching, noted that while the employee thought that he was on a “multi-person video conference” in reality “it turns out that everyone was fake.”

As I have mentioned numerous times before, it is often difficult for us, human beings, to accept that we can no longer distinguish between people and impersonators; this is especially true when to comes to parents and children: no parent wants to believe that a scammer could successfully trick them into believing that the scammer is their child crying for help. The reality is, however, that artificial intelligence (AI) has reached the point that no person is immune to such forms of trickery. For those who still do not believe that they can be tricked by deepfakes – the time to wakeup is now.