Hong Kong Deepfake CFO Video Conference Fraud (2024)

Incident Summary

In January 2024, an employee at the Hong Kong office of a multinational corporation was deceived into transferring approximately $25.6 million USD (HK$200 million) through an elaborate deepfake video conference scam.^[1]

The employee received what appeared to be a video call invitation from the company’s UK-based Chief Financial Officer. Upon joining the call, the employee observed multiple participants who appeared to be senior company executives, all of whom were AI-generated deepfakes.

During the video conference, the fraudsters instructed the employee to make a series of money transfers. The employee executed 15 separate transfers totaling HK$200 million to five local bank accounts before the fraud was discovered.^[2]

Key Facts

• Financial loss: $25.6 million USD (HK$200 million)
• Method: Multi-participant deepfake video conference
• Target: Finance department employee at multinational firm
• Detection: Employee contacted head office to verify after transfers completed
• Law enforcement: Hong Kong police investigation opened; six arrests made

Threat Patterns Involved

Primary: Deepfake Identity Hijacking — AI-generated video and audio used to impersonate multiple executives

Secondary: Adversarial Evasion — Deepfakes bypassed visual identity verification

Significance

This incident represents one of the largest confirmed financial losses from a deepfake-enabled attack. It demonstrates:

1. Multi-participant deepfakes — Attackers can generate convincing deepfakes of multiple individuals simultaneously
2. Real-time interaction — Deepfake technology has advanced to enable live video conferencing
3. Sophisticated social engineering — Attacks combine technical capability with understanding of corporate procedures
4. Verification gaps — Traditional visual confirmation is no longer sufficient for high-value transactions