Scammers use deepfake CFO in a video call to steal $25M

If your company's CFO pings you for a secret wire transfer, you would probably hesitate. But what if you hop on a group video call and see that same CFO on screen, surrounded by other familiar colleagues who all tell you to authorize the payment?

You would likely wire the cash. That is exactly what happened to an employee at a multinational firm's Hong Kong branch, and it ended with the company losing 200 million Hong Kong dollars, roughly 25.6 million US dollars.

According to a report from the South China Morning Post, the heist marks the first case of its kind in Hong Kong involving such a massive sum and deepfakes orchestrating an entire multi-person conference call. Hong Kong police confirmed the details, though they have not publicly named the targeted corporation or made any arrests so far.

An office call where everyone was a ghost

The scheme started like an everyday corporate spear-phishing attack.

A staff member in the finance department received a message purportedly from the company’s UK-based chief financial officer, requesting assistance with an urgent and confidential transaction. The employee felt suspicious at first, treating it with reasonable skepticism.

To clear those doubts, the scammers invited the employee to a video conference call. That was where the trap sprang.

Every single participant on that call, except for the victim, was an AI-generated digital fake. Scammers had harvested publicly accessible audio and video clips of the CFO and other co-workers, training models to mimic their faces, mannerisms, and voices with high fidelity.

Seeing and hearing their real colleagues on live video killed any lingering doubts. Following instructions given during the call, the employee completed 15 separate wire transactions totaling HK$200 million across five local bank accounts in Hong Kong. The fraud went completely unnoticed for about a full week until officials finally connected the dots and contacted the police.

Why it matters

Seeing is no longer believing. For years, the gold standard of enterprise security training was simple: when an unusual email asks for money, hop on a video call to verify the person's identity. This heist proves that playbook is officially dead.

What makes this attack especially chilling is the choreography. Scammers did not just spoof a single voice message or doctor a photo; they staged a real-time, multi-actor corporate meeting. Any executive who speaks at public industry conferences, podcasts, or earnings calls has effectively handed cybercriminals all the training data needed to replicate them.

In our view, enterprise finance teams need to immediately rip up their verification protocols. Visual and auditory checks are now zero-trust liabilities. Moving large sums must require offline out-of-band authentications, physical security keys, and multi-signature authorization that cannot be influenced by any screen or voice.