In January 2024, an employee at the Hong Kong office of a multinational company received what looked like a phishing email from the firm’s UK-based chief financial officer, asking for a confidential transaction. Suspicious at first, the employee was reassured when invited to a video conference where the CFO and several other colleagues appeared on screen. According to a written reply from Hong Kong’s Secretary for Security to the Legislative Council on June 26, 2024, the employee then authorized transfers to five local bank accounts, with losses of about HK$200 million - roughly US$25 million.
Every other person on that video call was fake. Police investigation found the fraudsters had assembled the conference from downloaded public video clips and voices of the real executives, altered with deepfake technology, and played the synthetic footage during the call to impersonate the staff he expected to see. The employee was the only real participant. The victim firm was later reported to be the engineering company Arup, which confirmed that fake voices and images had been used.
The Hong Kong government’s reply noted this was one of only three AI deepfake fraud cases reported in the city as of May 31, 2024 - including a second, smaller video-conference scam in May 2024 - but the scale of the loss made it the most cited real-world example of generative AI used for high-value corporate fraud.
Why business readers should care: this case broke a long-standing assumption that a live video call confirms identity. Generative video and voice cleared that bar. The practical defense is procedural, not perceptual - out-of-band verification and payment controls that do not depend on recognizing a face or voice on a screen.