An employee at a Hong Kong branch of a multinational firm was scammed into paying out 200 million HKD (more than $25 million) of company funds after a conference call in which every single participant — other than the worker — was a deepfake, the city’s public broadcaster reported.
Fraudsters, who are yet to be caught, used the company’s past meetings to create artificial intelligence-generated deepfakes of its chief financial officer (CFO) and several other employees to execute the elaborate scam, Radio Television Hong Kong reported on Sunday.
“In the past, we would assume these scams would only involve two people in one-on-one situations, but we can see from this case that fraudsters are able to use AI technology in online meetings,” Hong Kong police’s acting senior superintendent Baron Chan said.
“I believe the fraudster downloaded videos in advance and then used artificial intelligence to add fake voices to use in the video conference,” Chan was quoted as saying by RTHK.
Hong Kong police said the scam began last month, with the fraudster posing as the London-based firm’s chief financial officer and inviting the duped employee into a meeting with several of his co-workers.
On joining the meeting, the employee had a “moment of doubt” but fell for the scam because everyone on the call ‘looked and sounded real’, police said.
The scammers “used deepfake technology to imitate the voice of their targets reading from a script,” the South China Morning Post quoted Chan as saying. They “found publicly available video and audio of the impersonation targets via YouTube,” Chan said, according to CNN.
Following the meeting, the duped employee made 15 transactions amounting to HK$200 million within a week on the deepfake CFO’s instructions. The money was sent to five local bank accounts, auhtorities said.
The scammers also stayed in touch with the employee after the scam via WhatsApp, emails and one-on-one video calls, the SCMP said, adding that they also approached at least two other people at the branch using the same methods.
The employee — who was the only real person in that meeting — realised he had been scammed, during a call with the company’s head office later, police said.
Hong Kong newspaper The Standard said this was the first deepfake fraud involving such a large sum in the city.
A similar scam was reported in China last year, in which a tech worker was duped of $600,000 over a video call in which his “friend” asked for money to bid on a project.
Deepfake scams on the rise in Hong Kong
Deepfakes are realistic human faces — virtually undetectable to cybersecurity experts — generated using a technology called a generative adversarial network, or GAN.
Several AI tools and software, powered by the technology, have flooded the market, making it easy for anyone to create genuine-looking replicas of real people.
Deepfake videos available online are increasing 900% year-on-year, according to a recent KPMG report. “Deepfake-as-a-Service” opportunities have also imploded on the dark web, the report added.
Increasingly available AI tools have also made it possible to copy a person’s voice to make their deepfake uncannily believable.
In April last year, US-based Jennifer DeStefano reported receiving a telephone call with the voice of her 15-year-old daughter in a purported $1 million ransom call. DeStefano eventually discovered her daughter had not been kidnapped and testified about her ordeal in Congress in June.
Realistic deepfakes unfolded major controversy in the US again last month after explicit AI-generated images of pop star Taylor Swift flooded social media.
In Hong Kong, meanwhile, police say AI deepfakes were used at least 20 times for loan applications and bank account registrations between July and September last year.
Losses from technology-related crimes for the year were up 72% compared to 2022, amounting to 5.1 billion HKD ($652 million), they added.
- Vishakha Saxena