In early 2024, threat actors used real-time AI deepfakes to impersonate an entire corporate executive board during a live video call. Here is how they did it, and how to protect your organization.
Total Fraudulent Transfers
Transfers Executed During a Single Call
100% External AI Synthesis
In-depth analysis of the Hong Kong AI deepfake wire fraud by 5D Cyber
"This wasn't a simple phishing email. The attackers cloned the CFO's voice, synthesized live video of every executive, and conducted an entirely synthetic board meeting, in real time."
In February 2024, a multinational finance employee received what appeared to be a routine video conference invitation from their CFO. The employee joined and saw familiar faces: the CFO, CEO, and other senior executives, all interacting naturally. The CFO directed 15 separate wire transfers across five Hong Kong bank accounts. Only after the call did the employee realize every participant was an AI-generated deepfake. The attack unfolded in three distinct stages:
Attackers scraped public YouTube footage, keynote speeches, earnings calls, and media interviews of the company's executive team. Using this high-fidelity training data, they built generative AI models capable of synthesizing convincing voice and video clones of each target. Every public appearance, once a mark of leadership transparency, became raw material for the attack.
During the scheduled video call, the attackers injected live deepfake avatars into the conference software, synchronizing facial expressions, lip movements, and voice patterns for multiple participants simultaneously. The realism was sufficient to fool a trained finance professional who had interacted with the real executives for years.
Traditional visual and audio recognition, long treated as implicit identity confirmation, proved worthless. The attackers didn't need to steal passwords or bypass MFA tokens; they simply impersonated the individuals authorized to approve transfers. The fundamental assumption that "seeing is believing" was the vulnerability.
The Hong Kong heist exposed a fundamental flaw in how enterprises validate identity during high-value transactions.
"If I see and hear my CFO on video, the request is authentic."
"Visuals and voice can be synthesized live for under $100. Out-of-band cryptographic verification is mandatory."
Key Insight: The attackers didn't exploit a software vulnerability; they exploited human trust in audiovisual identity. The defense must be procedural, not perceptual.
These are not theoretical recommendations; they are immediate, actionable controls every mid-market organization should implement now.
Mandate secondary telephone or secure messaging confirmation for all high-value financial actions. The verification channel must be independent of the original request channel; a video call cannot be verified by another video call. Use pre-established phone numbers or encrypted messaging apps with known device fingerprints.
Implementation: Add a mandatory OOB verification step to your wire transfer policy for any transaction exceeding $50K. Document the verification in your compliance log.
Enforce multi-signatory cryptographic authorization for transactions over designated financial thresholds. No single individual, regardless of title, should be able to approve and execute a high-value transfer. Require at least two authorized signatories using hardware security keys or certificate-based authentication.
Implementation: Configure your treasury management system to require dual approval for any transfer above a defined threshold. Hardware token + biometric confirmation is the gold standard.
Audit and reduce public-facing high-definition voice and video assets of your executive team. Every keynote speech, podcast interview, and LinkedIn video provides training data for cloning models. While you cannot eliminate your executive presence, you can implement watermarking, limit resolution of publicly posted media, and maintain an inventory of exposed assets.
Implementation: Conduct a quarterly audit of all publicly accessible executive media. Consider digital watermarking for official video content and establish guidelines for resolution and length of public appearances.
Train finance and executive teams to recognize real-time video artifacting, unnatural latency, and behavioral anomalies during high-stakes calls. This isn't generic security awareness; it's specialized training focused on deepfake detection: watching for pupil irregularities, facial boundary blurring, inconsistent lighting, and audio-visual synchronization errors.
Implementation: Schedule biannual deepfake awareness workshops for your finance and executive teams. Include live demonstrations of current deepfake quality to calibrate threat perception.
Don't wait for an incident to expose your compliance and security gaps. Schedule a comprehensive Risk Assessment with 5D Cyber to audit your identity verification and financial workflow security.
More from 5D Cyber Insights
View All Threat Intelligence Articles