In early 2024, threat actors used real-time AI deepfakes to impersonate an entire corporate executive board during a live video call. Here is how they did it, and how to protect your organization.
Total Fraudulent Transfers
Transfers Executed During a Single Call
External AI Synthesis
In-depth analysis of the Hong Kong AI deepfake wire fraud by 5D Cyber
"This wasn't a simple phishing email. The attackers cloned the CFO's voice, synthesized live video of every executive, and conducted an entirely synthetic board meeting, in real time."
In February 2024, a multinational finance employee received what appeared to be a routine video conference invitation from their CFO. The employee joined and saw familiar faces: the CFO, CEO, and other senior executives, all interacting naturally. The CFO directed 15 separate wire transfers across five Hong Kong bank accounts. Only after the call did the employee realize every participant was an AI-generated deepfake. The attack unfolded in three distinct stages:
Attackers scraped public YouTube footage, keynote speeches, earnings calls, and media interviews of the company's executive team. Using this high-fidelity training data, they built generative AI models capable of synthesizing convincing voice and video clones of each target. Every public appearance, once a mark of leadership transparency, became raw material for the attack.
During the scheduled video call, the attackers injected live deepfake avatars into the conference software, synchronizing facial expressions, lip movements, and voice patterns for multiple participants simultaneously. The realism was sufficient to fool a trained finance professional who had interacted with the real executives for years.
Traditional visual and audio recognition, long treated as implicit identity confirmation, proved worthless. The attackers didn't need to steal passwords or bypass MFA tokens; they simply impersonated the individuals authorized to approve transfers. The fundamental assumption that "seeing is believing" was the vulnerability.
The Hong Kong heist exposed a fundamental flaw in how enterprises validate identity during high-value transactions.
The Old Reality
"If I see and hear my CFO on video, the request is authentic."
The New Reality
"Visuals and voice can be synthesized live for under $100. Out-of-band cryptographic verification is mandatory."
Key Insight: The attackers didn't exploit a software vulnerability; they exploited human trust in audiovisual identity. The defense must be procedural, not perceptual.
These are not theoretical recommendations; they are immediate, actionable controls every mid-market organization should implement now.
Mandate secondary telephone or secure messaging confirmation for all high-value financial actions. The verification channel must be independent of the original request channel; a video call cannot be verified by another video call. Use pre-established phone numbers or encrypted messaging apps with known device fingerprints.
Implementation: Add a mandatory OOB verification step to your wire transfer policy for any transaction exceeding $50K.
Enforce multi-signatory cryptographic authorization for transactions over designated financial thresholds. No single individual, regardless of title, should be able to approve and execute a high-value transfer. Require at least two authorized signatories using hardware security keys or certificate-based authentication.
Implementation: Configure treasury systems to require dual approval above a defined threshold.
Audit and reduce public-facing high-definition voice and video assets of your executive team. Every keynote speech, podcast interview, and LinkedIn video provides training data for cloning models. Implement watermarking, limit resolution of publicly posted media, and maintain an inventory of exposed assets.
Implementation: Conduct a quarterly audit of all publicly accessible executive media.
Train finance and executive teams to recognize real-time video artifacting, unnatural latency, and behavioral anomalies during high-stakes calls. Specialized training focused on deepfake detection: pupil irregularities, facial boundary blurring, inconsistent lighting, and audio-visual synchronization errors.
Implementation: Schedule biannual deepfake awareness workshops for finance and executive teams.
Don't wait for an incident to expose your compliance and security gaps. Schedule a comprehensive Risk Assessment with 5D Cyber to audit your identity verification and financial workflow security.