The scammer created a fake video conference in which simulated images of company employees appeared, who gave instructions to the employee to transfer funds
For the first time in the history of Hong Kong, a robbery using deepfake and artificial intelligence technology took place. A fraudster, using fake videos, stole $25,000,000 from a Hong Kong company. Details of the event, which occurred in early February, were revealed by the South China Morning Post on February 4.
The scam involved creating a fake video conference where digital copies of the company's CFO along with other employees instructed the employee to transfer funds. The operation was so convincing that a company employee believed in the reality of what was happening and made 15 transfers totaling 200 million Hong Kong dollars.
No one has been arrested in this case yet; Hong Kong police are actively investigating the incident. Details about the affected company remain secret for now.
Deepfake — is a tool that uses artificial intelligence to create convincing fake videos. In this case, the fraudster successfully reproduced the voices and appearance of real employees using video and audio recordings from open sources.
This incident was the first of its kind in Hong Kong involving a large amount of money and the use of deepfake video conference technology, where all participants (except the victim) were fabricated images of real people.
Hong Kong police have offered some tips to help organizations and individuals protect themselves from such attacks. It is recommended to use methods to authenticate participants in video conferences, such as answering personal questions or moving your head. The second option — provide each employee with an encrypted key pair, and sign public keys in personal meetings. Later, during remote communication, these signed keys can be used to authenticate conference participants.
In addition, Hong Kong police plans to improve the alert system covering the Fast Payment System (FPS) to include alerts for transactions associated with known scams, and by the second half of the year, expand coverage to include a wider range of electronic and personal transactions.