Blog

The CFO on the video call wasn't real: lessons from the $25 million deepfake case

26 October 2026 · 2 min read

In early 2024 Hong Kong police described a case that sounded like science fiction. A finance employee of a multinational firm received a message about a confidential transaction. He was suspicious. Then he joined a video call with what looked and sounded like the company's chief financial officer and several colleagues, and his doubts went away. Over 15 transfers he sent about HK$200 million (roughly US$25 million).

None of the people on the call were real. They were deepfake recreations built from public video and audio.

In May 2024 the British engineering group Arup confirmed to CNN that it was the company involved, that it had reported the matter to Hong Kong police in January, and that fake voices and images had been used.

Why it worked

• It started with doubt, not trust. The employee questioned the first message. The scammers answered that doubt with "proof": a face-to-face call.
• Authority plus secrecy. A senior executive, a confidential deal, and a request to act quickly.
• No second check outside the conversation. Every confirmation came through channels the criminals controlled.

This is not only a big-company problem

Small organizations have it easier in one way: everyone knows everyone. But they usually have fewer approval steps, and the person who can send money is often the same person who receives the request. The FBI's 2024 warning on generative AI describes exactly this: criminals using AI video to pose as executives and authority figures in live calls.

Controls that stop it, at any size

1. Two people for every new payee or bank-detail change. One person requests, a different person approves.
2. Call back on a known number. Not the number in the email, not a link in the meeting invite. The number already in your phone or your files.
3. A no-exceptions rule for secrecy. "Confidential, don't tell anyone" is a reason to involve a second person, never a reason to skip one.
4. A pause for large or unusual amounts. A 24-hour hold on first payments to new accounts costs little and stops a lot.
5. Practice. Staff who have seen a convincing fake once are far more likely to stop next time.

How KnoxDefender helps

The first step in cases like this is usually an email. KnoxDefender looks for the signs: a lookalike domain, a display name that matches a leader but an outside address, a reply-to that goes elsewhere, words about payment changes and urgency. It holds or flags those messages and explains why. The training library includes "AI-generated impersonation and deepfake requests" and "Invoice and bank-detail changes". And the two-person rule? That one is yours to write down today.

Sources

• CNN: Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee (16 May 2024)
• FBI IC3 PSA I-120324-PSA: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (3 December 2024)

← All stories · Questions? Contact us.