Hong Kong finance worker falls prey to deepfake video call, loses $25 million after interaction with ‘CFO’

A Hong Kong-based finance employee has been duped of $25 million after after falling prey to a deepfake scam. The worker – affiliated with a multinational company – was persuaded to part with his funds after a video call from his ‘Chief Financial Officer and other employees. Hong Kong police have reportedly made six arrests in connection with a slew of deepfake scams that have surfaced in recent months.

The worker had been suspicious about an email requesting a secret transaction, but the scammers looked and sounded so convincing on the call that he sent the money.

How can someone spot a deepfake video call?

Use visual cues to verify who you’re talking to. Deepfakes still can’t do complex movements in real time, so if in doubt, ask your video conference counterpart to write a word or phrase on a piece of paper and show it on camera. You could ask them to pick up a nearby book or perform a unique gesture, like touching their ear or waving a hand, all of which can be difficult for deepfakes to replicate convincingly in real-time.

Watch the mouth. Look out for discrepancies in lip syncing or weird facial expressions that go beyond a typical connection glitch.

Employ multi-factor authentication. For sensitive meetings, consider involving a secondary conversation via email, SMS or an authenticator app, to make sure the participants are who they claim to be.

Use other secure channels. For critical meetings that will involve sensitive information or financial transactions, you and the other meeting participants could verify your identities through an encrypted messaging app like Signal or confirm decisions such as financial transactions through those same channels.

Update your software. Make sure that you’re using the latest version of your video conferencing software in case it incorporates security features to detect deepfakes. (Zoom Video Communications did not reply to questions about whether it plans to make such detection technology available to its users.)

Avoid unknown video conferencing platforms. Especially for sensitive meetings, use well-known platforms like Zoom or Google Meet that have relatively strong security measures in place.

Look out for suspicious behavior and activity. Some strategies stand the test of time. Be wary of urgent requests for money, last-minute meetings that involve big decisions, or for changes in tone, language or a person’s style of speaking. Scammers often use pressure tactics so beware of any attempts to rush a decision too.