In a deepfake CFO scam, a criminal impersonates a senior executive, increasingly with an AI-generated voice or video, and rushes an employee into an urgent, confidential payment to a new account. One rule stops it: verify on a channel you already trust, a number or a person you had before the request arrived, before any money moves.
How the deepfake CFO scam works, step by step
The first contact is usually plain. In the case the Hong Kong government described to its legislature, a fraudster posing as the finance chief of a UK head office emailed a staff member at the local office about confidential transactions and invited that employee to a group video conference (HKSAR Government, June 26, 2024). The email does not need to be clever. It only needs to make a meeting look like work.
The meeting is where the impersonation happens. The FBI’s Internet Crime Complaint Center warned that criminals use generative AI to produce video for “real time video chats with alleged company executives, law enforcement, or other authority figures” (IC3, December 3, 2024). The bureau’s 2025 Internet Crime Report describes the same technique in text and audio: chat tools can “create official-sounding emails mimicking a company’s CEO or other officials,” and “Voice cloning can also be used to request wire payment” (FBI IC3, 2025 Internet Crime Report). The Hong Kong account goes one step further. Because the video conference there was pre-recorded, “there was actually no interaction” between the employee and the fraudster, according to the government’s reply, so a convincing call is not necessarily a two-way call.
Then come secrecy and a deadline. The Hong Kong pretext was confidential transactions, and that is the part doing the real work: it tells the employee not to ask the person at the next desk. A request that bars you from checking with anyone is the request that most needs checking, and no legitimate payment requires you to keep your own finance team out of it.
The money goes somewhere new. In the Hong Kong case the employee authorized transfers of about HK$200 million into five local bank accounts (HKSAR Government, June 26, 2024). A new payee, or a new account for a payee you have paid for years, is the most useful trigger for a second set of eyes, because a criminal who cannot change where the money lands has nothing to collect.
The transfers also rarely stop at one. That employee moved money into five separate accounts, which means several payments cleared between the fake meeting and the first real check. Treat any follow-up instruction from the same thread, call or chat as part of the same incident rather than a fresh request to be judged on its own merits.
The Hong Kong deepfake video call case
In January 2024, a staff member at the Hong Kong office of a multinational company received an email from someone posing as the finance chief of the group’s UK head office, joined a group video conference about confidential transactions, and authorized transfers of about HK$200 million into five local bank accounts. The government’s written reply to the Legislative Council on June 26, 2024 states that the meeting was pre-recorded, so “there was actually no interaction” between the employee and the fraudster, and that the case was still under police investigation at that point (HKSAR Government, June 26, 2024).
The engineering firm Arup confirmed to CNN that it was the company involved and that “fake voices and images were used,” adding that “Our financial stability and business operations were not affected” (CNN, May 16, 2024).
The sum is what made the case famous, but the mechanism is what transfers to a ten-person company: an email that looks like it comes from above, a meeting that supplies a familiar face and voice, a confidentiality rule that keeps colleagues out of it, and payments to accounts nobody has used before. None of those four steps requires a victim with offices in Hong Kong.
Business email compromise losses in 2025
The FBI files executive-impersonation payment fraud under business email compromise, which its 2024 report defines around “businesses regularly performing wire transfer payments” (FBI IC3, 2024 Internet Crime Report). In 2025, business email compromise reported to IC3 accounted for $3,046,598,558 in losses, second only to investment fraud at $8,648,617,756 (FBI IC3, 2025 Internet Crime Report).
The AI share of that total is still small. The same report counts “losses over $30 million to BEC scams involving AI” in 2025 and says plainly that “There are multiple BEC tactics, and not all are AI-enabled” (FBI IC3, 2025 Internet Crime Report). For a small finance team that is good news about where to spend effort: the control that catches a cloned voice is the same control that catches an ordinary spoofed email, because both end at a new account number.
Warning signs on a video call
IC3’s alert is the reason to stop treating a face as identification. If criminals can generate video for live chats with “alleged company executives” (IC3, December 3, 2024), then recognizing the person on screen is not evidence of who is on the other end.
FinCEN wrote its own list for banks running live identity checks, and two of the signals FinCEN flagged for banks translate well to a meeting your staff is asked to trust. One is when “A customer uses a third-party webcam plugin during a live verification check.” The other is an attempt to change communication methods during that check because of supposed technological glitches. FinCEN also cautions that no single red flag is “necessarily indicative of illicit or suspicious activity” (FinCEN, November 13, 2024), so read them as reasons to verify, not as proof.
The signs you can use at a desk are duller and more reliable: an account number you have never paid, an instruction to keep the payment confidential, a deadline that falls before anyone senior is reachable, and a caller who resists being called back on a number you already have.
| Request red flag | What to do |
|---|---|
| New bank details for a payee you have paid before | Call the payee on the number already in your records, never one supplied in the request |
| You are told to keep the payment confidential | Pause and tell your manager or the owner; confidentiality is not an approval |
| The deadline is today, before anyone senior is free | Move the payment behind your call-back; a real executive can wait for a verified number |
| The caller declines a call-back or wants to switch apps | End the meeting and dial the number you already have |
| Approval arrives only by chat app or from a new number | Confirm in your normal internal channel before anything moves |
Controls a small business can set up this week
Start with a written call-back rule: before any payment to a new payee or a changed account, someone calls the requester on a number the company already held, and the payment waits until that call connects. The rule has to name the source of the number, because the number in the email is the attacker’s number.
Add a second approver for exactly two events: a new payee, and a change to an existing payee’s bank details. Everything else can keep its current approval path. Two people on those two events is what makes a single fooled employee insufficient, which is the whole point of the pretext.
Make bank-detail changes go through one short form, not through whatever message arrived. Ask for the vendor contact, the old and new details, who called back, the number they used and the date. A form turns verification into a step someone can see you skipped.
Write a pause rule for confidential requests: any instruction that tells an employee not to involve a colleague gets escalated to the owner or the finance lead before it is executed, with no penalty for being wrong. Say out loud, once, that nobody at your company will ever be disciplined for delaying a payment to verify it. That sentence is the control.
Finally, run a fifteen-minute drill. Describe the Hong Kong pattern to whoever can move money, ask each person what they would say to end such a call, and let them practice the sentence: “I’ll confirm this on the number we have on file and call you back.” Then check that each of them actually has that number, somewhere other than their inbox.
What to do if the money already left
IC3’s instruction is short. “If you discover a fraudulent transfer, time is of the essence,” and immediately “contact your financial institution and request a recall of the funds.” File next: “Regardless of the amount lost, file a complaint at www.ic3.gov,” and “Be sure to include the full transaction details in your report” (FBI IC3, 2025 Internet Crime Report).
That sequence exists because of the Financial Fraud Kill Chain, the process the FBI uses to ask banks to freeze funds before they move on. In 2025 it ran on 3,900 incidents covering $1,163,919,846 in attempted theft and froze $679,013,183, a 58% success rate. Domestic cases made up 3,574 of those incidents with $507,042,623 frozen, and 326 international incidents accounted for $171,970,560 frozen (FBI IC3, 2025 Internet Crime Report). Those figures cover the incidents that reached the process, which is why the first hours after a wire matter more than a tidy report written a week later.
Report the attempt to the FTC as well, at ReportFraud.ftc.gov. Do it even if nothing left the account, so the pattern is on the record.
How we checked this
Facts checked on October 20, 2026. The figures and quotations above come from primary documents: the FBI Internet Crime Complaint Center’s 2025 and 2024 annual reports and its public alert on criminal use of generative AI, a FinCEN alert written for financial institutions, and the Hong Kong government’s own written reply on the January 2024 case. The company’s confirmation in that case is attributed to CNN, which reported it.
