Deepfake CFO tricks Hong Kong biz out of $25 million
- Reference: 1707114613
- News link: https://www.theregister.co.uk/2024/02/05/hong_kong_deepfaked_cfo/
- Source link:
The Hong Konger joined a vidchat in which his CFO appeared – but appeared a little off. So much so that the employee was initially suspicious. But his nerves were soothed as other colleagues he recognized appeared to join in on the call, the Hong Kong police [1]reportedly explained.
The fake CFO made increasingly urgent entreaties to execute money transfers, and the victim complied with instructions given during the call – eventually making 15 transfers into five local bank accounts.
[2]
The AI-generated videos were reportedly created from past genuine online conferences. To add depth and credibility to the scam, the perpetrators utilized WhatsApp, email and one-to-one video conferences with Hong Kong staff members.
[3]
[4]
"I believe the fraudster downloaded videos in advance and then used artificial intelligence to add fake voices to use in the video conference," reported the city’s police senior superintendent, Baron Chan Shun-ching.
What else exactly happened on the fateful call is disputed. Some reports suggest just one participant on the call was real, while others suggest multiple participants were human.
[5]
All agree that AI-generated humans appeared and that sadly, the unnamed finance professional was duped. That reality was only discovered by the victim after he contacted the (also unnamed) corporation's head office.
Local media outlet The Standard [6]declared the incident the first deepfake video conference scam in Hong Kong.
[7]India gives social media platforms 36 hours to remove deepfakes
[8]Rise of deepfake threats means biometric security measures won't be enough
[9]Dems and Repubs agree on something – a law to tackle unauthorized NSFW deepfakes
[10]'I'm sorry for everything...' Facebook's Zuck apologizes to families at Senate hearing
In a simpler, more innocent time – around a year and a half ago – Sophos researcher John Shier [11]told The Reg deepfakes weren't much of a threat.
According to Shier, scammers preferred simpler and cheap attacks, like old fashioned phishing.
Whether driven by the appeal of larger financial incentives, or influenced by the recent significant advancements in AI technology that facilitate their creation, it seems that the era of being unconcerned about deepfakes is fast disappearing.
[12]
While the deepfaked CFO scam may be the first reported in Hong Kong to use video conferencing, it's not the only scam using the technology. According to [13]CNN , Hong Kong police revealed in a Friday press briefing they had made six arrests in connection with other deepfake scams and that AI deepfakes had been used at least 20 times to trick facial recognition software.
The deepfake problem is also global. US senators last week [14]introduced a bipartisan bill that would allow victims portrayed in in non-consensual AI-generated pornographic deepfakes to sue the creators of the videos.
That move came after sexually explicit AI-generated images of Taylor Swift [15]proliferated across social media platforms – including on X/Twitter, where they racked up tens of millions of views before the Musk-owned site blocked searches for the pop icon.
India has had [16]similar problems when a way less graphic – but still personally and professionally violating – AI-generated video of Indian actor Rashmika Mandanna appeared online in November.
Indian IT minister Rajeev Chandrasekhar [17]reportedly warned in late January that social media platforms would be held accountable for deepfakes their users post. ®
Get our [18]Tech Resources
[1] https://news.rthk.hk/rthk/en/component/k2/1739119-20240204.htm
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZcC-2joFZTNmWSs9I6KdkgAAABM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZcC-2joFZTNmWSs9I6KdkgAAABM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZcC-2joFZTNmWSs9I6KdkgAAABM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZcC-2joFZTNmWSs9I6KdkgAAABM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.thestandard.com.hk/breaking-news/section/4/213122/HK's-first-deepfake-video-conference-scam-involving-HK$200-million
[7] https://www.theregister.com/2023/11/09/india_deepfake_takedown/
[8] https://www.theregister.com/2024/02/01/deepfake_threat_biometrics/
[9] https://www.theregister.com/2024/01/31/ai_defiance_act/
[10] https://www.theregister.com/2024/01/31/senate_social_media_zuckerberg/
[11] https://www.theregister.com/2022/10/17/phishing_beats_deepfakes/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZcC-2joFZTNmWSs9I6KdkgAAABM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://edition.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk/index.html
[14] https://www.theregister.com/2024/01/31/ai_defiance_act/
[15] https://www.theregister.com/2024/01/30/nudes_taylor_swift_action/
[16] https://www.theregister.com/2023/11/09/india_deepfake_takedown/
[17] https://www.ft.com/content/fc600196-f821-4397-92fc-364ed8d2608a
[18] https://whitepapers.theregister.com/
Re: Root cause
Exactly, there are a who host of other safeguards that seem to have failed here. I question how ‘professional’ this finance professional really was.
Re: Root cause
Banks require dual control on everything in the states.
A vault door has two combinations, known by 2 people and a time lock so it can only be opened during business hours.
Wire transfer requires an officer level second person to sign off and they have to input their code or usb dongle and pin to do the transfer.
This process is audited and approved by the board.
Something stinks from the board down.
Re: Root cause
I think you have too high expectations of safety mechanisms in financial institutions. Very often, the only thing that prevents an employee from transferring money to their own account is the fact that everything is logged and they would get caught.
Re: Root cause
Exactly - I think back to the case where Citibank accidentally wired $900M USD instead of about $8M USD back in 2020 to several lenders. They intended to make a $8M USD interest payment, but someone at Citi accidentally paid off the entire Revlon loan.
Oopsie.
That took a lawsuit that Citi lost (weird NY State law at play) but they won on appeals.
Re: Root cause
And those are what makes the news, the litany of other errors that they get to correct before serious impact almost never reaches public attention
Corporate Culture
One thing that will affect an organisation's resilience to this kind of fraud will be the corporate culture. If bullying by C-Suite types (or management in general) is common then this sort of thing is much less likely to be challenged
Re: Corporate Culture
Exactly! Every firm should have procedures that need to be followed to transfer any amount of money, especially to new bank accounts. However, if workers are used to having management bypass procedures at their own whim, then these sorts of failures will be extremely common.
Procedures are useless if those at the top also dont adhere to them... But that often doesnt fit with the C-suites belief that they are above the rules of the lowly plebs...
Re: Corporate Culture
When my guys call me out on something stupid I am doing, they get an appreciative thank you from me in stead of the cattle prod, window and carpet treatment.
Re: Corporate Culture
The cattle prod, window and carpet treatment is saved for when members of other departments start calling you out, right?
This is one where Nelson's "Ha ha!" seems extremely appropriate.
What's the betting that the standard process of recording this video conference was "forgotten"? So the hard evidence just happens to be unavailable.
Root cause
Why was this finance professional able to transfer $25m to what are presumably novel accounts?