The article describes how criminals are using AI-generated video (“deepfakes”) to impersonate executives and trusted colleagues on live video calls. A real 2024 case at engineering firm Arup shows how a finance employee was convinced by a deepfake CFO and colleagues to send about $25 million across multiple transfers. The piece also outlines repeatable scam patterns (CFO payment approval, fake auditor, fake HR onboarding) and emphasizes using separate-channel verification, not “trusting the face on screen.”
In this 2024 incident, an employee at an engineering firm's Hong Kong office received a request framed as a confidential transaction. To verify it, the employee asked for a video call, a reasonable instinct that backfired. On the call, the employee saw people who appeared to be the company's CFO and several colleagues. In reality, every person on that call was an AI-generated deepfake, built from publicly available footage of real executives. Believing the request was genuine, the employee authorized fifteen transfers totaling roughly $25 million before the fraud was discovered.
The scam succeeded because the employee, and the organization's norms, treated a live video call as sufficient proof of identity. Nobody had told the employee that a convincing face on screen is no longer reliable evidence of who is actually speaking. The request was also framed as urgent and confidential, which discouraged normal verification steps, and the payment pattern (multiple transfers, large total) was structured to move quickly before anyone paused to check.
Beyond this specific case, the same deepfake technique can appear in other guises:
These scenarios work precisely because those meetings are built around the assumption that a video call with a real person is inherently trustworthy.
Organizations can reduce exposure to this pattern with a few concrete practices:
These steps target the specific weakness this incident exposed: the assumption that seeing a familiar face on a screen is the same as verifying identity.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An employee joined a video call believing it included the company's CFO and several colleagues, but every person on the call was an AI-generated deepfake built from public footage of real executives.
The employee initially suspected phishing and requested a video call to verify the request, but the video call itself was treated as sufficient proof of identity, since convincing deepfakes are no longer easy to detect by sight.
The employee authorized fifteen transfers totaling roughly $25 million before the fraud was discovered.
Recommended controls include pre-agreed code words or gestures, strict policies that video alone cannot authorize payments or credential sharing, and verification through a separate, known channel.
In 2024, one finance employee wired $25 million after a single “confidential transaction” video call. They joined a video call with people who looked exactly like their CFO and colleagues. Every person on that call was an AI-generated deepfake, built from public footage. Here’s the trap: they push urgency and secrecy, then say, “Let’s jump on video to prove it’s me.” On that call, they rush you into big payments or an “audit” that quietly asks for system access and security answers. Aha moment: seeing someone on video is no longer proof it’s them. If anyone on a call asks for money movement or credentials, stop and confirm through a separate channel you already trust.
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
The article describes how modern phishing can start with an email impersonation and then move into live deepfake video calls to pressure employees into sending money. It cites a widely reported case at engineering firm Arup where an employee, convinced by a deepfake video call featuring synthetic…
Research from Cisco Talos and CrowdStrike says criminals are building AI into everyday operations, from writing malicious code to scaling fraud infrastructure. The reports describe real prompt logs where attackers use simple “authorized testing” claims to trick AI tools into helping them, plus…
The article discusses Google’s new selfie-video account recovery, but it also highlights a real deepfake-enabled fraud case. In that incident, a finance employee joined a video call showing deepfake versions of coworkers and was persuaded to send multiple wire transfers, illustrating how realistic…
The article explains how generative AI is making phishing and impersonation more convincing, so “bad grammar” is no longer a reliable warning sign. It cites a real case in Hong Kong where fraudsters used deepfake video to impersonate senior colleagues on a video meeting and tricked a finance worker…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
