Hong Kong Finance Worker Wired $25.6 Million After AI Deepfake Recreated His Entire Executive Team on a Video Call

A finance worker in Hong Kong was suspicious the moment he got the message. Someone claiming to be his company's chief financial officer requested a confidential, urgent transfer. Secret transfer. Senior officer. Remote instruction. That's a classic red flag for fraud, and his first reaction was suspicion.

Then came the meeting invitation. His CFO appeared on screen. Other colleagues joined him. The employee recognized their faces and their voices. They looked like the people authorized to request this transfer. Any doubt he had was met with a room full of confirmation.

Every other person on that call was fake. Their faces had been recreated from existing footage and their voices imitated. The meeting existed for one person and one person alone — the only participant whose face, job, and decisions were real.

Hong Kong police later laid out the arithmetic. The employee authorized 15 transfers into five local bank accounts. The total was HK$200 million, roughly US$25.6 million. He discovered the fraud only after following up with headquarters.

A single fake face wasn't enough. A fake room was.

A simpler version of this story is that an employee was deceived by a fake video. But that leaves out an important detail: he was initially suspicious of the message he received. The fraud succeeded because the criminals did not try to dismiss that suspicion. Instead, they built a broader situation designed to make the request appear credible. One familiar executive on a video call might still have left room for doubt, but a group call supplied social proof — several known and trusted colleagues also appeared to accept the request, transforming an unusual instruction into a shared corporate reality.

He was no longer weighing one suspicious message against his own judgment. He was weighing his judgment against an entire room. The fraudsters didn't merely copy a single face — they used a bunch of familiar faces to create the appearance of context, hierarchy, and consensus, adding pressure by making him feel like he was the only person on the call who didn't understand what needed to be done.

Security guidance saw this coming

Five months before that transfer, three United States security agencies warned organizations that deepfakes were becoming cheaper and easier to produce. Their guidance identified impersonated leaders and financial officers as a direct threat and recommended real-time verification, protected communications, training, and rehearsed responses. By November 2024, the Financial Crimes Enforcement Network was reporting an increase in suspicious activity involving deepfake media, particularly fraudulent identity documents used to defeat identity checks.

Security training taught people to escalate from a suspicious message to richer proof: get on a call, turn on the camera, bring in the team. But in this case, the call, the camera, and the team were the fraud.

What Hong Kong police's account shows is that several faces on one attacker-controlled call weren't several confirmations — they were one source wearing several identities. All the apparent votes of confidence arrived through the same compromised door.

Companies handling significant transactions may need to rely on more than apparent agreement on a video call. Independent approval channels, verified contact information, transaction controls, and a separate route back to the supposed decision-maker can help give reality another chance to enter into the process — even when a request appears to come from a room full of familiar, trusted faces.