A Video Call That Cost $25.6 Million—And It's Happening in Hong Kong
It was supposed to be a routine video conference. The executive opened his laptop, started the call, and found himself face-to-face with his Chief Financial Officer. The conversation felt natural. The voice was clear. The facial expressions matched. Everything looked real because it was artificially perfect.
Within minutes, the finance worker transferred $25.6 million. Only later—when the real CFO called asking about the wire—did the chilling truth emerge: that wasn't his boss. It was a deepfake. And Hong Kong's finance industry just became the target of the most sophisticated fraud ever recorded in the city.
This isn't science fiction. This happened in 2024, and it's a wake-up call that no business in Hong Kong can ignore. Not because it might happen—but because it *is* happening, and it's getting worse.
Why Deepfake Fraud Works: The Cold Math of Trust
Your defense against fraud has always been verification. You see someone's face on video, hear their voice, and trust it. But deepfake technology has shattered that assumption. In 2025, AI can now generate photorealistic video of almost anyone saying almost anything—and do it in real-time.
The Hong Kong case reveals something terrifying: deepfake attacks aren't random. They're targeted. The scammers used multiple AI-generated executives in a single call to create pressure and urgency. They knew the company structure. They understood the payment process. They even tailored the request to match typical business patterns.
This is why deepfakes are deadlier than phishing emails or vishing calls. Traditional fraud makes mistakes. Deepfakes? They don't stammer. They don't get the job title wrong. They don't hesitate when asked a tricky question. They're *designed* to be perfect, and that perfection is their weapon.
The Numbers Show Deepfakes Are Just the Beginning
The deepfake fraud case is alarming, but it's not an isolated incident. The real danger is the acceleration:
In 2025, HKCERT recorded **15,877 cybersecurity incidents** across Hong Kong—a **27% year-on-year increase**. Phishing attacks alone account for **57% of all cyber incidents**, exposing the fact that Hong Kong businesses remain vulnerable to social engineering at scale.
But here's the hidden threat: while companies focus on phishing and traditional hacking, **35% of businesses using AI are already entering corporate data into AI tools**. They're training the very systems that could be weaponized against them. And with only **26% of Hong Kong SMEs having dedicated cybersecurity staff**, most businesses won't even know they've been compromised until the damage is done.
AI-powered attacks are becoming stealthier and more scalable. What costs hundreds of thousands to execute through traditional fraud can now be automated and deployed against thousands of companies simultaneously.
Your Next Video Meeting Could Be the Trap
Think about your last important video call. How would you verify it was really your boss? Not "pretty sure" or "probably"—but *actually verify* in the moment, with zero doubt?
Most Hong Kong executives can't answer that question honestly. And that's the gap the attackers are exploiting.
The deepfake call in Hong Kong followed a pattern that's becoming eerily familiar:
1. **Research**: Attackers gather intelligence on company structure, recent deals, and communication patterns from LinkedIn, company websites, and leaked data.
2. **Impersonation**: Multiple AI-generated executives appear on the same call, creating urgency and peer pressure.
3. **Exploitation**: A high-stakes financial request that feels normal—a wire transfer for a "time-sensitive acquisition" or "urgent investment."
4. **Speed**: The entire call is over in minutes, before the victim has time to process what's happening.
And the scariest part? Every step of this process is *improving*. Deepfake videos are getting sharper. AI voices are becoming more natural. Detection tools are falling behind. Your current defenses—a video call plus a phone call back—might not be enough.
How Deepfakes Exploit Your Trust in Technology
Here's the psychological trap: as business becomes more digital, we *have* to trust video and voice. Remote work demands it. International business requires it. So when deepfakes show up, they arrive wearing the same clothes as your daily reality. You don't question it because you *can't*—not without bringing every interaction to a halt.
That's exactly what the attackers count on.
The Hong Kong victim had no reason to suspect the CFO. The company had hosted hundreds of remote calls. Video conferencing was normal. And that's the genius of deepfake fraud: it doesn't require the victim to be stupid or careless. It requires the victim to function like a normal business—and then it exploits that normalcy.
What You Can Do Right Now (Before Your Crisis Hits)
The deepfake case happened. You can't prevent that. But you *can* prepare for the next one—because there will be more.
**Immediate steps:**
- **Multi-step verification for high-value requests**: If you're transferring money, making deals, or accessing sensitive systems, require a separate verification channel. A video call isn't enough. Require a callback to a verified phone number, an in-person meeting, or a secure authentication process. - **Train your team on deepfake red flags**: Not everyone needs to be a deepfake expert, but your finance, HR, and executive teams need to know what to watch for—unnatural pauses, perfect lighting, slightly off lip-sync, requests that break normal procedures. - **Implement AI-powered security monitoring**: The same AI that creates deepfakes can detect them. Advanced security systems now use AI to flag suspicious video calls, detect deepfake artifacts, and alert you before fraud happens. - **Audit your data exposure**: Review what company information is publicly available. Scammers use LinkedIn profiles, org charts, and past news to build convincing impersonations. Minimize what you expose. - **Establish clear financial approval workflows**: Deepfakes exploit urgency and authority. If your finance process requires multiple approvals from different people on different channels, even a perfect deepfake can't bypass it.
The Real Cost: It's Not Just About Money
$25.6 million is staggering. But the real cost goes deeper. After the deepfake fraud in Hong Kong, that company had to:
- **Rebuild trust** with investors, clients, and employees who questioned how this could happen. - **Overhaul security infrastructure** at massive expense and disruption. - **Face reputational damage** that still follows the company's brand. - **Increase insurance and compliance costs** for years to come.
For SMEs, the impact is even worse. A $25.6 million loss might bankrupt a mid-sized company. The fraud isn't just a financial hit—it's an existential threat.
This Is the New Normal. Are You Ready?
The deepfake deepfake call in Hong Kong was unprecedented in scale, but it revealed something crucial: **AI fraud isn't coming in the future. It's here now.** And it's only going to get faster, smarter, and more profitable for attackers.
The companies that survive this transition are the ones that act *before* the crisis. They implement security systems that assume deepfakes are a real threat. They train their teams. They build processes that can't be bypassed by a perfect video call. They understand that trust in the digital age requires more than your eyes and ears.
Your next video meeting could be legitimate. Or it could be artificial. And in a world where deepfakes are becoming indistinguishable from reality, the only way to stay safe is to stop relying on the assumption that seeing is believing.
🛡️ Don't Let Deepfakes Catch You Off Guard
UD's AI Staff Solution includes AI-powered security monitoring
that helps identify threats before they cost you millions.
懂AI，更懂你 — 28 years protecting Hong Kong businesses.