how it happened
- whofraudstersdeepfaked the CEO live
- the targetfinance directorevery step had a reason
- then~US$499,000 sentsecond request flagged
- how it stoppedbank stopped itfunds recovered
what everyone assumed
A live video call has always carried more proof than an email or a phone call, because you can see the people, watch them react, hear them in the moment. That extra evidence is precisely why the format was chosen against the victim. The finance director was not careless, he was applying the verification standard most of us still trust: if I can see them and hear them on a live call, they are who they appear to be.
what happened
The deception was built in layers rather than left to chance. The finance director was first brought into the video conference, where, according to Singapore Police accounts reported in the press, the chief executive and other executives were impersonated using real-time deepfakes. He signed the NDA with the supposed lawyer. Then, across the call and the follow-up messages, he was directed to move funds from the company’s HSBC account, framed as support for an urgent regional restructuring. On 26 March 2025 he transferred roughly US$499,000 to a local corporate account. From inside the process, every step had a reason.
step by step
- a finance director joins a video callThe CEO and other executives are real-time deepfakes.the assumption breaks here
- an NDA and an urgent restructuring storyHe is directed to move funds.
- 26 March 2025about US$499,000 transferred
- next daya second request makes the bank lookNearly all of it is recovered by 28 March.
how it surfaced
The assumption did not retire on the call. It retired the next day, when a second request arrived for a further sum reported at about US$1.4 million, and the bank flagged the anomaly. Singapore’s Anti-Scam Centre worked with Hong Kong’s Anti-Deception Coordination Centre to halt the cross-border withdrawals. Nearly the entire US$499,000 was recovered by 28 March. About US$5,000 had already been moved out through a domestic mule account. The thing that finally caught it was not the deepfake quality, it was a second transfer that drew a second look.
A live call now shows you a face and a voice, and neither one is evidence of identity any more.
What still holds up is the process around the payment, not the meeting that asked for it.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersThe CEO on the call is a deepfake, and the transfer goes through.what it costs youYou get the money back only because the bank spotted the second request.
- or it goes like thisit happenedArup deepfake fraud, 2024howA video call full of deepfaked executives asks for urgent transfers.what leavesmoney, in several transfers in one daywho ends up with itfraudsters who built the call
- or it goes like thisit happenedFacebook and Google, 2019howInvoices arrive in a real supplier's name with new bank details.what leavesmonths of supplier paymentswho ends up with ita fraudster abroad
sources
your turn
what you can do about it
this week
Someone in your finance function may be told, in confidence, on a convincing call, to move money for a deal that has to stay quiet and move fast.
Secrecy and urgency are the two conditions that switch off the second look. The one place to look this week is whether a large or unusual transfer can be completed on the strength of a single call, or whether it has to clear an out-of-band confirmation that does not depend on anyone's face. In Singapore the first payment went through, and it was the demand for a second one that exposed the first.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →