$25 million deepfake fraud

What Happened

In February 2024, a finance employee at a multinational firm's Hong Kong office was tricked into transferring HK$200 million ($25.6 million) to fraudsters. The employee received a suspicious email claiming to be from the company's UK-based Chief Financial Officer, which he initially suspected of being a phishing attempt. However, he was invited to a video conference call with who he believed was the CFO and several other colleagues. The fraudsters used advanced, real-time generative AI video and voice-cloning technology to create highly realistic deepfakes of the CFO and other colleagues. Reassured by the video call, the employee executed 15 transactions, only realizing the fraud days later when verifying the transactions with the actual parent company.

How MEG 1 would have acted

This represents a highly sophisticated, malicious use of real-time biometric video and voice cloning to bypass corporate financial security, constituting a direct, hostile attack on the organization's financial sovereignty.

MEG 2 Analysis - Legal Framework

Agent level: N3 (individualized/advanced) - generative AI systems capable of real-time, highly realistic biometric video and voice simulation used to execute financial fraud.
Cause (6.1):
(c) hostile weaponization / biometric impersonation - the deliberate creation and deployment of cloned biometric assets designed to deceive a human operator and execute unauthorized, high-value financial transactions.
Attachment of liability: The external cyber-criminals are fully liable; the manufacturer of the real-time deepfake software shares liability if they failed to implement mandatory safety controls, watermarking, or verification of usage rights (7.2).

Procedural Mechanism

6.2 (architectural human confirmation): High-value financial transactions must require multi-factor, out-of-band architectural human confirmation (e.g., digital signatures, out-of-band phone calls), and must not rely solely on verbal or video-conferencing authorization.
7.2 (anti-weaponization): Software developers are exonerated if they implemented mandatory biometric enlistment verification and unalterable real-time watermarking; full liability is placed on the fraudulent actors.
7.1 (independent forensics): The video stream packets, IP routing metadata, and transaction destination logs must be preserved in a secure ledger for international forensic investigation.