When the boss on the video call isn’t real
An employee sent $25 million after a video call where everyone else was a deepfake. The fix is a process, not a tool.
This year an employee at an engineering firm’s Hong Kong office sent about 25 million US dollars to criminals. The request came on a video call with the company’s CFO and several colleagues. All of them were deepfakes. The firm, Arup, confirmed it in May.
A cloned voice now needs a few seconds of audio. A convincing face on a call is getting cheap. “I saw them on video” isn’t proof anymore.
The defence isn’t a detection tool. It’s a payment process nobody can skip:
- Any new payee or changed bank details get confirmed by calling back on a number you already have, never one from the message or call.
- Large payments need two people, and one of them wasn’t on the call.
- Urgency and secrecy are red flags, especially together. “Don’t tell anyone, it’s confidential, do it today.”
- Agree a code word between finance and leadership for unusual requests.
And make it clear that following the process is never insubordination, even if the “CEO” is shouting.