Convincing faces, unauthenticated seats: the Hong Kong deepfake was a meeting-identity failure

The week

In early February 2024, Hong Kong police described a case in which an employee of a multinational company’s Hong Kong office was deceived into moving money. In 15 transfers, about HK$200 million, roughly US$25 million, went to five local bank accounts. The employee acted after a video conference in which the company’s UK-based chief financial officer and other colleagues appeared to be present. Police said those participants were deepfakes. The company was identified in May 2024 as the engineering firm Arup. In the same fortnight, on February 8, the Federal Communications Commission ruled that AI-generated voices in robocalls are artificial voices under the Telephone Consumer Protection Act. On February 14, Microsoft and OpenAI reported that several state-affiliated groups had used large language models for reconnaissance, scripting and drafting phishing content.

Most commentary filed the Hong Kong case under business email compromise with better special effects. Earlier in this series we argued that business email compromise is a payments problem, decided by callbacks and dual release. That remains true. The new element here was the meeting. A video call with several familiar faces did what an email could not: it removed doubt. The employee was persuaded by a channel that most organizations treat as trusted by default, though it rarely authenticates anyone. That makes the meeting itself a control surface. It has three points where a bank can act: how someone gets into the meeting, what counts as proof of identity once inside, and how an instruction leaves the meeting and becomes a transaction.

Getting in: the invitation and the join path

Enterprise collaboration platforms distinguish internal users from external ones, but the distinction is easy to miss. A participant joining from another tenant, a personal account or an anonymous link usually appears with a display name the attacker chose. External labels exist, yet they are often small, and many firms have trained staff to ignore them because so many legitimate meetings include outsiders.

The controls are configuration choices that security and collaboration teams can make in a week. Restrict anonymous join for meetings organized by finance, treasury and executive offices. Make external participants wait in a lobby and show a clear external banner. Block or flag display names that match internal executives when the account is external. Require meetings about payments, acquisitions or confidential transactions to be organized from inside the corporate tenant, by a known person, using the corporate directory.

Each setting has a cost. Lobby rules slow down meetings with clients and advisers. Blocking executive name lookalikes produces false positives. The trade-off is acceptable for a narrow group of high-risk roles. Applying it to everyone would generate the kind of friction that leads people to switch to personal tools, which is worse.

These settings can be measured. A useful monthly report covers the high-risk group. It shows how many meetings included external or anonymous participants and how many external accounts used a display name matching an internal executive. It also shows how many lobby admissions were granted without the organizer’s review. The numbers start high and should fall as habits change. A sudden rise in executive lookalike names is itself an early warning that the organization is being targeted.

Inside the meeting: what counts as proof

The second point is cultural and procedural. Staff are taught to verify identity on the phone, but few organizations have a rule for video. A face that looks and sounds right has, until recently, been treated as the strongest proof available. Generative video and voice tools have removed that assumption, and the February 14 report from Microsoft and OpenAI showed that attackers were already using language models to research targets and polish their approaches.

Banks need an explicit rule: a face or voice in a meeting is not proof of identity for any request involving money, credentials or confidential data. The rule should name what is. Practical options include confirmation through the corporate chat system from the person’s authenticated account, a callback to a directory number, or approval inside a workflow system that requires the person’s own login and multifactor authentication.

The rule only works if senior people follow it visibly. A chief financial officer who tells finance staff, in writing, that every request from them will be confirmed by a second channel removes the social cost of checking. Without that, an employee who challenges an apparent executive on camera bears the risk of being wrong.

Getting out: the handoff from conversation to transaction

The third point is where an instruction leaves the meeting. In the Hong Kong case, a conversation became 15 transfers. The safeguard is to make sure that no meeting, however senior, can directly cause a payment. Instructions should be re-originated in the payment or treasury system by the person who has authority, under their own credentials, and then released by a second person.

For banks this applies in two places. The first is the bank’s own treasury, accounts payable and corporate finance functions. The second is clients. Commercial and private banking teams receive instructions from corporate treasurers and family office principals on video calls. Their procedures should state that a call is never an instruction, and client agreements should support that.

The bank’s position as receiving institution also matters. The Hong Kong funds went to five local accounts. Mule account detection, including scrutiny of new accounts receiving large, unusual inbound transfers, is the last point where a deepfake-driven payment can be stopped.

Banks can also offer this protection as a service. Corporate clients increasingly ask their banks for payment controls such as named approvers, dual authorization in the online banking platform and checks that the payee name matches the account. Making those features the default for large outbound wires, rather than an option, moves the handoff control into the bank’s own systems, where it does not depend on the client’s meeting hygiene.

The three points are independent. Tight join controls do not help if staff accept faces as proof. A strong verification rule fails if one person can still move money directly. Organizations should close all three, starting with the roles that can move the most money.

With hindsight

AI impersonation became a standing fraud pattern. In November 2024, FinCEN issued an alert to financial institutions on fraud schemes using deepfake media, with red flags and a request to reference the alert in suspicious activity reports. In May 2025, the FBI warned that malicious actors were using AI-generated voice messages to impersonate senior US officials. Both warnings described the same weakness: people treating a familiar voice or face as authentication. The Hong Kong case remains one of the most cited examples because the controls that would have stopped it were neither new nor expensive. A later article in this series looks at FinCEN’s alert and the wider question of where institutions still let a face or voice approve something.