In March 2025, a finance director at an unnamed multinational corporation (MNC) headquartered in Singapore was defrauded of US$499,000 (approximately SG$670,000) through a meticulously orchestrated deepfake video conference attack. Cybercriminals used artificial intelligence(AI) to generate real-time synthetic personas of the company's CFO and other senior executives, then hosted a live Zoom call with the finance director, convincing them to authorize a large wire transfer.

This case is one of the first of its scale in Southeast Asia and marks a turning point in corporate fraud. It did not involve a phishing email or a suspicious phone call, but a multi-participant live deepfake video conference that bypassed the traditional “seeing is believing” safeguard. Importantly, authorities in Singapore and Hong Kong responded swiftly and recovered the transferred funds before the fraud was fully completed.

⚠  WHY THIS MATTERS TO EVERY CFO
Traditional verification protocols, including video calls are no longer sufficient. By the time fraudsters ask for a second transfer of US$1.4 million, the first payment may already have been sent. This case shows clearly that deepfakes are no longer just a future risk they are a real and present danger for businesses today.

The targeted organisation is an unidentified multinational corporation with operations in Singapore and cross-border financial activities extending to Hong Kong. The company's name has not been publicly disclosed by Singapore authorities (consistent with privacy protections for corporate victims). Its finance function involved regular large-value intercompany and project-related wire transfers, a profile that made it an attractive target.

The attack was multi-stage, psychologically sophisticated, and leveraged multiple channels to build trust before extracting funds. The following timeline is reconstructed from the Singapore Police Force advisory and corroborated by independent reporting from HRD Asia, Cyber Security Asia, and Reality Defender.

The attackers used generative AI and deepfake video technology sourced from publicly available footage. Key technical characteristics of the attack included:

While the full US$499,000 was recovered, this outcome is exceptional. The recovery was only possible because the finance director's suspicion was triggered by the second request and because Singapore-Hong Kong law enforcement cooperation moved within hours. In the majority of comparable global incidents, funds are dispersed and irrecoverable within 24–48 hours.

This incident is instructive precisely because the finance director followed what were, until recently, best-practice verification steps. The failure was not negligence, it was that the threat evolved beyond existing control frameworks.

1. Video Verification as Final Check- Now Compromised

The widely taught counter-measure to Business Email Compromise (BEC) attacks is 'escalate to a video call to verify the requester.' This incident shows that video calls can no longer serve as a final verification step. The attackers aware that finance professionals had been trained to request video verification, proactively suggested the Zoom call themselves, weaponising the verification step.

2. Single-Channel Authentication

The finance director received the initial request via WhatsApp, was briefed via documents, and then confirmed via Zoom, all channels controlled by the attackers. There was no step that required the finance director to initiate contact with the real CFO through an independently verified number or email on file.

3. Absence of Out-of-Band Dual Authorisation

A second independent authoriser, physically present, or contacted via a pre-registered separate channel was not required. For a wire transfer of US$499,000, many financial governance frameworks would mandate dual sign-off, but this control either did not exist or was bypassed within the deepfake's false authority structure.

4. No Deepfake Detection Capability

Neither the Zoom platform nor the company's internal systems flagged the video call as containing AI-generated content. Commercial real-time deepfake detection tools existed at the time but were not deployed in this organisation's workflow.

🚨  CRITICAL INSIGHT

The most dangerous element of this scam was not the technology, it was the psychological engineering. Scammers knew that finance professionals had been warned about BEC emails and voice calls. They pre-empted verification by offering video confirmation themselves. The 'willingness to verify' created false confidence that exploited the very security culture meant to protect the victim.

In retrospect, multiple warning signs were present. Awareness of these signals should form part of every finance team's ongoing training.

The root cause is the intersection of two converging factors:

(1) the commoditisation of real-time deepfake technology that has made multi-person video impersonation accessible to criminal networks, and

(2) the absence of control frameworks that account for compromised video verification. Security postures built for Business Email Compromise and voice-only fraud are structurally inadequate against live video deepfake attacks.

A full control stack addressing deepfake threats can be implemented for under SG$200,000 annually, a fraction of the SG$670,000 targeted in this incident, and negligible against the potential US$1.9 million total exposure had the scam fully succeeded.