DEEPFAKE FRAUD / THE APPROVAL LESSON
A familiar face
cannot approve a payment.
The Hong Kong case shows why authority needs an independent check.
A familiar face on a screen can make a request feel authoritative. The Hong Kong deepfake-fraud case shows why a payment process must establish authority independently of how convincing a meeting looks.
The loss is striking, but the sequence matters more: a message, a staged appearance of authority, and payment instructions that continued through another channel.
THE EXECUTIVE BRIEF
The decisions that matter.
- The later official account clarifies the early news coverage.
- A convincing call does not independently authorise a payment.
- Rehearse the process for pausing and checking an urgent executive request.
THE REPORTED CASE / JANUARY 2024
The later official account is more precise.
See CNN’s February 2024 coverage. In a 26 June 2024 Legislative Council reply, Hong Kong’s government described a case reported in late January: a phishing email impersonated a UK-head-office CFO, followed by a fabricated, pre-recorded group conference. Instructions continued over instant messaging; about HK$200 million went to five local bank accounts.
The reply said investigators believed public clips and voices had been used and that the pre-recorded meeting involved no interaction. The account does not describe a fully interactive live call or a single transfer to China. It also does not establish that this was Hong Kong’s first-ever deepfake fraud.
The historical US-dollar headline is an approximate conversion. Keep the source currency and the dated account visible when discussing the loss.
THE BUSINESS CONTROL
Recognition and authorisation are different questions.
AN ILLUSTRATIVE PAYMENT FILE
Three checks a convincing video cannot replace.
IDENTITY
Who made the request?
Use a previously established route rather than the phone number or account supplied with the request.
AUTHORITY
May this payment be approved?
Apply the normal limits, separation of duties, and exception process, including for senior executives.
BENEFICIARY
Where is the money going?
Independently verify changed or unfamiliar payment details through the agreed process.
CyberSolace payment-review prompts. This is not a reconstruction of the victim’s internal controls.
A call, email, or message can be one item of evidence without being sufficient authority. The more consequential the instruction, the more important it is to use a process that does not rely entirely on apparent identity.
Agree how confidential transactions are handled before an urgent request arrives. If secrecy means the normal approver must not be contacted, the instruction should trigger the exception process, not silently remove it.
THE PEOPLE & THE PROCESS
Give staff permission to pause.
An employee may recognise something unusual yet feel unable to challenge a senior person. Make the verification rule apply regardless of rank. Senior leaders should model that behaviour by accepting independent checks on their own requests.
Keep the checking route usable when the usual person is travelling, busy, or unreachable. A process that depends on one individual answering immediately creates pressure to bypass it.
Use training to explain the action expected: pause, verify using a known route, and escalate uncertainty. Do not make the programme depend on staff diagnosing visual artefacts or winning a contest against synthetic media.
IF A PAYMENT HAS ALREADY MOVED
Treat uncertainty as an incident requiring prompt action.
Contact the relevant bank through a trusted channel, activate the business incident and fraud process, and preserve the messages, transaction details, and available records. Coordinate reporting and legal or insurance advice appropriate to the circumstances.
Keep the response supportive. A colleague who suspects a mistake needs to report it quickly. Public blame or an argument over whether the video was convincing can delay the actions that matter.
A PRACTICAL EXERCISE
Try the request without using real money.
Give a small group an authorised scenario: an apparently senior colleague requests an urgent confidential payment to new details after a convincing remote meeting. Ask who may approve, how the beneficiary is checked, and what happens if the executive cannot be reached.
Record the assumptions and the first decision that cannot be supported. That finding provides a concrete improvement to ownership, contact routes, or payment policy without needing to demonstrate a deepfake attack on staff.
A PRACTICAL NEXT STEP
Test the authority behind the instruction.
CyberSolace can help rehearse an executive-impersonation scenario against the business’s actual approval and escalation arrangements.
SOURCES & EDITORIAL REVIEW
Historical findings and incident accounts are dated in the text. Illustrative review prompts are CyberSolace commentary. Editorial review: 20 October 2026.