Finance worker pays out $25M after video call call with deepfake CFO

https://edition.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk/index.html

by bsdz • 2 years ago

491 339 2 years ago

edition.cnn.com

bsdz• 2 years ago

“(In the) multi-person video conference, it turns out that everyone [he saw] was fake,”

This sounds like it required quite a bit of preparation, i.e. collecting data for each deep-faked participant including image/voice samples.

If it's reaching this level of sophistication already then I suspect a new participant validation scheme is on its way for sensitive meetings.

willsmith722• 2 years ago

the scary part is how easy this would be to do right now, especially for a larger, higher-profile company. leadership is almost synonymous with an online presence in the form of podcasts, interviews, youtube videos, conference talks. combine that with public photo-sharing app profiles, and you're in business.

sbarre3• 2 years ago

Yeah C-suite execs are often on quarterly investor calls and those calls are made public as a matter of record aren't they?

dist-epoch2• 2 years ago

$25 mil was on the stake.

It would easily be worth it spending $1m on the perfect setup.

irrelative• 2 years ago

Only if it works >4% of the time.

escapecharacter• 2 years ago

spearphaking?

ozr2• 2 years ago

It's a sophisticated attack for sure, but the data collection really isn't too difficult now. A minute or two of audio is sufficient for voice, and a single good image.

silexia• 2 years ago

The most likely explanation is the employee responsible here was actually the one who stole the money.

layer8• 2 years ago

It seems that only the voices were deep-faked, and the video material was from genuine calls and downloaded before the attack: https://news.rthk.hk/rthk/en/component/k2/1739119-20240204.h...

iamflimflam1• 2 years ago

I would suggest that every CFO agrees some kind of secret challenge response with their staff and other execs.

pliny• 2 years ago

The secret challenge exists and it is the phone number / email address / VC account of CFO. If CFO wants to order EMPLOYEE to send money, then EMPLOYEE should only do the action after making an outgoing call to CFO.

agilob• 2 years ago

Make a twist and call my wife, not me.

makeitdouble5• 2 years ago

Where it hurts is it can be a PITA to get hold of the CFO from the mere employee side, especially as the CFO was UK based.

Basically, it was a well thought and well executed scam that perfectly fit the employee's situation.

hn_throwaway_99• 2 years ago

100% agree. "Hang Up, Look Up, Call Back" should be made into a jingle and absolutely hammered into the culture of, at this point, literally everyone (given all the scams that occur targeted both toward consumers and employees): https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo...

TrackerFF• 2 years ago

I don't know enough about this, but would it be possible for the scammers to hijack the SIM swapping?

That is, the scammer manages to get ahold of the SIM card / phone number of the CFO, and be on the receiving end if/when a worker calls the CFO up.

Weakest link would probably be to compromise some telecom worker, so that this can be orchestrated.

aussieguy12342• 2 years ago

This will work, until some determined actor sim swaps the CFO in advance.

Narkov• 2 years ago

Money transfer, or any non-revocable transaction for that matter, should require multiple sign-offs (a.k.a "two/X to sign"). Businesses have been using this for decades.

This problem isn't a technical one..it's a process issue. One person shouldn't be able to transfer $25m without multiple people authenticating and authorising.

monkeydust• 2 years ago

Was expecting this to happen soon and I guess soon is now. Will Zoom, MS start to compete on participant authentication features they are probably going to add?

DANmode3• 2 years ago

Heading in that direction

https://www.microsoft.com/en-us/security/blog/2023/05/04/how...

https://learn.microsoft.com/en-us/entra/verified-id/how-to-d...

smeej3• 2 years ago

My money had been on 3-5 years, but it was definitely coming, and I guess I shouldn't be surprised it's here.

Gustomaximus3• 2 years ago

“(In the) multi-person video conference, it turns out that everyone [he saw] was fake,”

This could be totally real, but also could one employee saying 'the CFO was on a call' and claim deepfake to make it an excuse?

I guess it was a matter of time before this occurred. How long before scammers do bulk video calls to parents/grandparent pretending to be the kids saying they are in trouble and need $$$ ASAP.

The even better question, is how can this be stopped or reduced and is there a new business there?

cornholio3• 2 years ago

Seems like it can be stopped dead with standard crypto, smart cards and multifactor tokens, multiparty authorization etc. Ideally, issued by public authorities together with any other official ID, leveraging the strong security governments have already built around that process.

The generic type of vulnerability referenced in the latter part of the article has sprung up after fintech tried to emulate traditional offline auth and KYC with things like scanned images of ID documents, face recognition and liveness detection. Anyone in the know could see these attacks coming miles away.

loceng2• 2 years ago

Could you elucidate how exactly "standard crypto" would stop such a thing?

hobofan• 2 years ago

I don't know. Based on how it is described in the article, you could detect it via the means you mentioned and raise them as warning flags to the user, but as a last instance there will still be users that ignore all the warning signs and be convinced by a good scam story.

lupire• 2 years ago

The article mentions a pile of stolen ID cards used in another fraud.

dist-epoch2• 2 years ago

It's a lose-lose situation.

If you refuse and it's an actual emergency with the real CFO, it might be a career limiting move, if you don't get fired.

If you accept, it might be a deepfake CFO and you might get sued.

acdha4• 2 years ago

If you refuse and it's an actual emergency with the real CFO, it might be a career limiting move, if you don't get fired.

This is really the crux of it: senior management needs to take the lead setting up policies which are efficient enough not encourage people to try to bypass them and the culture that everyone in the company should feel comfortable telling the CEO “I’m not allowed to do that”. This is possible but it has to be actively cultivated.

michaelt• 2 years ago

The solution: Make it your boss's problem.

_lvbh• 2 years ago

scammers do bulk video calls to parents/grandparent pretending to be the kids saying they are in trouble and need $$$ ASAP

Especially when a high percentage of people post their face and voice on social media. I find this especially crazy in the age of AI. I trained a Stable Diffusion LORA with photos of a friend and showed it to them (with permission) and they were completely shocked. Showed it to one of their friends and they were fooled for at least a minute and took some careful looks to find discrepancies

ghaff5• 2 years ago

The reality is that if you speak at a conference there's a decent chance there's video of that on YouTube. If you have any sort of public presence as part of your job, your voice and likeness are probably out there whether you put it out yourself or not.

Keeping yourself anonymous isn't compatible with a lot of even moderately senior-level jobs out there.

NoPicklez2• 2 years ago

I dont think its "crazy".

There has been little issue for most people having photos of themselves online on social media.

If people want a photo of you they will find one.

RScholar• 2 years ago

Roguescholar@sbcglobal.net Roguescholar@sbcglobain and and and and and and and l.net

fuzzfactor• 2 years ago

it was a matter of time before this occurred.

I would assume the matter of time for it occurring has elapsed a while ago, and now we are in the place where it's not only being detected, but further, actually revealed, regardless of how embarassing that is.

pas• 2 years ago

recently a group targeted expat/temp students and their families. they somehow coerced the kid to go camping don't pick up to anyone, and then they told the family the kid is with them. the family paid.

https://abcnews.go.com/US/utah-missing-foreign-exchange-stud...

abdullahkhalids• 2 years ago

How long before scammers do bulk video calls to parents/grandparent pretending to be the kids saying they are in trouble and need $$$ ASAP.

Unfortunately, this is why we need open access to some deepfake tech. The only way to convince people who are not immersed in tech how convincing deepfakes can be is to sit with them, and create their own deepfakes.

Then memorize and practice security protocols like verbal passwords.

staunton5• 2 years ago

The issue with people disregarding security protocols goes much deeper than them being unaware of what's possible. People just hope nothing will happen and avoid thinking about it. You're facing "Who's got time for that stuff? We have actual work to do!" and "What's so important about our data/access privileges/whathaveyou anyway? Nobody will bother stealing it."

bagels2• 2 years ago

That's already happening successfully without deepfakes. Scammer calls and says "grandma I'm in trouble, they are holding me in jail unless you buy gift cards"

jimmySixDOF• 2 years ago

There was an old theory you needed to be holding today's newspaper or mention current events to at least show that a media was not prepared earlier but this advice is out the window given enough dedication from the adversary.

mrguyorama• 2 years ago

I guess it was a matter of time before this occurred. How long before scammers do bulk video calls to parents/grandparent pretending to be the kids saying they are in trouble and need $$$ ASAP.

Umm where have you been the last decade? The "Grandma help me I'm in a foreign prison and need you to buy iTunes gift cards" scam is extremely lucrative.

Gustomaximus3• 2 years ago

Just some well meaning feedback.

Opening with the line "Umm where have you been the last decade?" feels like throwing insults, and not conducive to a positive enviroment to learn from one another. You probably didnt mean it that way but though Id point out this style.

Regarding the last decade,, the pertinent part of the comment you responded to is "do bulk video calls to parents/grandparent pretending to be the kids" - more referring to when these existing scams hit a higher level.

lemming• 2 years ago

How long before scammers do bulk video calls to parents/grandparent pretending to be the kids saying they are in trouble and need $$$ ASAP.

A friend of mine in the US actually personally knows two people that this has already happened to, albeit with audio only. With video it's going to be nuts.

makeitdouble5• 2 years ago

Chan said the worker had grown suspicious after he received a message that was purportedly from the company’s UK-based chief financial officer.

It wasn't just a fake call, and he had a paper trail of the order...at this point it's pretty hard to prevent this from happening, short of having every order double checked by some other independent entity.

oldtownroad• 2 years ago

it’s trivial to avoid. Do not accept instructions outside of the standard instruction channels. The only reason this scheme works is because of bad processes, bad training or a culture of fear (where employees feel compelled to comply with any demand regardless of process for fear of losing their job).

If an employee routinely receives email or zoom instructions to transfer $25m without any sort of sign off then the company is completely at fault for terrible process.

JumpCrisscross• 2 years ago

Do not accept instructions outside of the defined company processes

Most non-enterprise companies have fairly loose wire protocols. That said, outgoing phone calls to two separate signers is a good, simple best practice.

nikanj• 2 years ago

The standard instruction channels are so reliably shit, nobody bats an eye if they get an email saying ”Teams is on the fritz again, please join us on Zoom instead”

logicchains• 2 years ago

Corporate email clients usually have a way of marking non-internal emails, surprised this wasn't used.

laboratorymice• 2 years ago

Don't know the details here, but email is still very much broken, and a number of large companies, including in the financial sector, are spoofable even after checking the usual boxes.[0]

[0] https://news.ycombinator.com/item?id=37438478

makeitdouble5• 2 years ago

Perhaps I'm reading too much between the lines, but this part makes it look like he got suspicious and checked for clues. It would have been pretty bad if the email was actually marked as internal.

Sam deal for the call as well. I'd expect the video client to warn that some members of the call are external to the organization (Google Meet does that). Or the CFO is expected to be outside (from another org) from the get go.

Initially, the worker suspected it was a phishing email, as it talked of the need for a secret transaction to be carried out.

mvc5• 2 years ago

You can't rely on email.

That's how I almost lost £100k. I got an email from my lawyer instructing me to pay an amount that I was expecting to have to pay, but to the wrong account. The email "from:" was definitely my lawyser's email address. It satisfied Gmail's spoofing checks. But it was not my lawyer who sent it.

frenchman99• 2 years ago

This should like bad company processes all around. For a sum this high, you need more than just a video call. Get an email (if the tech team setup DMARC correctly, sending phishing from company-domain is near impossible). Talk through company chat (Slack, Teams, etc). Call a couple high ranking on their cell.

miohtama• 2 years ago

Good old face-to-face works. 25M is worth of a business class flight.

smeej3• 2 years ago

It's not the money. It's the time. Lots of companies move fast enough that a $25M deal won't wait as long as it takes to fly from HK to London.

tetha• 2 years ago

It's one of the better ways to avoid getting scammed: Try to validate the communication in ways without relying on any information they gave you.

If someone claims to be a police officer and hands you a number to call to see if they are real... don't use that number. Figure out the non-emergency number of the station they claim to be coming from independently and ask them. If a "new agent" from your bank calls you and gives you a "new number" to call them, figure out an official number of your bank and call that.

mvc5• 2 years ago

Yep. Previous scam victim here. This step would have halted the scam I fell for.

Also, whenever paying new accounts, once you've independently reached the person you think you're talking to, always do a test transaction and make sure they get it before sending the rest.

willsmith722• 2 years ago

Initially, the worker suspected it was a phishing email, as it talked of the need for a secret transaction to be carried out. However, the worker put aside his early doubts after the video call because other people in attendance had looked and sounded just like colleagues he recognized.

this is the real problem. why oh why, after suspecting an email as phishing, would you then go on to even click ANYTHING, let alone join a video call?

insanity. either stupidity or he's lying about suspecting the email. how many corporate security trainings does it take? this is just about 101. "if asked to do a secret task by a suspicious email, DONT do it"

geraldwhen• 2 years ago

“Secret transaction” is in the annual training of annual who handles money. That’s an immediate red flag, escalate to corporate governance officer.

pavel_lishin4• 2 years ago

how many corporate security trainings does it take? this is just about 101. "if asked to do a secret task by a suspicious email, DONT do it"

It takes $CURRENT_NUMBER + 1.

People are still, to this day, racking up thousands of dollars in iTunes gift cards on corporate cards and mailing them out, because they got a text from "the CEO". It happened at my spouse's work just last year. It'll continue happening again, forever, because to paraphrase P.T. Barnum, a sucker is hired every minute - in the probability distribution of humanity along that particular axis, there's always going to be some percentage at the bottom who'll fall for the most obvious scams. Sometimes repeatedly.

IshKebab• 2 years ago

corporate security trainings

Have you ever actually done corporate security training? It's very obviously 100% useless and not going to teach anyone anything.

A company I worked for actually started sending test phishing campaigns which is a lot more effective, but I thought they were still pretty obvious and also it led to stupid people reporting them on Slack endlessly.

Still, probably the best thing you can do.

ozr2• 2 years ago

For you and me, yeah the training is useless. For someone actually naive enough to pick up gift cards for the 'CEO'? It could help.

Havoc2• 2 years ago

It's very obviously 100% useless and not going to teach anyone anything.

I've seen some decent ones. e.g. One that was presented from adversaries PoV which I thought was innovative & got people thinking about it in novel ways (at least did for me).

NoPicklez2• 2 years ago

I work in making and sending phishing emails for companies and measuring people's response.

Many people will open a suspected phishing link, report it, then open it later in the afternoon...

therealdrag0• 2 years ago

How do you know the training is useless?

teo_zero• 2 years ago

"if asked to do a secret task by a suspicious email, DONT do it"

This is not what they teach you in trainings, though. They teach you to get the requestor (or your boss or whoever might be authoritative) on the line and confirm that the email is authentic. I believe a video call qualifies as well.

SoftTalker2• 2 years ago

Depends on who initiates that video call. If the "boss" calls you and says "did you get the email" that is suspect at least if you don't carefully verify the origin of that call. Basically any communication that you don't initiate might be fake.

saaaaaam2• 2 years ago

I have no idea how something like this can even happen. In a company of that size it should be actually impossible for a transaction like this to occur without clearly documented processes to ingest, review, authorise and pay transactions.

I have clients where anything over even quite a low set limit (say €10k) requires multi-party authorisation - and it's very common for the person entering payments to be unable to authorise payments. That's just good practice.

A payment should not be able to be queued without a PO number. If the payee is new, the bank details need to be verified by phone. Once approved as a destination account, that payee is set up in banking, and authorised by a finance clerk and someone more senior. At the point a payment is requested the PO and other details should be double checked against what is in the system. If there's a match, then the payment can be queued for authorisation. The person entering payments and the people approving payments should be entirely different - and it should be people, not a single person. When payments are entered, the payments should be reviewed by first authorisation - a finance manager, for example - and once that authorisation is conducted, depending on payment limits, another authorisation or authorisations will be carried out.

BrandoElFollito2• 2 years ago

Exactly. There are programatical barriers you cannot bypass alone.

I can imagine a scan where the fake CEO gets a phone or laptop outside of the process "because CEO". This however will still be limited to generic, low value stuff handled by single people in a company.

There is no way that a reasonably organized company can leak 40 MM USD.

fallingknife• 2 years ago

Citigroup leaked almost a billion, and it wasn't even fraud. https://www.npr.org/transcripts/1019909860

lightedman• 2 years ago

"There is no way that a reasonably organized company can leak 40 MM USD. "

Oh, please, HP lost some 40 million in inventory while contracted to Solectron Global for repairs, because their inventory systems are utter garbage compared to Dell or Toshiba.

Log_out_• 2 years ago

Cooperate processes are not laws, cooperations are not states, they are thiefdoms and of course the baron gets todo as he wish. Why whenever that illusion of order crumbles away, have this sort of public meltdown just because one is powerless and exposed to be trampled at any moment by random forces? This is just life and this is just part of a medieval peasants existence, towards which all of HN helped culturally steer this ship. Get over it, get on with it..

dartos• 2 years ago

Do you… need a hug?

mp05• 2 years ago

I definitely err on the side of cynicism but jeez, this is pretty out there.

pts_• 2 years ago

Yeah people here acting illogically like denying covid for eg

ecf• 2 years ago

I have no idea how something like this can even happen. In a company of that size it should be actually impossible for a transaction like this to occur without clearly documented processes to ingest, review, authorise and pay transactions.

After having worked IT for various startups I cannot understate just how much executives and other higher ups detest policies that make them verify who they are. It short circuits something with their ego.

ricardobayes• 2 years ago

True, I was closing a real estate deal once with a rich guy and he called his private banker for something. He had a near-meltdown that they asked some kind of verification question from him.

doubloon3• 2 years ago

every process has exceptions. and there is no process stronger than the manager firing an employee for disobeying an order.

cj2• 2 years ago

every process has exceptions

Except these sort of transfers almost always happen with, at a minimum, dual approval where exceptions cannot be made because it's software defining the rule.

1 employee submits the transaction for review, and a 2nd (and sometimes a 3rd, 4th) person must approve it before the payment initiates. There isn't typically a bypass function.

Also, CFOs are typically responsible for setting up and enforcing these controls. A big part of a CFO's job is to manage risk. If you work under a CFO, you would be more likely to be rewarded for following the process than be punished.

Obviously there are exceptions to this, but by and large no CFO would punish a finance person for disobeying an order to bypass a process intended to prevent financial fraud.

mvc5• 2 years ago

I think there's a lot of people here making the wrong assumption about how their CFO would react to being told no.

These people aren't stupid. I'd expect them to understand risk better than your average senior software engineer and if you tell them "Sorry boss, too risky to do that right now. I can't be 100% sure this message is genuine. Let's sync on this after your meeting", your chances of promotion at this company would likely rise, not fall.

mcv2• 2 years ago

Chalk that up as another reason why employers shouldn't be able to fire people too easily.

wjnc2• 2 years ago

At the end of the day even in large firms you only need to fool three or four eyes. Those eyes might get a lot of transactions to process and a certain sense of complacency might occur. The hope is that automatic controls will aid those humans with all kinds of checks, but even billion dollar transactions at the end of the day are human transactions.

wslh• 2 years ago

I have been witness of spreadsheets passed through email, whatsapp, etc from one sector to another to initiate payments. It's all about trust perception. That is one of the weak links.

Solvency• 2 years ago

I don't get it. I work for a biggish company. Every time a user wants to join my Miro team I have to use a maze of ancient purchase order systems like Sage with multiple levels of approvals from our finance team. It's almost outrageously draconian but... not a penny goes by unpinched.

This is astounding levels of incompetence.

yfbx• 2 years ago

Yup and large corp/banker corruption and bribery happens only in netflix movies /s

blibble3• 2 years ago

in financial services everything you can possibly doing for your regular job has an approval chain (often consisting of at least 3 people)

install notepad++ from pre-packaged store? approval needed

change to mailing list you own? approval needed

1 line config change to production alerting system? 8 approvals needed

I can easily imagine people just clicking Approve sometimes without reading

Aurornis• 2 years ago

I feel like I’m missing something from your post. Are you being asked to approve several large financial transactions per hour in your job as a software engineer?

Regardless, approvals for multi-million transfers require a higher level of process and approval.

ponector• 2 years ago

And then you hear stories like that one about french trader Jérôme Kerviel who did unauthorized trades with 5 billion losses.

And many more stories like that.

But yes, for small fish there is an approval process for everything, even to but a paper clip.

seagulls• 2 years ago

In a company of that size it should be actually impossible for a transaction like this to occur without clearly documented processes to ingest, review, authorise and pay transactions.

Oh, my sweet summer child. The larger the organization, the more dysfunctional it becomes.

See How this scammer used phishing emails to steal over $100 million from Google and Facebook

https://www.cnbc.com/2019/03/27/phishing-email-scam-stole-10...

samstave• 2 years ago

The deep-fakers were likely, at least at one point, an internal employee of this firm so that they knew how to pull this off.

RecycledEle• 2 years ago

Having 2 people authorize a $25M USD transaction does seem like a prudent precaution.

micromacrofoot• 2 years ago

billionaires do it all the time with 1 person

stavros• 2 years ago

I like the juxtaposition of this comment and the one before it, saying "if we had to authorize every transaction of a few million, we wouldn't get any other work done".

cesaref2• 2 years ago

I worked at an investment bank which made daily FX transactions to cover trading in world markets to their nostro accounts, and these could easily be in the 10-100 million range on a given day. Transactions like these are not particularly surprising in that context, so processes will be in place to reduce the workload on operations staff, so that they only need to validate exceptional transactions.

If you have 10 business units trading 50 world currencies, checking 500 transactions for FX every day is a total chore hence it would get automated, and only unusually large transactions would be flagged. Rules like <10m goes through automatically would be tuned over time so that the workload on operations team members would add actual value without being onerous on their time.

So, depending on the business we are talking about, a 25m transaction could basically be lost in the noise. Given the mention of the CFO being london based and the operations team being in HK, it sounds like a typical investment bank setup to me.

vincnetas• 2 years ago

but i assume these daily transactions are going to same validates target accounts, that are nnot changing daily. in this case i assume this was a transaction to a random account.

rwmj• 2 years ago

It depends what the multi-party authorisation is trying to protect against. Normally you're trying to protect against insiders stealing money by authorizing a payment on their own. In this case it's quite possible that multiple people inside the company signed off on the transfer and it all happened "by the book".

hinkley3• 2 years ago

Social engineering is substantially about appealing to someone who can do all the steps you cannot perform from outside.

From what I understand of the literature, it’s often several interactions to gather enough information from several employees to learn to sound like you belong there, then using it all against someone with “keys” who escorts you the rest of the way.

hinkley3• 2 years ago

But does that fix the problem or just slow it down a bit?

If you can deepfake one guy with the checkbook, can’t you deepfake the guy with the checkbook and the guy who enters the POs into the system? Lower odds, but far from zero.

anon84873628• 2 years ago

Just like the locks on your door or safe. Doesn't "fix" the problem of theft, but slows them down quite a bit.

IanCal• 2 years ago

This was a case where someone pretended to be other people at the company over video calls. It's not a huge leap for that to happen to multiple employees - if it didn't happen here having multiple people doesn't eliminate this attack.

saiya-jin• 2 years ago

You don't understand current banking as its happening right now, simple as that. Also, you probably didn't read article since it clearly states it was a 'secret' transaction, most probably meaning bypassing all controls put in place.

I mean we still right now live in the world where just a very rough match for signature on a piece of crappy paper is enough to move millions if needed.

saaaaaam2• 2 years ago

Yeah, I do. And yeah, I did.

Maybe it’s because I’m in the EU. Banking here is very different to the US.

Havoc2• 2 years ago

it should be actually impossible

Couple years ago I thought that too...

All the checks you describe - multiple approvers, standing data, callbacks etc - the guys going after big payments like this know these checks are in place, how they work and have a game plan for it.

nickdothutton• 2 years ago

There really ought to be a stronger sign of confirmed identity in business calls. Something cryptographic. Every single day I end up in business calls randomly scattered across teams, WhatsApp, FaceTime, zoom, and a half dozen other systems. Instead we get stupid cartoon avatars and the ability to put a funny backdrop behind us.

DANmode3• 2 years ago

For many of these "attacks", it could be thwarted as simply as opening the messages tab and seeing no prior history.

pavel_lishin4• 2 years ago

I'm not sure if we have good enough systems in place, in terms of UX, for that to work.

Imagine every C-level exec who's opened a top-urgent ticket with IT because their printer doesn't work (they forgot to plug it in/forgot it needs paper/it's not a printer, it's a paper shredder) trying to operate some form of key exchange software securely, while people capable of pulling off this sort of scam are targeting them.

I don't think this is a problem that can be solved with technology.

MichaelZuo4• 2 years ago

This doesn’t sound correct, why can’t it be solved with sufficiently advanced technology i.e. software and devices?

We already have facial verification systems in hundreds of millions of devices that are genuinely very difficult to spoof.

psychlops3• 2 years ago

A 2 of 3 key authorization would have gone a long way to preventing this.

aiisjustanif• 2 years ago

Zoom has MFA, including YubiKey.

physPop• 2 years ago

Then they shouldn't be C-level execs. We should expect more proficiency from people we pay so highly.

favflam• 2 years ago

Is PGP out for this use case?

Doesn't the US military have DoD people plug in their ID badges to read/sign emails through outlook?

mebassett• 2 years ago

I have known two publicly traded companies that fell victim to similar sorts of scams (someone impersonating the cfo or ceo over the phone). One was defrauded out of a seven figure sum, the other got lucky and a bank involved stopped the transaction to verify again. I don't know how the first was able to keep it quiet, I only knew because I chatted with the people in question. I suspect that the deepfake angle makes it easier to admit that they were defrauded in this way.

Talking about how something like this can happen in a big company is fun and all, but the scary thing is is that it is _so much easier_ to do these sorts of scams with deepfakes. Which means they will be deployed against "softer" targets, like you and me, and your parents and grandparents.

jbirer• 2 years ago

Looks like an elaborate embezzling scheme to me.

smeej3• 2 years ago

Why embezzle from one company when you can steal from lots of them?

This is an obvious and natural evolution of the kinds of attacks that have existed for years. It was bound to happen eventually. I think it's just sooner than people expected.

djmips• 2 years ago

My feeling too. I doubt criminals actually have mastered realtime deepfake. It's plausible but on the balance it's more likely a 'plausible' excuse.

mikkom2• 2 years ago

VC usually means venture capital(ist) so the title is very confusing.

redsoundbanner• 2 years ago

what does it mean here?

mikkom2• 2 years ago

Finance worker pays out $25 million after video call with deepfake ‘chief financial officer’

That is the actual title of the linked article.

ooterness• 2 years ago

"Video conference"

marssaxman• 2 years ago

I agree, I read the headline several times over without understanding.

dang2• 2 years ago

Ok, we've taken VC out of the title above.

mattmaroon3• 2 years ago

Just because I am curious, and have not seen any software capable of fooling me in this regard, yet, what would somebody use to do this? Is this an already existing product that can create video representations of people I know so well it would fool me?

sbarre3• 2 years ago

There was a paper linked on here recently (last few months?) that showed off video call deepfaking using gaussian splatting, essentially using a webcam to "puppet" a very convincing 3D recreation of another person's head & shoulders in real-time..

I tried to find the link but my search-fu is not good today it seems..

I did find this, which seems related: https://blog.metaphysic.ai/the-emergence-of-full-body-gaussi...

There's also the fact from the article that this was an employee in Hong Kong on a video call with people supposedly in the UK, so it's also possible they took advantage of bad video quality to do this..

Get on video for the first minute or so, then, as we've all done, say "I'm going to turn off my video so my connection sounds better" etc...

jacquesm5• 2 years ago

This is where those 'security researchers' are helping to make such fraud easier. If you release these tools into the wild you are enabling criminals who by themselves would have no way to create these tools.

geor9e• 2 years ago

I have not seen any software capable of fooling me

That belief is a catch-22, though. By definition, each time one fooled you, you didn't note anything other than a run-of-the-mill normal video. A lot of tiktok accounts lately are dedicated to deepfaking celebrities. For example, if I hadn't already told you and you just casually scrolled by it, would you immediately suspect this isn't Jenna Ortega https://www.tiktok.com/@fake_ortegafan/video/732425793067973... ? I didn't look for the best example, that was just the very first that came up.

Is this an already existing product

Usually cutting edge ML has to be done with a github repo last updated a few days ago using Tensorflow/Pytorch and installing a bazillion dependancies. And then months later you might see it packaged up as a polished product startup website. I've seen this repo a lot https://github.com/chervonij/DFL-Colab

xyst• 2 years ago

Honestly, half the time I am interviewing random contractors around the world. I get a feeling they use OpenAI to answer questions. I have thrown out the typical “leet hacker” bullshit questions and rote memorization type stuff. Gone back to simply quizzing them on their own resume, digging into the finer details of what they did. Can’t deep fake experience, yet.

the_duke• 2 years ago

Yep, Google/openai has become pretty common place in remote interviews.

The funny thing is, I ask them to say say "I don't know" rather than the above, but they still do it...

You can work around it by picking a difficult practical problem from your domain and talking through choices and their different tradeoffs.

welder2• 2 years ago

@dang can you change the title to:

Finance worker pays out $25M after vid call with deepfake CFO

Edit: maybe not zoom

mintplant• 2 years ago

It's most expedient to email hn@ycombinator.com for things like this.

welder2• 2 years ago

Thanks, sent.

jacquesm5• 2 years ago

Where does it say it was Zoom?

switch0073• 2 years ago

Hoover, Walkman, Sellotape, Google, Bandaid, Kleenex…

hinkley3• 2 years ago

Are we going to have to start using code phrases like in the Renaissance and in popular fiction?

Don’t write a check unless you hear me mention aardvark or Mad King Ludwig.

RobRivera• 2 years ago

I literally thought the title meant a Venture Capitalist, not Video Call smh

diebeforei485• 2 years ago

I think "power distance" (a cultural thing - both national culture and corporate culture) might play a role here. In some cultures, you do whatever the big boss asks you to do, regardless of procedure.

(Media reporting suggests this can also be true at some US hardware tech companies).

ladyanita224• 2 years ago

Having worked with Chinese people, let me tell you this is 100% accurate. It may (and probably will) happen in western countries as well, but the culture makes China, South Korea, Taiwan and Japan extremely vulnerable to this. No one I worked with was willing to refute, question or even raise any doubts if someone they perceive not at their level or, even better, below, was in the call.

usrusr8• 2 years ago

Other countries are known for a culture of nothing ever happening without a piece of paper carrying an official-looking stamp. Those are laughably insecure, but the culture could easily be ported to public key signature. "Boss voice is only boss voice when it comes with a digitally signed transcript" shouldn't be too hard to introduce in "don't ever question your boss" cultures I think? Bosses might even enjoy the grandeur of showing off their status with an insignia-device. "Orders without proof of identity are irresponsibly bad form" could be surprisingly easy to establish.

John23832• 2 years ago

Having dated an abnormal amount of mainlanders, One thing that I always found weird was the amount of "rule following". Top down directives that you must do.

I can only imagine this being leveraged nefariously.

robjan• 2 years ago

I don't know, most professionals in HK I have met are pretty open to challenging people but maybe that's just the people I choose to work with.

In any case what I find strange is that usually HK finance companies (like much of the rest of the world) will have some kind of maker-checker system which prevents individual mistakes like this.

robocat• 2 years ago

From the article this was an employee in Hong Kong on a video call with people supposedly in the UK.

Power distance might matter, depending on nationality of participants.

Also if English is a second language, then perhaps the sound quality of the synthetic voices wouldn't need to be as good - we are surely better at recognising voices in our mother tongue.

ctrw3• 2 years ago

Current deep fakes are good enough to fool your mother. I've done it with friends to show what's possible.

ultrasaurus• 2 years ago

Back in my days building custom software (in the US/Canada) a lot of the PM work was figuring out how the process overrides worked. Every organization has a set of formal rules... and the way things actually work (and 50% of my job was making sure our CRUD apps that were more than just spreadsheets with changelogs).

But having lived & worked in a few countries now, the way other cultures do their overrides is always more visible (e.g. Country A you might pay bribes to get out of tickets, country B might just not pull people over in nice cars)

slickrick216• 2 years ago

In some ways the west is still remarkably feudal but to the direct chain of managers not just directly to your “liege lord”. I regularly see people say no to big bosses who are outside the direct management even if they have high ranks.

franze• 2 years ago

In Austria one CFO wired a few millions (7 I think) after a couple of fake emails from her boss - with a note to not mention it to anyone even him.

staunton5• 2 years ago

I guess that says something about how that company was usually run...

__loam2• 2 years ago

This is why a Korean Air flight crashed at some point. The copilot knew something was wrong but the pilot was a lot more senior than him and in Korean culture it's normal to defer to your elders (according to the checklist manifesto). The cockpit recording showed what happened and it directly contributed to efforts to standardize crew resource management training. Other incidents like a flight out of Morocco where an older male pilot disregarded the concerns of his female copilot and crashed the plane have reinforced the need for CRM, especially for pilots from cultures where people may be ignored for social reasons.

throw3827484• 2 years ago

It's funny how when something happens in Asia some commenters always say it's because of the culture.

Sure there might be cultural differences, but maybe this guy is just careless.

There was a case in the US where someone pretended to be a cop, called a fast food restaurant, and actually convinced the manager to strip search an employee.

I guess this is also a case of cultural power distance.

3abiton• 2 years ago

Prison exleriment in business.

brianmcc• 2 years ago

Also applies in medicine/healthcare:

"Silence, power and communication in the operating room" https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3001035/

alexpotato• 2 years ago

This is one reason checklists are so effective in surgeries.

Prior to checklists, nurses would feel hesitant to point out errors by surgeons.

Post checklists, people felt more empowered to say "Doctor, I believe you missed step 5".

(Didn't completely remove the hesitancy but this point was identified explicitly in Atul Gawande's book The Checklist Manifesto)

thih93• 2 years ago

What is the chance that a CFO gets in touch with a deepfake specialist and they split the profits? I’m not saying that this is what happened, I’m more focused on future scenarios.

willcipriano• 2 years ago

I thought the value of these types of people are their people skills.

Nobody would accuse me of great people skills and while I'd like to point to my technical acumen as the reason I can spot fakes like this easily, it's my primate brain that knows something is wrong.

mvc5• 2 years ago

Apparently the victim spotted it as a fake too. And then did what they thought was necessary to confirm the instruction.

thih93• 2 years ago

Just like security specialists can follow a phishing link, I'm sure employees with good people skills can be conned into sharing details with a deepfake colleague.

Social engineering works because people think they could spot it.

thih93• 2 years ago

Or even better: have CEO & COO hold a secret emergency meeting with the CFO; after the money transfer the CEO & COO deny everything, claim they weren't there and were deepfaked.

coding123• 2 years ago

Wouldn't only a CFO have the ability to move 25MM

evanjrowley• 2 years ago

A Boston-based finance worker also sent $6M to scammers back in 2023. Surely some social engineering was involved, but nothing about deepfake was mentioned: https://apnews.com/article/technology-boston-law-enforcement...

Deepfake was used in the 2023 MGM casino breach to convince tech support staff to do things that compromised their MFA

Now we're seeing a combination of these for significantly higher gains.

newhotelowner3• 2 years ago

A lot of upper midscale hotels in the USA are owned by Indians from India whose last name is Patel.

Pretty much every single hotel gets a call from Mr. Patel at night asking to wire money due to an emergency. A lot of hotel employees fell for it and wire money. These employees even drill open the safe. Some even wire money from their personal account.

This scam is mostly social engineering without any AI/Deepfake. It's going to be a fun time ahead for everyone.

swyx• 2 years ago

the patel motel cartel! https://www.nytimes.com/1999/07/04/magazine/a-patel-motel-ca...

BlueTemplar2• 2 years ago

Heh, reminds me a bit of how a South Korean cult is behind Sushi becoming popular...

analog31• 2 years ago

Odd coincidence: 25 years ago a friend of mine, who was a machinist, told me that his ultimate career goal was to own a motel. His name: Patel.

He explained the whole thing to me.

skybrian2• 2 years ago

I'm confused about what you're saying. This is a hypothetical scenario?

__loam2• 2 years ago

No he's saying this happened to actual employees.

newhotelowner3• 2 years ago

Nope. Real examples. I don't think there is any upper mid scale hotel that haven't received this calls. If you follow hotel industry groups, you will see this happening every week. This and IT support calls.

delfinom• 2 years ago

Lol.

My engineering manager fell for the CEO gift card scam.

Except the kicker is the CEO has asked him to actually do the same thing before for real hahaha

chrsig• 2 years ago

So you're saying he fell for it twice...What did you say his contact info was again? :D

bengalister• 2 years ago

In France there had been cases of employees wiring money convinced that they were talking to their CEO/CFO/lawyers over the phone. Many cases were due to a Franco-Israeli gang arrested in 2022/2023 that managed to make at least 38M Euros out of it. They impersonated CEOs without the help of deepfake AI. See https://www.europol.europa.eu/media-press/newsroom/news/fran...

acjohnson55• 2 years ago

There is an entertaining podcast series on this called Persona:https://podcasts.apple.com/gb/podcast/persona-the-french-dec...

cozzyd• 2 years ago

Speaking of personas and apple ... I bet apple vision personas make attacks like this a lot easier if anybody ever uses them.

CaffeinatedDev• 2 years ago

War using AI begins :O

DoodahMan• 2 years ago

i reckon we're going to see this used for pump & dumps too at some point, ala a deepfake of some big pharma exec talking about acquiring some small biotech.

noobermin2• 2 years ago

Many comments are saying how finance companies should do more authentication for large transfers and the common response for that is a few million transferred is routine in that field and authentication of transactions the size of the onr quoted in the article would be impractical. The response to that then is if 25M doesn't matter enough to verify in some way then companies shouldn't cry when it's stolen. Then losing a few million here and there which apparently isn't worth authenticating the transfer of is just the cost of business. It's either worth the extra controls or it's like snacks in the rec room, not worth worrying about.

TacticalCoder• 2 years ago

It's also usually just one more call to get the stolen assets frozen. If it's already "gone", it's not really "gone" and can be clawed back.

Such headlines are usually followed, a few weeks later by an headline reading not unlike this:

"Three indicted in scheme involving deep-fake to steal $25m".

hnta2023• 2 years ago

i'm not sure which i think is more likely:

1) a multiperson zoom of deep fakes fooled the worker 2) the worker was in on it as an inside man and the deep fake story is cover

pvaldes• 2 years ago

This opens also the possibility to steal money and then pretend that you were fooled by AI impersonating your boss to give you orders that you can't refuse. Sending fake videos of your boss to yourself. Create a smog curtain and give the police a digital hare to chase that does not exist. Wow. Looks like the plot of a new Netflix series.

cube00• 2 years ago

The old adage "follow the money" still holds, you'll be forever monitored until it shows up. It's even easier in the digital world where they don't need to park a pizza van outside your house.

mvc5• 2 years ago

I think there would be a good chance of getting caught if you did that. The police would be involved at this point and would definitely consider that as something to investigate before concluding the case.

mikeyouse• 2 years ago

It's all about knowing the limits.. most theft like this isn't really reported / investigated by the police. Companies lose money in stupid scams and thefts all the time, it's usually just written off. $25M would obviously be investigated but $25k?

Finance worker pays out $25M after video call call with deepfake CFO

Related Stories