The Hong Kong case reported in February is now four months old, and most finance functions have discussed it at a management meeting and changed nothing. A finance employee at the local office of a large engineering group received an instruction about a confidential transaction, was suspicious of it, and did what every training programme has taught for a decade: escalated to a video call. On that call were the group's chief financial officer and several recognisable colleagues. The employee then executed fifteen transfers to five accounts, totalling around two hundred million Hong Kong dollars — roughly twenty-five million in dollar terms. Every person on the call was synthetic. That detail is what makes this case worth a policy change rather than a briefing note.
The deepfake was not the vulnerability. The vulnerability was a payment process that accepted a conversation as authorisation
The employee followed the policy. The policy was wrong.
It defeated the control that was working
For twenty years the standard answer to a suspicious payment instruction has been to verify with a human. Pick up the phone, get on a call, look them in the eye. That advice was sound because impersonating a known colleague in real time was genuinely difficult. That difficulty has gone. Face, voice, manner and idiom are all reproducible with material that most executives have published themselves, and the quality required is not perfect — it is merely good enough for a compressed video call on an unfamiliar platform where the audio is slightly off because the audio is always slightly off. So the escalation path became the attack path. Worse, it became the attack path that carries institutional endorsement, which is why the employee had no reason to hesitate after the call and every reason to proceed.
The whole class of control that has expired
Any control whose strength depends on recognising a person through a channel the attacker chose is now unreliable. That includes voice recognition on a phone call, visual recognition on a video call, and the softer version — "it sounded like him, he used the nickname he always uses". The common failure is not gullibility. It is that none of those channels authenticate anything. The recognition is real; the identity behind it is unverified.
What actually holds
Five controls, none of them technical, all of them testable. Out-of-band callback to a pre-registered number. Not a number supplied in the request, not a number in the meeting invitation, not a mobile number that appeared in a signature block last week. A number already held in a verified directory. Dual authorisation on new and changed beneficiaries, performed by someone other than the requester, with the second approver contacting the counterparty independently. A cooling-off period on beneficiary changes — even twenty-four hours destroys the urgency the entire scheme depends on. Channel limits. A payment above a threshold cannot be initiated from an instruction received by email, chat or call, regardless of who appears to send it. It must originate from an approved obligation in the system. A no-blame stop right, named and written down, so any employee can pause any payment pending verification and be thanked rather than questioned.
Authorise from the record, not from the conversation
That is the design principle worth extracting from this case. A payment should be executable because there is a verified beneficiary, an approved purchase obligation or contract, and an authorisation within a documented delegation. It should not be executable because someone with apparent authority asked convincingly. A process built that way does not need anyone to detect a deepfake. It fails safe when detection fails, which is the only assumption about detection that has aged well.
Seniority is the attack surface
The uncomfortable part is that the control works only if it applies most strictly to the people least accustomed to being challenged. Every organisation's verification process is strongest against a junior stranger and weakest against the chief executive in a hurry. The fix is not a procedure, it is a sentence from the top: my instruction is subject to the same callback as anyone else's, and I will not treat the delay as an inconvenience. Without that sentence, written and circulated, the process has an exception the size of the executive team.
Three things to do this quarter
Run a ninety-minute tabletop in which the scenario is a convincing video call from the chief financial officer, and see how far it gets. Ask three people in accounts payable, without warning, what number they would call to verify — the answers will be instructive. And audit every new or changed beneficiary in the last twelve months against evidence of independent verification.
Practical Guidance for Verification Controls Review
- Verify payment instructions out of band to a pre-registered number only.
- Never accept a contact detail supplied in the request itself.
- Require dual authorisation on beneficiary changes, independent of the requester.
- Impose a cooling-off period on new beneficiary activation.
- Set channel limits so high-value payments cannot originate from a message.
- Publish a no-blame stop right with a named escalation contact.
- Have the chief executive endorse the callback rule for their own instructions.
- Tabletop a synthetic video call and audit beneficiary changes annually.
The Regional Angle
The first and largest local problem is decision culture. A great many groups in this region are owner-led, and an instruction from the chairman's office genuinely does override process — not through poor governance but because that is how the business was built and how it moves quickly. This attack monetises exactly that culture: the more real the deference to a senior instruction, the less friction the fraud encounters, and the employee who pauses a principal's payment for verification is taking a career risk that no written procedure fully removes. The control therefore cannot be implemented by finance. It has to be issued by the principal, in their own words, stating that instructions bearing their name require callback verification and that anyone who enforces it has their backing. That memo is worth more than any tool on the market, and in its absence every other control in this article has a documented exception. The second is the recall window, which is shorter here than most treasury teams assume. Funds in these cases move through several accounts in multiple jurisdictions within hours, and the practical chance of recovery falls away almost immediately. The regional complication is calendar friction: working weeks differ across Gulf markets, correspondent and beneficiary banks operate on a Monday-to-Friday week, and an instruction executed late on a Thursday afternoon locally may have no human recall path anywhere in the chain until the following Monday. Two practical responses. Know, in advance and in writing, your bank's fraud recall contact and its out-of-hours procedure — not the branch relationship manager, the recall desk. And schedule high-value payment runs early in the week rather than at the end of it, which costs nothing and can be the difference between a recall and a loss. The third is the structure of regional finance teams, which is unusually exposed. The typical arrangement has a group finance function in one country, entity accountants in others, and authorisers who have often never met the people executing their instructions in person. Interaction is entirely by video and message, so there is no baseline of in-person familiarity against which a synthetic version looks wrong, and a slightly unusual manner is easily attributed to a poor connection. Where an authoriser sits outside the team that executes, register their verification details deliberately: a callback number held in the directory, a named alternate, and ideally a pre-agreed challenge that is not discoverable from any published material. Multi-entity groups should maintain that roster per entity and review it whenever a signatory changes, because the gap between a signatory list and a verification list is where this fraud lives.
The objection worth taking seriously
The strongest objection is that this is a technology problem with a technology answer arriving shortly. Liveness detection, provenance signalling on media, and platform-level authenticity indicators are all under active development, and within a few years a video call may carry a reliable assertion about who is actually on it. Building heavy manual process now, the argument runs, is over-correcting to a window that will close. Detection will improve, and organisations should adopt authenticity signals as platforms ship them. But there are two reasons not to wait. The first is that detection is an adversarial contest whose current state you cannot audit: you are being asked to place a payment control on a capability whose false-negative rate against next month's generation is unknown and unknowable, and which no auditor can test. The second is that the process controls are worth having regardless of deepfakes. Out-of-band verification, independent beneficiary approval and a cooling-off period defeat ordinary invoice fraud, compromised-mailbox fraud and internal collusion just as effectively, and those remain far more common than synthetic video. They cost some friction and no capital. The honest conclusion is that detection is a useful future addition to a control that must work without it, because the case in Hong Kong involved an employee who was already suspicious, already escalated, and was defeated by the verification step itself.
Common Questions
Would a detection tool have prevented this?
Possibly, and possibly not — and nobody could have known which in advance. The process fix works whether or not the detection does.
Is a phone callback enough, given voice cloning?
A callback to a number you already held is meaningful, because it verifies the channel rather than the voice. A callback to a number provided in the request verifies nothing.
Should executives reduce their public video presence?
Marginally helpful and not a strategy. Enough material already exists for anyone with a conference appearance or a published interview.
What should we expect over the next twelve months?
Expect these attacks to move down-market, because the tooling cost has collapsed and mid-sized companies have weaker payment controls than large groups. Expect the first regulatory expectations around verification of payment instructions to appear in financial sector guidance. Expect insurers to begin asking specifically about out-of-band verification at renewal. And expect at least one well-publicised case where the impersonated party is a supplier rather than an executive, which is a harder problem because the relationship is thinner and the callback list rarely exists.
Verification Controls Review — we rebuild payment authorisation so it comes from the record rather than the conversation, and test it against a convincing fake.