This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Cybercriminals attempted to defraud DNB Bank's Singapore office by using deepfake video and audio to impersonate the bank's CEO and CFO during a live Microsoft Teams meeting. The attackers requested a multi-million dollar wire transfer, but bank employees identified the fraud and avoided financial loss. DNB security officials noted that the deepfakes were created using publicly available footage and highlighted the increasing accessibility of such tools for criminal activity.
Unknown cybercriminals reportedly used purported deepfakes to impersonate DNB Bank's CFO and CEO during a live Microsoft Teams meeting, instructing employees at the bank's Singapore office to transfer millions of Singapore dollars. The video and voice were allegedly cloned from public footage and appeared convincing. DNB identified the attempt as a "CEO fraud" and avoided losses, calling it their first encounter with a live deepfake meeting.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
The incident involves cybercriminals using deepfake technology to impersonate bank executives in a live meeting to execute a targeted CEO fraud scam.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by human malicious actors who intentionally deployed deepfake technology post-deployment to execute a financial scam.
Cybercriminals targeted DNB Bank's Singapore branch using real-time deepfake video and audio of the CEO and CFO during a live Microsoft Teams meeting to solicit a multi-million dollar transfer. The attempt was detected and blocked by bank staff, resulting in zero financial loss. This incident demonstrates an evolved capability in AI-enabled financial fraud.
The deepfake generation software acted as a Tool, generating synthetic video and audio based on existing public recordings of the executives to be played back during the meeting.
Risk Level 3: Limited Risk. The report describes the use of deepfakes, which are AI-generated content subject to transparency obligations under the EU AI Act.
The AI system was used to generate a synthetic video of the CFO and clone her voice to impersonate her in a live meeting.
The report is highly detailed, coming directly from DNB executives and security personnel who experienced and analyzed the attack. The sequence of events, the detection method, and the lack of financial loss are clearly documented.
None. The event is clearly a targeted CEO fraud attempt using synthetic media.
Technology
Accessible Deepfake Tools
Cheap or free AI tools allow creators to synthesize realistic media easily.
Live Stream Deepfake Injection
Attackers successfully fed real-time deepfake feeds into a Teams meeting.
Data Inputs
Publicly Available Media
Public executive video and audio recordings were harvested to train the AI.
Human Factors
Overreliance on Visual Cues
Observers initially trusted the meeting due to familiar faces and voices.
Process and Methods
No Meeting Verification Protocol
There was no official process to verify the identity of video call hosts.
Out-of-Band Communication
Initial contact via WhatsApp bypassed secure corporate communication channels.
Management
Active Monitoring Decision
Security chose to proceed with the suspicious call to study attacker methods.
Regulatory Environment
Unregulated Generative AI
Lack of strict regulatory oversight on the creation of deepfake software.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
