This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Malicious actors used advanced deepfake techniques to impersonate a company director and trick an employee into transferring Rs 10.70 crore from a subsidiary of [PERSON_001].
Starmangalsutra Private Limited, a jewelery-manufacturing subsidiary of India-based Sky Gold and Diamonds, reportedly lost ₹10.70 crore (about US$1.1 million) after unknown actors compromised a company-issued phone and laptop and used purported deepfake methods to impersonate a director. An employee, reportedly believing the instructions were genuine, transferred funds to unknown bank accounts before verification showed the director had issued no such instructions.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
The incident involved the targeted impersonation of a company director using deepfakes to execute a fraudulent financial scam.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by human malicious actors who intentionally used deepfake tools to defraud the company.
Added categories peak at 2: Minor (Psychological Harm, Inferred)
Malicious actors utilized advanced deepfake techniques to impersonate a company director, defrauding a subsidiary of an Indian conglomerate of Rs 10.70 crore. While causing localized financial and reputational damage, the incident constitutes a cybercrime event with minor implications for broader national security, highlighting the evolving threat of AI-enabled corporate social engineering.
The AI system (deepfake generator) was used as a tool by unauthorized individuals to clone a director's profile and impersonate them. It performed a specific function of generating synthetic media based on direct inputs without autonomous planning or decision-making.
Limited Risk: The system involves AI-generated content such as deepfakes, which under the EU AI Act are subject to transparency obligations to ensure users are aware they are interacting with AI-generated media.
The incident involved the use of advanced deepfake techniques and profile cloning to impersonate a company director.
The report clearly outlines the nature of the incident, the financial loss, the method of deception (deepfakes), and the impact on the company. There is little ambiguity regarding the primary domain (fraud) or the causal factors.
None
Technology
Deepfake Profile Cloning
Impersonation of a director using advanced deepfake cloning techniques.
Device Compromise
Unauthorized access to a company-issued mobile phone and laptop.
Human Factors
Employee Deception
Employee believed the deepfake instructions and processed transfers.
Process and Methods
Inadequate Verification
No secondary verification of the director's transfer instructions.
AI system involved
An AI system was involved, but the reports do not identify it.
Identified by automated extraction; can differ from the alleged developers above.
