The material that makes an impersonation convincing was never stolen from you. Most of it was published: your posts, your interviews, your voice on a recorded webinar, your executives on a conference panel. Combined with an ordinary leaked staff list, that is enough to place a persuasive, personalized call to whoever moves your money.
Documented impersonation cases show why a familiar face or voice should not authorize a payment by itself. These examples illustrate the mechanism; they do not establish how often it occurs.
February 2024 · Hong Kong
The video call that wasn’t
Hong Kong Police later summarized a 2024 prerecorded-video-conference deepfake fraud causing approximately HK$240 million in losses. That summary is the primary record, and it is deliberately spare.
Secondary reporting identified the victim as the engineering firm Arup and reported fifteen transfers involving apparent colleagues, including its chief financial officer, with the synthetic participants said to have been built from publicly available footage. The case was disclosed in February 2024 and Arup confirmed it was the victim that May. We keep the two layers apart on purpose: the loss figure comes from the police summary, the employer and transfer detail from reporting.
⚠ police summary confirms the fraud and the loss; the rest is reporting
The FBI’s Internet Crime Complaint Center issued a public service announcement on criminals using generative AI to commit financial fraud at scale. Among the described techniques: generating short audio clips of a loved one’s voice to impersonate a relative in a crisis and demand money, and generating video for real-time chats posing as company executives or authority figures.
The PSA’s framing is worth repeating plainly: AI does not invent these scams. It reduces the effort, the language errors and some of the tells that used to expose these scams.
Arup said its own systems were not compromised. Public reporting attributes the loss to synthetic impersonation, though it does not establish that no credential or technical compromise occurred anywhere in the preparation chain. What is clear is that the employee did what a careful person does: he was suspicious of the first email, so he asked for a video call to confirm it. The attackers turned a familiar verification step into part of the attack.
The practical lesson is to verify a payment request through a known, independent channel. Technical detection may help, but it should not be the only control. Use the callback procedure in part one of this series.
Know which kind of harm needs which response.
For a fraudulent payment, contact the financial institution promptly and preserve the transaction details. For a threat or non-consensual intimate image, use the platform's reporting process and seek appropriate support. Immediate danger requires emergency help.
Puerto Rico's right-of-image statute addresses unauthorized commercial use of an identifiable person's likeness, subject to consent and statutory exceptions. That is a different issue from whether a payment can be reversed. Do not assume a potential legal claim will recover funds.
Non-consensual intimate imagery has separate legal and reporting routes. The federal TAKE IT DOWN Act places a 48-hour removal duty on covered platforms after a valid request, including known identical copies. Follow the actual request requirements; this does not guarantee removal from every service.
