AI Risk Wire

Cases › other › LR-2026-0755

Video call with fake participants led to $25 million transfer

Preliminary Why: Publisher not yet named · subject to change

Status: action reported, no fix

Severity moderate
Reported 4 Sep 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity moderate: Test: data or systems of others touched with a bounded scope stated. Fact: the scope stated is 15 transfers into five local bank accounts; the source states the total as roughly US$25.6 million.

A finance worker in Hong Kong received a message claiming to come from his company's chief financial officer asking for money for a confidential transaction. His first reaction was suspicion, but he then joined a video call in which the chief financial officer and colleagues appeared. The source states that every other participant on the call was fake, with faces recreated from existing footage and voices imitated. The employee authorized 15 transfers into five local bank accounts, totalling HK$200 million, roughly US$25.6 million. He discovered the fraud only after following up with headquarters. The sources describe no AI agent and do not give the transfer dates or the company's name.

What happened

1 · What went wrongThe video call included other participants who were not real, with faces and voices reproduced.
2 · What it reached or didThe employee authorized 15 transfers into five local bank accounts.
3 · How it was caughtThe fraud was discovered only after the employee followed up with headquarters.

What was done

The total transferred was HK$200 million, roughly US$25.6 million, as stated in the source.

Risks

Not yet sorted into a risk

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Evidence

No source states: what the AI was doing, when it happened, when it was found, how many records were exposed, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 3 items from the primary sources

What happened, in order

Not dated in the sources:

  • The employee received a message claiming to be from the chief financial officer requesting money for a confidential transaction.
  • The employee authorized 15 transfers into five local bank accounts.
  • The employee discovered the fraud after following up with headquarters.
Show every field, with its source and grade

What happened

Earliest source we hold
2026-09-04
D inferred by us from the described behaviour, reason shown
Who caught it
the victim
C one secondary source states it
What went wrong
other
D inferred by us from the described behaviour, reason shown

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Why this severity
Test: data or systems of others touched with a bounded scope stated. Fact: the scope stated is 15 transfers into five local bank accounts; the source states the total as roughly US$25.6 million.
D inferred by us from the described behaviour, reason shown

Notes on gaps

The source is contributor content promoting the Vertus product; its product claims are not used. No remediation by the affected company is stated. The USD figure is the source's own approximate conversion of HK$200 million, recorded as stated.

LR-2026-0755 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON