Purported Deepfake Impersonation of Starmangalsutra Director Reportedly Led to ₹10.70 Crore (Approximately US$1.11 Million) in Unauthorized Fund Transfers

Starmangalsutra Private Limited, a jewelery-manufacturing subsidiary of India-based Sky Gold and Diamonds, reportedly lost ₹10.70 crore (about US$1.1 million) after unknown actors compromised a company-issued phone and laptop and used purported deepfake methods to impersonate a director. An employee, reportedly believing the instructions were genuine, transferred funds to unknown bank accounts before verification showed the director had issued no such instructions.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involved the targeted impersonation of a company director using deepfakes to execute a fraudulent financial scam.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by human malicious actors who intentionally used deepfake tools to defraud the company.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system involves AI-generated content such as deepfakes, which under the EU AI Act are subject to transparency obligations to ensure users are aware they are interacting with AI-generated media.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Video Generation; Voice Generation
• Behaviour type: Tool
• Alleged developer: Synthetic video generation technology developers, Synthetic media generation technology developers, Synthetic audio generation technology developers, Deepfake technology developers
• Alleged deployer: Synthetic media creators, Scammers in India, Scammers, Deepfake creators
• Alleged harmed parties: Victims of deepfake-enabled fraud, Unnamed employee of Starmangalsutra, Unnamed director of Starmangalsutra, Targets of scams, Targets of scammers in India, Starmangalsutra, Sky Gold and Diamonds, Privacy, Epistemic integrity

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Substantial, indirect Substantial
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The report explicitly describes a financial loss of approximately Rs 10.70 crore suffered by the subsidiary Starmangalsutra Private Limited.

Directly caused: The direct financial loss from the unauthorized fund transfers was approximately Rs 10.70 crore.

Indirectly caused: The parent company's share price declined by 3% on the BSE following the disclosure of the fraud.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Technology

• Deepfake Profile Cloning: Impersonation of a director using advanced deepfake cloning techniques.
• Device Compromise: Unauthorized access to a company-issued mobile phone and laptop.

Human Factors

• Employee Deception: Employee believed the deepfake instructions and processed transfers.

Process and Methods

• Inadequate Verification: No secondary verification of the director's transfer instructions.

Information quality

• Classification confidence: High
• Reason for confidence: The report clearly outlines the nature of the incident, the financial loss, the method of deception (deepfakes), and the impact on the company. There is little ambiguity regarding the primary domain (fraud) or the causal factors.
• Ambiguities identified: The specific deepfake modality (voice, video, or just profile picture/cloning) is not fully detailed, referred to generally as 'advanced deepfake techniques, including profile cloning and coercion'.

Malicious actors utilized advanced deepfake techniques to impersonate a company director, defrauding a subsidiary of an Indian conglomerate of Rs 10.70 crore. While causing localized financial and reputational damage, the incident constitutes a cybercrime event with minor implications for broader national security, highlighting the evolving threat of AI-enabled corporate social engineering.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: India
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The immediate incident is resolved, but the underlying threat of deepfake-enabled financial fraud represents an ongoing strategic concern for corporate cybersecurity.
• Autonomy: Human-controlled. The AI deepfake tools were directly controlled and utilized by human malicious actors to execute the fraud, with no autonomous decision-making by the AI.
• Novelty: Evolved capability. Deepfake financial scams have occurred previously, but the use of advanced profile cloning and multi-device access represents an evolved capability in cyber fraud execution.

Impact by dimension

• Physical security: Negligible. No physical systems, infrastructure, or human safety was threatened during this financial fraud incident.
• Information security: Minor. The incident involved targeted deepfake impersonation of corporate leadership, but was limited to financial fraud rather than systematic information warfare or intelligence compromise.
• Sovereignty: Negligible. No government functions, electoral systems, or state sovereignty processes were affected by this corporate incident.
• Economic security: Minor. While the fraud resulted in a financial loss of Rs 10.70 crore and a 3% stock decline for the parent company, it represents a localized corporate loss rather than a systemic threat to national economic stability.
• Societal stability: Negligible. The incident was a targeted corporate fraud with no implications for societal stability, civil liberties, or human rights.