WiseTech Global CEO Richard White reported that unknown actors used AI-generated deepfake videos to impersonate him in WhatsApp calls to staff members, attempting to solicit money. The employees identified the fraud immediately and the attempts were unsuccessful. White shared this experience at an Australian Shareholders’ Association conference to highlight the security threats posed by AI.
WiseTech Global's CEO, Richard White, was targeted in multiple deepfake scam attempts where unknown actors used AI to create videos of him requesting money from staff members via WhatsApp. These repeated attempts were identified by the employees, who realized they were not speaking to the real CEO.
Risk classification
- Primary risk domain: 4 Malicious actors
- Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation
The incident involved malicious actors using AI-generated deepfake videos of the CEO to impersonate him in order to scam staff members into giving them money.
Causal factors
- Entity: Human
- Intent: Intentional
- Timing: Post-deployment
The incident was initiated by human malicious actors who intentionally used deployed deepfake technology to attempt financial fraud.
EU AI Act risk tier
- Risk tier: 3 Limited Risk
Risk Level 3. Limited Risk: The incident involves 'AI-generated content such as deepfakes', which falls under Limited Risk due to transparency and disclosure requirements.
AI system and alleged parties
- AI system: None named
- AI purpose: Deepfake Video Generation; Voice Generation
- Behaviour type: Tool
- Alleged developer: Unknown deepfake creators
- Alleged deployer: Unknown scammers, Unknown deepfake creators
- Alleged harmed parties: WiseTech Global, Richard White
Harm severity
Severity ratings are based on this scale.
Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.
- Physical: direct Negligible, indirect Negligible
- Infrastructure: direct Negligible, indirect Negligible
- Property: direct Negligible, indirect Negligible
- Financial: direct Negligible, indirect Negligible
- Environmental: direct Negligible, indirect Negligible
- Malicious content: direct Negligible, indirect Negligible
- Differential treatment: direct Negligible, indirect Negligible
- Civil rights: direct Negligible, indirect Negligible
- Democracy: direct Negligible, indirect Negligible
- Privacy: direct Negligible, indirect Negligible
- Psychological: direct Negligible, indirect Negligible
- Epistemic: direct Negligible, indirect Negligible
- Child sexual exploitation and abuse: direct Negligible, indirect Negligible
People affected
- Occurrences reported: 1
- People reportedly exposed: 4
Potential causes
Management
- Public Promotion of AI Avatars: Management created and shared AI avatars of company leaders.
Technology
- Convincing Deepfake Technology: AI video generation allows highly realistic impersonation of executives.
- Unsecured External Channels: WhatsApp allows external attackers to directly call staff members.
Data Inputs
- Publicly Available Avatars: Company created AI avatars of executives for public presentations.
Human Factors
- Targeting of Individual Staff: Attackers exploited individual staff members via social engineering.
Process and Methods
- Ad-hoc Verification Process: Staff relied on informal Teams messages to verify executive identity.
Information quality
- Classification confidence: High
- Reason for confidence: The report clearly outlines the nature of the incident, the targets, the method (WhatsApp video deepfakes), and the outcome (no financial loss). There is little ambiguity about what transpired.
- Ambiguities identified: The specific AI tools or platforms used to generate the deepfakes are not identified.
Unknown malicious actors used real-time AI deepfake video calls to impersonate the CEO of WiseTech Global in an attempt to defraud employees. The attempt was unsuccessful due to vigilant staff, resulting in zero financial loss. The incident demonstrates the evolving threat of AI-enabled social engineering targeting corporate leadership, but carries minimal national security implications.
- Overall national security impact: Minor
- Scope: Single nation
- Primary target: Australia
- Alleged perpetrator: Unknown
Threat characteristics
- Imminence: Long-term. The specific incident is resolved with no ongoing threat, though it reflects a broader, long-term trend of AI-enabled social engineering.
- Autonomy: Human-controlled. The deepfake technology was used strictly as a tool by human malicious actors to conduct the calls, with no autonomous decision-making by the AI.
- Novelty: Evolved capability. Represents an evolved capability where deepfakes are used in real-time video calls rather than just static media or audio.
Impact by dimension
- Physical security: Negligible. No physical systems, critical infrastructure, or human safety elements were targeted or affected in this corporate fraud attempt.
- Information security: Negligible. The deepfake targeted a corporate executive for financial fraud, not government leadership, public institutions, or national intelligence capabilities.
- Sovereignty: Negligible. The incident was entirely confined to a private commercial entity and did not impact government operations, elections, or state sovereignty.
- Economic security: Minor. While targeting a major logistics software firm, the failed fraud attempt resulted in zero financial loss and no compromise of strategic technology or systems.
- Societal stability: Negligible. The event was a localized, unsuccessful corporate phishing attempt with no broader societal impact or human rights implications.
.avif){kind=small}