Scammers Reportedly Using Deepfake Video Calls to Impersonate Executives in Singapore and Orchestrate Corporate Bank Transfers

Scammers in Singapore are reportedly using AI-generated deepfake video calls to impersonate corporate executives. The calls seek to deceive employees into authorizing fraudulent bank transfers. Usually, it is reported, victims will receive WhatsApp messages inviting them to Zoom meetings. During the calls, the scammers are disguised as senior leaders and will instruct the employees to transfer company funds for fake business transactions and to disclose personal data.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The scammers used AI-generated deepfakes to impersonate executives and target specific corporate employees for financial fraud and personal data theft.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The scammers successfully manipulated victims into disclosing highly sensitive personal information, specifically NRIC and passport details.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by human scammers intentionally deploying deepfake technology post-deployment to deceive employees and steal corporate funds.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3: Limited Risk. The incident involves 'AI-generated content such as deepfakes', which falls under Limited Risk and is subject to transparency obligations under the EU AI Act.

AI system and alleged parties

• AI system: unspecified
• AI purpose: Deepfake Video Generation; Voice Generation
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: Unknown scammers, Scammers impersonating Singaporean executives
• Alleged harmed parties: General public of Singapore, Executives in Singapore, Employees in Singapore, Companies in Singapore

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Minor, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: Yes, the report explicitly describes substantial financial losses from corporate bank accounts, though specific figures are not disclosed.

Directly caused: Victims transferred substantial amounts of funds from corporate bank accounts to scammer-controlled accounts under the guise of business payments.

Inferred additional harm: Given that corporate business payment scams typically involve high-value transactions, the total financial loss across affected Singaporean businesses is likely in the hundreds of thousands or millions of dollars.

Privacy

Reported: Yes, the report explicitly states that some victims were asked to disclose personal information such as NRIC and passport details.

Directly caused: Victims disclosed highly sensitive personally identifiable information, including NRIC and passport details, to the impersonators during the fraudulent video calls.

Inferred additional harm: The stolen NRIC and passport details are highly likely to be used for subsequent identity theft, unauthorized account creation, or sold on the dark web, affecting the long-term privacy of the victims.

Epistemic

Reported: Yes, the report describes the fabrication of live video and audio to mislead victims into believing they were interacting with real executives.

Directly caused: Scammers used deepfake video calls to fabricate the presence and authorization of senior executives and MAS officials, misleading employees into executing unauthorized transactions.

People affected

• Occurrences reported: 1
• People reportedly harmed: 2
• People reportedly exposed: 5

Potential causes

Management

• Lack of Verification Protocols: Management failed to establish protocols to verify executive instructions.
• Inadequate Employee Training: Management did not train staff to check for manipulated audio or video.

Technology

• AI Digital Manipulation: Scammers used AI to alter appearances and impersonate executives.
• Lack of Deepfake Detection: Zoom and messaging platforms lacked tools to detect manipulated video.

Data Inputs

• Impersonated Identity Data: Scammers used executive identities to craft convincing video feeds.

Human Factors

• Cognitive Bias and Trust: Victims trusted the visual representation of their high-ranking executives.
• Lack of Employee Awareness: Employees failed to recognize tell-tale signs of AI video manipulation.

Process and Methods

• Absent Verification Protocols: No processes existed to verify the authenticity of video call participants.
• Insecure Communication Channels: Unsolicited WhatsApp messages were used to initiate corporate Zoom calls.

Information quality

• Classification confidence: High
• Reason for confidence: The report clearly outlines the attack vector (WhatsApp to Zoom deepfake calls), the impersonated entities (executives, MAS officials), and the outcomes (financial transfers, PII disclosure). While specific financial amounts and the exact deepfake software are not named, the nature of the AI safety incident is unambiguous.
• Ambiguities identified: The specific AI software or platform used to generate the deepfakes is not identified, and the exact number of affected businesses and total financial losses are not specified.
• Alternative interpretations: None. This is a classic deepfake-enabled business email compromise (BEC) / CEO fraud style incident.

Scammers in Singapore utilized real-time AI deepfakes to impersonate corporate executives and Monetary Authority of Singapore (MAS) officials during live video calls, executing financial fraud and harvesting sensitive personal data. While demonstrating an evolved cyber-threat capability, the incident remains a localized criminal matter with minor national security implications.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Singapore
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic and capability concern regarding AI-enabled cyber fraud rather than an active, immediate national security crisis.
• Autonomy: Human-controlled. The AI system functioned strictly as a real-time tool controlled by human operators to alter their appearance and voice.
• Novelty: Evolved capability. Significantly advances traditional business email compromise and phishing by utilizing real-time, interactive video and audio deepfakes.

Impact by dimension

• Physical security: Negligible. The incident is entirely digital and financial, with no impact on physical infrastructure, kinetic operations, or human safety.
• Information security: Minor. Use of real-time deepfakes to impersonate corporate and regulatory officials represents a sophisticated disinformation tool, but was localized to financial fraud rather than state-level intelligence compromise.
• Sovereignty: Minor. Impersonation of Monetary Authority of Singapore (MAS) officials targeted regulatory trust, but did not disrupt core sovereign operations or government decision-making.
• Economic security: Minor. Resulted in corporate financial losses and potential exposure of sensitive business data, but is manageable through standard law enforcement and financial regulatory procedures.
• Societal stability: Minor. Theft of highly sensitive personal data (NRIC and passports) poses identity theft risks to individuals, but does not threaten broader social cohesion or human rights.