"I Talked to My CEO on the Phone. It Wasn't Him."
In early 2024, a finance employee at a Hong Kong branch of a multinational company got a message that looked like it came from his UK-based CFO, asking about a confidential transaction. He was suspicious — it read like phishing. So the company did the thing every fraud-prevention training tells you to do: they got on a video call to confirm it was really him.
The CFO was on the call. So was the CFO's usual conference of colleagues, the same people the employee had worked alongside for years — faces he recognized, voices that sounded right. He made 15 transfers totaling about $25.6 million. Every single person on that call, other than the employee, was a deepfake. Fabricated from old recorded video and audio, stitched together in real time, good enough to fool someone who had every reason and every instinct to be careful.
That's not a hypothetical. That's a Tuesday.
The thing we always trusted was the human check
For most of the history of fraud prevention, "get on a call and confirm it's really them" was the gold-standard defense against phishing. Text and email can be faked — but a voice, a face, the specific way your CFO clears his throat before he says something he doesn't want to say? That felt unfakeable. It was the fallback everyone reached for specifically because it was hard to spoof.
That fallback doesn't hold anymore. Voice cloning tools now need only a few seconds of someone's speech — pulled from an earnings call, a conference talk, a podcast appearance, a company all-hands posted on YouTube — to generate a convincing clone. Real-time video deepfakes, the kind used in the Hong Kong case, can now render a live face on a video call well enough to survive a multi-person conference, not just a quick one-on-one. Wire-fraud attempts using cloned executive voices to pressure finance staff into urgent transfers have become common enough that the FBI and multiple banks have issued specific warnings about them.
The attack doesn't need to fool a machine. It needs to fool a person who's seen that face and heard that voice a hundred times before, over a slightly compressed video call, while being told the situation is urgent and confidential. That's a much easier bar to clear than most people assume.
Why "just verify it's them" isn't a real answer anymore
The uncomfortable implication here is bigger than one scam technique. Almost every layer of trust in a modern organization — approving a transfer, granting access, confirming an identity over the phone — ultimately traces back to a human recognizing another human, whether directly or through a process someone designed around that assumption. Call the CEO back to confirm the wire transfer. Video call your colleague to check the request is real. Recognize your manager's voice on the phone.
That entire category of defense assumes a fundamental fact hasn't changed in decades: that a face and a voice are hard to fake convincingly. They aren't anymore, and the tools to fake them keep getting cheaper and faster. Security advice that boils down to "just make sure it's really them" is now advice built on a broken assumption.
What actually holds up when a face isn't proof anymore
This is exactly why identity verification is shifting away from things that can be recorded, cloned, or replayed — a voice, a face, a signature — and toward things that are much harder to fabricate on demand: cryptographic proof tied to a specific device, and behavioral or contextual signals that a deepfake video call simply can't produce. A cloned voice can ask someone to approve a transfer. It can't also be standing next to the physical device that's supposed to authorize it.
That's the same underlying shift NearAuth.ai is built around, just one layer removed from the wire-transfer scenario: instead of trusting a single verification moment — a login, a phone call, a face on a screen — access and identity get tied to continuous, physical proximity between a person and their actual device. An attacker can clone a CEO's voice with a few seconds of audio. They still can't put your phone in the same room as theirs.
The lesson from Hong Kong isn't "be more suspicious on video calls," though that helps. It's that any security process built entirely on a human recognizing another human now has an expiration date. The processes that will hold up are the ones that don't ask a person to be the judge of what's real in the first place.
chris@nearauth.ai