March 10, 2026
No Comments
When the Monetary Authority of Singapore (MAS) issued its September 2025 circular on deepfake risks, it marked a turning point for financial institutions and businesses. The guidance followed a series of documented incidents — from the HK$200M Hong Kong CFO impersonation scam (The Guardian) to a €20M cryptocurrency fraud in Spain (PANews Lab) and a crypto scam in Hong Kong using AI-generated personas (Protos). Even Singapore has seen close calls — including a $499K near-miss prevented in March 2025 (MAS).
The circular shows that MAS understands the scale of the problem. It does not just prescribe technology like liveness detection or endpoint detection tools. It emphasises the human side of fraud prevention: training employees, building stronger verification processes, and reinforcing separation of duties for high-risk transactions.
For companies, the lesson is clear: fraud is not just a technical problem. It is a verification problem that spans people, process, and tools.
In February 2024, a Hong Kong employee was tricked into authorising HK$200M in fund transfers after attending a video call where fraudsters used deepfakes of colleagues and the CFO (The Guardian).
The scam worked because the criminals controlled the conversation, eliminated doubt by having multiple “participants,” and applied pressure with fake urgency. The lack of a secondary verification process meant one employee’s actions led directly to multimillion-dollar losses.
In April 2025, Spanish authorities investigated a deepfake-driven cryptocurrency fraud that cost investors €20M. Fraudsters used manipulated video content and fabricated endorsements to convince victims that the scheme was legitimate (PANews Lab).
Unlike older scams, this case showed that deepfakes can be combined with polished marketing and credible details to bypass even cautious investors’ judgement.
In October 2024, Hong Kong police broke up a fraud ring that used AI deepfakes of women — marketed as “superior women” — to lure victims into false relationships before convincing them to transfer money into crypto wallets. Losses reached tens of millions of dollars (Protos).
This incident highlighted how fraud tactics prey on trust and personal connection, not just corporate processes. It demonstrated that both executives and ordinary employees can be victims of scams.
In March 2025, MAS and police intervened to prevent a $499,000 fraudulent transfer, citing it as a near miss for Singaporean businesses (MAS). The incident showed that local verification processes can fail under pressure, but also that rapid coordination with authorities can stop the fraud in time.
Together, these examples show why MAS has escalated its focus on corporate verification.
For companies and financial institutions, the implications are wide-ranging:
The consequence is not only monetary losses. Regulatory fines, reputational harm, and loss of investor confidence can all follow when a company fails to address verification risks.
In August 2024, an Indonesian financial institution reported a KYC bypass using deepfake photos — proving that static identity verification is not enough (MAS Circular, 2025).
Fraudsters impersonate executives on video calls, pressuring employees to approve fraudulent transactions. The psychological manipulation is as powerful as the technical deception.
Employees are conditioned to respect hierarchy. Without escalation processes, they may act on instructions from fraudulent CEOs without question.
MAS emphasised that fraudsters now combine AI with proven fraud tactics:
This hybridisation makes fraud both harder to detect and more convincing.
On 18 September 2025, MAS issued its circular mandating a comprehensive approach to fraud prevention. It stresses that controls must be both technical and human-centred.
These requirements reflect lessons from the cases: single points of failure, weak processes, and untrained employees make fraud easier.
Each MAS guideline addresses a real vulnerability:
In short, MAS is closing the gap between technical solutions and human fallibility.
MAS listed five categories of risk:
Each risk has measurable impact: loss of money, erosion of shareholder confidence, or regulatory censure.
The FBI has warned of similar patterns in the U.S. In 2023, companies reported business email compromise losses exceeding $2.9B, often involving CEO fraud layered with new AI techniques (IC3.gov).
What is clear: MAS’s guidance is not an isolated directive. It is part of a global trend recognising that deepfake threats are now embedded in corporate fraud. For multinational companies, aligning with MAS requirements is a way to raise global standards of resilience.
Provide employees with toolkits to verify executives’ communications.