DNB bank employees receive deepfake video in Teams meeting impersonating executives
DNB bank reportedly fell victim to a sophisticated deepfake-based CEO fraud attempt in which scammers used AI-generated video and audio to impersonate the CFO and CEO during a live Teams meeting and request a large financial transfer. DNB's security team detected and contained the attack, and no funds were transferred.
What happened
On 21 January 2025, leaders at DNB's Singapore office received a suspicious WhatsApp message purportedly from CFO Ida Lerner inviting them to a Teams meeting with Lerner and Group CEO Kjerstin Braathen regarding a new product launch. On the same day, other leaders at DNB's international offices received similar messages from Lerner and Braathen.
On 23 January, the Teams meeting took place with several internal and external participants. During the meeting, a deepfake video of Lerner appeared and instructed DNB to transfer several million Singapore dollars for an investment opportunity, claiming it as a unique opportunity for the bank.
DNB's security team identified the meeting as a fraudulent CEO fraud attempt and allowed it to proceed to learn more about the scammers' methods. The deepfake video and audio were created using publicly available video and audio recordings of Lerner and Braathen, which the scammers looped during the meeting.
Reported impact
No financial loss was recorded. Braathen noted that despite some connection issues, the deepfake audio and video appeared credible, with Lerner's voice and recognizable English accent from her time at HSBC reproduced convincingly.
Index analysis
This represents the first known instance of deepfake technology being used in a live video conferencing format to impersonate multiple executives in a CEO fraud attempt targeting a financial institution, according to DNB.
Governance controls
DNB's Singapore office leader reported the suspicious WhatsApp message to DNB's security department in accordance with company procedures. DNB's security team identified clear signs of fraudulent activity and decided to continue with the Teams meeting to gather intelligence on the scammers' tactics.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.