Hong Kong police break up deepfake romance scam syndicate

Hong Kong police disclosed on October 14, 2024, that they had arrested 27 people for allegedly running a romance scam ring that used AI face-swapping technology. The syndicate operated out of a residential building and used faked video calls to push victims toward fraudulent cryptocurrency trading platforms.

What happened

Police said the operation was based in a 4,000-square-foot facility in Hong Kong's Hung Hom neighborhood, and among those detained were six university graduates recruited to help build the scam infrastructure. According to a regional crime unit official, scammers first contacted victims on social media and sent AI-generated photos designed to create an attractive persona before moving to video calls. Officials said the deepfake technology then altered the scammers' appearance and voice during live video calls to build trust before victims were pushed into investment platforms.

Impact

Victims were located in Hong Kong, mainland China, Taiwan, India and Singapore. Reporting also indicated that several of those detained had suspected ties to a major organized criminal group active in Hong Kong and China.

Response

Police seized computers, mobile phones, suspected crime proceeds and luxury watches from the operation's headquarters. The disclosure followed a separate United Nations report warning about the broader use of deepfake tools by organized fraud groups across the region.

Lessons for security leaders

This case shows that live video is no longer reliable proof of identity, since deepfake tools can alter both appearance and voice in real time during a call. Security awareness programs for employees and consumers alike should treat video-call verification as a social-engineering risk rather than a safeguard, and organizations should pair any high-value financial request made over video or messaging with an independent verification channel. The scale of proceeds involved also underscores why fraud and anti-money-laundering teams should factor deepfake-enabled romance and investment scams into their threat models alongside more familiar business email compromise and executive-impersonation scenarios.