March 2025
Day 1 of 4
Moved from the account
USD 0
Asked for again the next morning
Singapore · March 2025
Reconstructed from
a police record
A true account

USD 499,000three days from the first message to the payment

The finance director paid it once he had the instruction in writing.
You have his job for the next four days.

Based on a real case: a scam against a finance director at a Singapore multinational, March 2025. Read the police release

Monday, 24 March

You’re the finance director. Every payment above a set amount needs your approval.

What you have
Approval of payments above a set amount
A payments team who process them
A CFO you have known for years
What nobody has written down
How to check a payment, and with whom
What to do when a request is confidential
A number to confirm it’s really him
Both columns are written for the simulation. The record doesn’t describe this company’s controls.

You’ll make four decisions and see what each one cost at the end.

Decision 01 / 04 · 24 March · 09:12

Your CFO messages you on WhatsApp instead of email.

How do you answer?

Nothing has been asked for yet
Decision 02 / 04 · 24 March · 16:40

That afternoon a confidentiality agreement arrives. Your name is already on it.

Attachment · two pages
Project
Regional restructuring
Party
You, by name and title
Scope
Not to be discussed with anyone until announced

Do you sign it?

Signed
25 March

The video call is moved to the next day.

Invitation · moved
Video conference · Regional restructuring
25 March 26 March
From the police account: the call was rescheduled on 25 March.

On 26 March you join the call. The chief executive is there, with others you recognise.

Decision 03 / 04 · 26 March · After the call

Everyone who should have been on the call was on it. Afterwards, a lawyer on the deal sends you the payment details.

Correspondence · external counsel
Matter
Regional restructuring, first tranche
Beneficiary
Account provided in the attachment
Amount
USD 499,000

Do you send it?

USD 499,000 has left the account
Decision 04 / 04 · 27 March · The morning after

The next morning, the CFO asks for a second payment on the same thread.

Do you send it?

He stopped and called the bank

He called the bank, and the bank alerted the Anti-Scam Centre the same day.

Checking with the CFO would have meant asking the people running the scam whether it was real.

What was on the call
Singapore Police Force, 7 April 2025

“He joined the Zoom video conference with the company’s chief executive officer, among others, impersonated using deepfake technology.”

The option that would have stopped this was on screen at every decision. At the time, it always looked like the wrong choice.

Your choices and his

What it cost
USD 499,000
Moved
3 days
First message to payment
USD 1.4m
Asked for, and not sent
The bank alerted the Anti-Scam Centre. Singapore and Hong Kong police traced the money and withheld it.
What would have changed this
01
A face on a call isn’t proof
The people asking for the money can fake the video call and the letter.
02
Check outside the conversation
Your sensible checks went back to the scammers: on WhatsApp, on the call, to the lawyer. Call a number you already hold.
03
Two people approve large payments
Above a set amount, a second person must approve, however urgent the request.
Are you a business owner?
Find out how you can protect your personal data from cyber threats.
Protect yourself
The incident, the sequence, the amounts and the mechanism. Singapore Police Force media release, 7 April 2025. A finance director of a multi-national corporation was contacted on 24 March 2025 by a scammer impersonating the company’s chief financial officer, was made to sign a non-disclosure agreement, and joined a Zoom video conference with the chief executive officer, among others, impersonated using deepfake technology. The video conference was rescheduled on 25 March. Through subsequent correspondence with a lawyer-impersonator he was instructed to perform a transaction, executed 26 March. He became aware of the scam on 27 March 2025 when the scammer asked for a further USD 1.4 million. Over USD 499,000 was traced and withheld, and over USD 5,000 seized locally.
police.gov.sg, media release, 7 April 2025
Retrieved 30 August 2026.
Not established, and not claimed: whether the video conference was live or pre-recorded. What was said on it, by anybody. What the other people on the call did. How the scammers knew the reporting lines. How the deepfake was produced. Whether the money was returned to the company. The release says traced, withheld and seized, which are three different things, and none of them is returned.
Written for the simulation: the wording of every message, including the line about keeping it off email. The two pages of the agreement and the name already on it. The eleven payments. The twenty-two minutes. The letterhead, the hour and the reference number. Every reply at decisions 01, 02 and 03, including the answer that legal is not read in on the restructuring. The two columns of what this company did and did not have written down. The reader plays a composite finance director, not any identified person.
Naming: no individual, company or bank is named anywhere on this page, deliberately, although the source names the bank. No regulatory framework is invoked, because no personal data was taken and this case has no PDPA dimension.
Three questions

Now check your own business.

Answer honestly. Your answers aren’t sent or saved.

01
If your CFO messaged you for a payment, do you have your own number to check with?
02
Do payments above a set amount need two people to approve them?
03
Would a senior request for confidentiality override your payment checks?
0 of 3 answered
Where you stand

Run the free scan
Already know what you need? .