Singapore Businessman Loses S$4.9 Million to a Fake Zoom Meeting Built From Real Footage of PM Lawrence Wong and Other Officials

What happened

A Singaporean businessman with prior interactions with government officials was drawn into an elaborate impersonation scam that fabricated an entire Zoom video conference appearing to feature Prime Minister Lawrence Wong, Singapore's president, a Minister in the Prime Minister's Office, Monetary Authority of Singapore representatives, foreign officials (Canada's foreign minister, the UAE president's senior diplomatic adviser), and private-sector names (BlackRock, Dubai International Financial Centre). Nine real high-profile individuals or institutions were presented as participants. None of them attended. The pretext was a request for "urgent funding assistance" tied to the real-world Strait of Hormuz crisis. After being lured via WhatsApp and a spoofed email, signing a fake NDA, and attending the fabricated conference, which closed with a PM Wong who appeared to thank him personally for attending, the victim was contacted again and induced to wire at least S$4.9 million (~US$3.8 million) in multiple transactions to a corporate bank account supplied by the scammers.

The Singapore Police Force disclosed the case in a 14 May 2026 news release, and said on 16 May 2026 that it had obtained footage of the conference, publishing stills and three deepfake indicators. It later gave the full recording to Channel NewsAsia exclusively, and CNA's frame-by-frame analysis, published 22 August 2026, materially changed the technical account: the conference was assembled overwhelmingly from genuine, obscure video of the real officials rather than generated from scratch. The exact dates of the call and the transfers have not been disclosed. The call cannot predate 25 March 2026, the date of the Canadian foreign minister's Paris press conference whose footage it reuses, so the attack ran at some point between late March 2026 and 14 May 2026.

How it worked

The scam unfolded in stages combining messaging-app impersonation, spoofed email, forged documents, and a fabricated video conference. (1) Initial contact: the victim received a WhatsApp message from a profile using the photo and name of the Secretary to the Cabinet, instructing him to attend a meeting with PM Lawrence Wong. (2) Email lure: he then received an email from WongHongKuan.secretarycabinet@proton.me (a Proton Mail address, not a genuine government domain) purportedly from the Cabinet Secretary, requesting "urgent funding assistance" tied to the Strait of Hormuz crisis, with an attached fake government "letter of guarantee" bearing a reproduction of PM Wong's signature promising reimbursement within 15 business days. (3) Control/legitimacy steps: the victim was told to sign a non-disclosure agreement and provide a copy of his identification card, both of which added a veneer of official process and discouraged him from discussing the "meeting" with others. (4) The fabricated meeting: after signing the NDA, he was invited to a Zoom video conference that appeared to include PM Wong, Singapore's president, a Minister in the Prime Minister's Office, representatives of the Monetary Authority of Singapore, Canada's foreign minister, the UAE president's senior diplomatic adviser, and private-sector figures from BlackRock and the Dubai International Financial Centre. He was introduced as a private-sector participant; the meeting proceeded with a briefing on the Strait of Hormuz situation and closed with a PM Wong who acknowledged the victim's attendance personally. None of the officials were there. CNA's August 2026 analysis of the full recording established how the cast was assembled: "The scammers, in other words, did not create their cast of Zoom characters from scratch. Instead, they constructed a live, convincing hoax almost entirely using real videos that were mixed with doctored audio, stolen identities and graphic overlays." At least seven visual segments were traced to YouTube uploads that remain publicly accessible and are either dated or little watched. In the segment traced in most detail, a 2023 radio interview reused for the Minister in the Prime Minister's Office, the audio had been replaced but the video, including her hand gestures and head movements, "appeared unedited". (5) Extraction: after the call, a scammer posing as a lawyer contacted the victim by WhatsApp and induced him to wire funds in multiple transactions to a corporate bank account supplied by the scammers. He grew suspicious afterward, contacted the real Cabinet Secretary, and only then learned he had been scammed.

The lure and the tell

The lure combined a personalized WhatsApp approach (using a real official's name and photo), a spoofed email from a Proton Mail address impersonating the Cabinet Secretary, a forged "letter of guarantee" carrying a fake reproduction of PM Wong's signature, an NDA to enforce secrecy, a geopolitical urgency hook (the real-world Strait of Hormuz crisis), and finally a full Zoom "meeting" populated with recognizable officials and organizations (Singapore's president and prime minister, a minister, MAS, foreign ministers, BlackRock, DIFC) to manufacture social proof and authority at a scale far beyond a single spoofed voice call.

The tell, per the Singapore Police Force's forensic review of the footage it obtained (16 May 2026): (1) speech did not synchronize with the speakers' lips, indicating pre-recorded inauthentic audio; (2) all "speakers'" audio was broadcast from a single account rather than from each individual call participant; and (3) the video showed a distorted background and a partially obscured Zoom logo that did not align with the foreground, which SPF said "indicates that the videos were manipulated using AI technology".

CNA's analysis of the full 19-minute recording, published 22 August 2026, added four sharper tells that a viewer could have caught in the moment. The Zoom name label at the bottom left of the main feed read "Lawrence Wong" from start to finish, never changing even as the face on screen cycled through four different people, and at points a second name was visible on top of it, as though one feed had been overlaid on another. Four further Zoom accounts sat in the call as silent padding, and two of those feeds, the president's and the BlackRock representative's, were playing in a loop. A "Live Zoom Recording" graphic sat inside individual participant tiles, placed there to cover the watermarks of the broadcasters whose footage had been lifted. Zoom does not draw a recording badge inside a participant's screen; it puts the indicator on the wider meeting interface, so the badge was itself the artifact.

The most instructive element is something the scam got right rather than wrong. The one audio track the scammers left untouched was the Canadian foreign minister's, taken from a virtual press conference she gave in Paris on 25 March 2026 on safe passage through the Strait of Hormuz. Her real remarks sat close enough to the pretext that no editing was needed, so her lips matched her words exactly. Her segment was the longest in the call, at over seven minutes, and it ran near the start. Reuben Ng, a behavioral and data scientist and associate professor at the NUS Lee Kuan Yew School of Public Policy, told CNA it provided "an anchor" for the scam: "It's an exercise to erode suspicion and build trust. By placing her video near the start, it prevents a potential victim from raising alarm bells and lowers their guard." Every lip-sync failure that came afterwards could then be read as lag or a poor connection.

Outcome

The Singapore Police Force disclosed the loss in a public advisory on 14 May 2026, warning that scammers were targeting business professionals with prior government interactions, then said on 16 May 2026 that it had obtained footage of the fabricated conference, publishing stills and a technical breakdown of three deepfake indicators. The full recording was not made public in May. SPF later shared it exclusively with Channel NewsAsia, which published a frame-by-frame analysis on 22 August 2026 that materially revised the technical account of how the call was built. PM Lawrence Wong posted on Facebook on 14 May warning the public that messages purporting to arrange meetings on his behalf via the "Cabinet Secretary" were scams: "These messages are scams. Please exercise caution if you receive unsolicited messages of this nature."

As of 2 September 2026, no arrest, attribution or recovery has been publicly announced in connection with this S$4.9 million loss. Three people were arrested and charged on 9 May 2026 over suspected SIM-card offences relating to earlier cases that used the same modus operandi (fake NDA-gated virtual meetings with impersonated senior officials). Police did not say whether they were involved in this one: The Online Citizen reported on 15 May 2026 that "SPF did not disclose whether those arrested were directly involved in the latest S$4.9 million case. The police added that investigations into the wider scam network were ongoing." The three are not named here, because charged is not convicted.

Why it matters

What this case teaches changed once the full recording was analyzed. On the May account it read as a demonstration that generative AI can now conjure an entire multi-participant government meeting out of nothing. The August account is more useful, and more alarming, because the scammers generated almost nothing. They assembled a credible head-of-government video conference out of real footage that anyone can still watch on YouTube, picked clips obscure enough that the victim was unlikely to recognize them, covered the original broadcasters' watermarks with a fake recording badge, and laid substituted speech over the top. An NTU researcher quoted by CNA put the economics plainly: using publicly available footage is much cheaper and easier than generating a person's likeness with AI. That puts the skill floor for this attack at a YouTube search and a cheap voice tool.

The sharpest lesson is the anchor. The scammers' most valuable asset was their one piece of untouched truth: seven minutes of genuine, perfectly synchronized footage of a real foreign minister, on topic and placed early, buying credibility that the doctored segments could then spend. Detection advice that trains people to watch for lip-sync mismatch quietly assumes the attacker will show them a mismatch while they are still watching closely. This attacker showed them a flawless match first, deliberately, so that every later mismatch would be filed under bad connection. Any control that depends on a person noticing an artifact has to survive being primed not to look, which is why a procedural rule, no fund-transfer decision made on the basis of a video call, outlives any list of visual tells.

The case also shows that genuine prior contact with real officials does not protect a target. That contact is what made the approach plausible in the first place, and the attackers selected for it. It prompted an unusual direct public rebuttal from the impersonated sitting Prime Minister alongside a national police advisory carrying technical detection guidance, which is how governments are now treating impersonation of officials: as a national fraud-prevention problem rather than a reputational one.

Defenses

The Singapore Police Force's public advisory (14 and 16 May 2026) told the public that government officials will never ask, over email, phone, or video call, to transfer money, disclose bank login details, install apps from unofficial app stores, or transfer a call to police or other officials; to never send funds or ID documents to unverified individuals; to independently verify any purported official request through official government channels; and to use the ScamShield app or website, or the 24/7 ScamShield Helpline (1799), to check suspicious messages. SPF also published a "3A" detection approach and three technical tells (see the lure and the tell above). One check would have ended this at the second step: the Singapore government's email domain is gov.sg, and the request arrived from a proton.me address.

For organizations, the case argues for treating any high-value fund-transfer instruction that arrives via a video call or messaging app, however convincing the participants look, as unverified until confirmed through an independent, previously established channel, meaning a callback to a known number rather than one supplied in the suspicious message. Awareness training should carry the sharper tells from the August analysis alongside SPF's three: a participant name label that never changes while the face on screen does, silent participants whose feeds loop, and a recording badge drawn inside an individual participant tile, which Zoom does not do. Because the source video was real and published, a reverse image or video search on a distinctive frame can surface the original upload, and a purported live participant whose background matches a years-old broadcast is not live.

Train these as corroboration, not as the control. The anchor technique is aimed squarely at visual scrutiny: a viewer who has just watched seven minutes of perfectly synchronized, genuine footage has been taught, within the call itself, to explain away everything that follows. The procedural rule is what holds when the training fails.