DNB Bank · AI used against the institution · severity 1 of 5
In January 2025 fraudsters tried to get DNB's Singapore office to pay out several million Singapore dollars, close to NOK 24 million, using a live Microsoft Teams meeting in which deepfaked video and voice of chief financial officer Ida Lerner gave the instruction. DNB chief executive Kjerstin Braathen disclosed the attempt at a security conference on 3 February 2025 and called it "a complete deepfake", according to BankShift. The attack began with WhatsApp messages on 21 January; the Singapore manager reported them to DNB security, the bank joined the 23 January meeting to study the method and broke contact when payment instructions appeared. No money was lost. DNB's security chief said it was the first time the bank had seen a deepfake in a live-meeting format.
Record last reviewed Oct 21, 2026 · Markdown
Date
Jan 21, 2025 · disclosed Feb 3, 2025
Institution
DNB Bank
Country
Norway
AI system
Deepfaked video and cloned voice of DNB executives, looped from public recordings, used in a live Microsoft Teams meeting
AI?
Described as AI by the institution or regulator
The institution, a regulator or a court called the system AI.
Status
Confirmed by the institution
Severity
1 of 5
Impact
Close to NOK 24 million requested (several million Singapore dollars); nothing paid · No customers involved · A targeted attempt on DNB's own Singapore office; the bank reported no loss.
What happened?
On Tuesday 21 January 2025 managers at DNB's Singapore office received a suspicious WhatsApp message that appeared to come from chief financial officer Ida Lerner; at the same time other managers at DNB's international offices received similar messages from "Lerner" and chief executive Kjerstin Braathen, inviting them to a meeting with both executives about a project to launch a "new and exciting product". BankShift reported that the attackers targeted DNB's offices in Singapore and London.[1]
The Singapore manager reported the message to DNB's security department under the bank's procedures, and security staff saw clear signs of a "CEO fraud" attempt. DNB decided to go ahead with the Microsoft Teams meeting, held on Thursday 23 January, to learn more about the method. When the deepfaked "Lerner" joined, she instructed DNB to transfer several million Singapore dollars to complete what was presented as a unique investment opportunity; VG put the amount at close to NOK 24 million. DNB broke off contact once payment instructions were shown on screen.[1][2]
When DNB reviewed the footage it found that both sound and image of Lerner and Braathen had been taken from real recordings available online and looped by the fraudsters. Braathen, who was shown a recording of the meeting, said at the Finansiell Trygghet security conference that "it was a complete deepfake" and that the only thing that stood out was that she appeared in summer clothes in what was supposedly November. DNB's chief security officer Torgeir von Essen told BankShift it was the first time the bank had seen such a deepfake fraud in a live-meeting format and that the attacker was "relatively advanced" and not Norwegian.[1][2]
The AI Incident Database later catalogued the case as incident 1246, describing it as an attempt in which DNB "avoided losses". Finansavisen, writing about executive-impersonation fraud in March 2025, recounted that a DNB employee in Singapore became suspicious and the fraud was averted.[3][4]
When did it happen?
- Jan 21, 2025
Managers at DNB's Singapore office and other international offices receive WhatsApp messages impersonating CFO Ida Lerner and CEO Kjerstin Braathen; the Singapore manager reports them to DNB security.[1]
- Jan 23, 2025
DNB attends the fake Microsoft Teams meeting, where a deepfaked Lerner asks for a transfer of several million Singapore dollars; DNB breaks contact when payment instructions appear.[1][2]
- Feb 3, 2025
CEO Kjerstin Braathen discloses the attempt at a security conference; BankShift and VG report it.[1][2]
What was the impact?
- Financial: Close to NOK 24 million requested (several million Singapore dollars); nothing paid[1][2][4]
- Customers: No customers involved[1][2][4]
- Other: A targeted attempt on DNB's own Singapore office; the bank reported no loss.[1][2][4]
Severity 1 of 5: Contained attempt: the Singapore office reported the approach to security before the meeting, DNB cut contact when payment instructions appeared, and no money was lost; no customers were involved and no regulator action followed.
How did DNB Bank respond?
DNB disclosed the attempt itself. Braathen called it "a learning experience for us" that "shows how good they have become", and said deepfake attacks are developing fast and the bank must be prepared. Chief security officer Torgeir von Essen said DNB gains more by being open about such incidents than by keeping them back, and that the bank was still analysing the data to identify the threat actor.[1]
What was the outcome, and did regulators act?
No money was transferred. DNB said it was analysing the attack to identify who was behind it; no arrest, prosecution or regulatory action connected to the attempt has been reported in the sources reviewed as of 2026-10-21.[1][4]
Did DNB lose any money to the deepfake Teams call?
No. The Singapore manager reported the suspicious WhatsApp invitation to DNB security before the meeting, the bank attended only to study the method, and it broke off contact when payment instructions for close to NOK 24 million appeared on screen, according to BankShift and VG.
How did the fraudsters make the DNB deepfake?
DNB said both the sound and the image of its CFO Ida Lerner and CEO Kjerstin Braathen were taken from real recordings available online and looped during the live Teams meeting. Braathen noticed she appeared in summer clothes in what was supposedly November, which gave the fake away.
Was the DNB attempt confirmed by the bank?
Yes. DNB chief executive Kjerstin Braathen disclosed it herself at a Norwegian security conference in February 2025, and chief security officer Torgeir von Essen described it to BankShift as the first time the bank had seen a deepfake fraud attempt in a live-meeting format.
Has anyone been charged over the DNB deepfake attempt?
No arrest or charge has been reported. DNB said in February 2025 that it was still analysing the data to identify the threat actor and that the attacker was relatively advanced and not Norwegian; no later update was found in the sources reviewed as of October 2026.
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning