# Deepfaked DNB executives in a fake Teams meeting try to get Singapore staff to pay out millions Source: https://www.bankingnewsai.com/ai-incidents/dnb-2025-deepfake-cfo-teams-call Last updated: Oct 21, 2026 DNB Bank · AI used against the institution · severity 1 of 5 In January 2025 fraudsters tried to get DNB's Singapore office to pay out several million Singapore dollars, close to NOK 24 million, using a live Microsoft Teams meeting in which deepfaked video and voice of chief financial officer Ida Lerner gave the instruction. DNB chief executive Kjerstin Braathen disclosed the attempt at a security conference on 3 February 2025 and called it "a complete deepfake", according to BankShift. The attack began with WhatsApp messages on 21 January; the Singapore manager reported them to DNB security, the bank joined the 23 January meeting to study the method and broke contact when payment instructions appeared. No money was lost. DNB's security chief said it was the first time the bank had seen a deepfake in a live-meeting format. ## Key facts | | | | --- | --- | | Date | Jan 21, 2025 (disclosed Feb 3, 2025) | | Institution | DNB Bank | | Country | Norway | | AI system | Deepfaked video and cloned voice of DNB executives, looped from public recordings, used in a live Microsoft Teams meeting | | AI? | Described as AI by the institution or regulator — The institution, a regulator or a court called the system AI. | | Category | Deepfake fraud (AI used against the institution) | | Status | Confirmed by the institution | | Severity | 1 of 5 — Contained attempt: the Singapore office reported the approach to security before the meeting, DNB cut contact when payment instructions appeared, and no money was lost; no customers were involved and no regulator action followed. | ## What happened? On Tuesday 21 January 2025 managers at DNB's Singapore office received a suspicious WhatsApp message that appeared to come from chief financial officer Ida Lerner; at the same time other managers at DNB's international offices received similar messages from "Lerner" and chief executive Kjerstin Braathen, inviting them to a meeting with both executives about a project to launch a "new and exciting product". BankShift reported that the attackers targeted DNB's offices in Singapore and London. [1] The Singapore manager reported the message to DNB's security department under the bank's procedures, and security staff saw clear signs of a "CEO fraud" attempt. DNB decided to go ahead with the Microsoft Teams meeting, held on Thursday 23 January, to learn more about the method. When the deepfaked "Lerner" joined, she instructed DNB to transfer several million Singapore dollars to complete what was presented as a unique investment opportunity; VG put the amount at close to NOK 24 million. DNB broke off contact once payment instructions were shown on screen. [1][2] When DNB reviewed the footage it found that both sound and image of Lerner and Braathen had been taken from real recordings available online and looped by the fraudsters. Braathen, who was shown a recording of the meeting, said at the Finansiell Trygghet security conference that "it was a complete deepfake" and that the only thing that stood out was that she appeared in summer clothes in what was supposedly November. DNB's chief security officer Torgeir von Essen told BankShift it was the first time the bank had seen such a deepfake fraud in a live-meeting format and that the attacker was "relatively advanced" and not Norwegian. [1][2] The AI Incident Database later catalogued the case as incident 1246, describing it as an attempt in which DNB "avoided losses". Finansavisen, writing about executive-impersonation fraud in March 2025, recounted that a DNB employee in Singapore became suspicious and the fraud was averted. [3][4] ## Timeline - Jan 21, 2025 — Managers at DNB's Singapore office and other international offices receive WhatsApp messages impersonating CFO Ida Lerner and CEO Kjerstin Braathen; the Singapore manager reports them to DNB security. [1] - Jan 23, 2025 — DNB attends the fake Microsoft Teams meeting, where a deepfaked Lerner asks for a transfer of several million Singapore dollars; DNB breaks contact when payment instructions appear. [1][2] - Feb 3, 2025 — CEO Kjerstin Braathen discloses the attempt at a security conference; BankShift and VG report it. [1][2] ## What was the impact? - Financial: Close to NOK 24 million requested (several million Singapore dollars); nothing paid - Customers: No customers involved - Other: A targeted attempt on DNB's own Singapore office; the bank reported no loss. [1][2][4] ## How did DNB Bank respond? DNB disclosed the attempt itself. Braathen called it "a learning experience for us" that "shows how good they have become", and said deepfake attacks are developing fast and the bank must be prepared. Chief security officer Torgeir von Essen said DNB gains more by being open about such incidents than by keeping them back, and that the bank was still analysing the data to identify the threat actor. [1] ## What was the outcome? No money was transferred. DNB said it was analysing the attack to identify who was behind it; no arrest, prosecution or regulatory action connected to the attempt has been reported in the sources reviewed as of 2026-10-21. [1][4] ## FAQ ### Did DNB lose any money to the deepfake Teams call? No. The Singapore manager reported the suspicious WhatsApp invitation to DNB security before the meeting, the bank attended only to study the method, and it broke off contact when payment instructions for close to NOK 24 million appeared on screen, according to BankShift and VG. ### How did the fraudsters make the DNB deepfake? DNB said both the sound and the image of its CFO Ida Lerner and CEO Kjerstin Braathen were taken from real recordings available online and looped during the live Teams meeting. Braathen noticed she appeared in summer clothes in what was supposedly November, which gave the fake away. ### Was the DNB attempt confirmed by the bank? Yes. DNB chief executive Kjerstin Braathen disclosed it herself at a Norwegian security conference in February 2025, and chief security officer Torgeir von Essen described it to BankShift as the first time the bank had seen a deepfake fraud attempt in a live-meeting format. ### Has anyone been charged over the DNB deepfake attempt? No arrest or charge has been reported. DNB said in February 2025 that it was still analysing the data to identify the threat actor and that the attacker was relatively advanced and not Norwegian; no later update was found in the sources reviewed as of October 2026. ## Sources 1. [DNB utsatt for sofistikert deepfake-angrep](https://www.bankshift.no/nyheter/dnb-utsatt-for-sofistikert-deepfake-angrep/375139) — BankShift, Feb 3, 2025 (news): "Her prøver en deepfake-versjon av DNBs finansdirektør Ida Lerner å instruere ansatte ved bankens Singapore-kontor til å utbetale millioner av Singapore-dollar i et ekte Teams-møte." 2. [DNB-topper misbrukt i bedragerivideo](https://www.vg.no/nyheter/i/jQxk1q/dnbs-toppledere-ble-utsatt-for-avansert-bedrageriforsoek) — VG, Feb 3, 2025 (news): "Her sitter DNBs finansdirektør i et videomøte og gir ordre om utbetaling av nær 24 millioner kroner. Men videoen er forfalsket." 3. [Direktørsvindlerne har fått nye våpen](https://www.finansavisen.no/teknologi/2025/03/25/8250514/direktorsvindel-har-fatt-nye-vapen-med-kunstig-intelligens-og-fyller-skjermen-med-deepfakes) — Finansavisen, Mar 25, 2025 (news): "Men heldigvis for banken ringte det en bjelle, i dette tilfellet for en ansatt ved DNBs kontor i Singapore, som fattet mistanke. Svindelen ble derfor avverget." 4. [Incident 1246: Purportedly AI-Generated Deepfake Reportedly Used to Impersonate DNB Bank CFO and CEO in Live Teams Meeting](https://incidentdatabase.ai/cite/1246) — AI Incident Database, Oct 22, 2025 (incident index): "DNB identified the attempt as a "CEO fraud" and avoided losses, calling it their first encounter with a live deepfake meeting." All AI incidents at banks: https://www.bankingnewsai.com/ai-incidents --- Canonical page: https://www.bankingnewsai.com/ai-incidents/dnb-2025-deepfake-cfo-teams-call Part of [BankingNewsAI](https://www.bankingnewsai.com/) — the register of AI incidents at banks: https://www.bankingnewsai.com/ai-incidents. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.