Arup finance worker pays $25 million after deepfake video call

Background

A deepfake is an image, video or audio recording generated or altered with machine-learning models, usually trained on existing footage of a real person so that the synthetic face or voice resembles the original. Such material is cheap to produce and can be played through ordinary video-conferencing software, which makes it useful for fraud as well as for satire.

Corporate payment approvals have long rested on two assumptions: that an instruction arriving by email can be checked against the sender's identity, and that a familiar face and voice on a call confirm who is on the other end. A deepfake attacks the second assumption directly. Because synthetic video only has to hold up inside a small conference window for a few minutes, and because a request framed as confidential discourages the recipient from asking colleagues, a well-prepared fake call can pass for the real thing.

What happened

In February 2024, Hong Kong police disclosed that a finance employee at a multinational company had been induced to join a video conference in which the person presented as the chief financial officer, and the other participants, were all deepfake re-creations ^[1].

The approach began with an email. The worker at first suspected that the message, which appeared to come from the company's UK office and referred to a secret transaction, was a phishing attempt ^[1]. The video call dissolved that doubt: the attendees looked and sounded like colleagues he recognised, so he set his concerns aside ^[1].

The transfer

He agreed to send a total of 200 million Hong Kong dollars, roughly US$25.6 million, issued as 15 separate transactions ^[1].

The victim was not named when the police disclosed the case. On 16 May 2024, the London-based engineering firm Arup confirmed to CNN that it was the company involved, and that fake voices and images had been used ^[1]. Arup had notified Hong Kong police of the fraud in January 2024 ^[1].

Arup said the incident had not affected its financial stability or its business operations, and that none of its internal systems had been compromised ^[1]. The money left through payments the employee agreed to authorise, not through a breach of the company's own network — which is part of what makes the case instructive.

Why it matters

Rob Greig, Arup's global chief information officer, said the number and sophistication of such attacks had been rising sharply in recent months ^[1].

The case shows where the weak point sits. Nothing in the company's infrastructure had to fail: a single employee, convinced by moving images and voices of people he knew, approved a sequence of transfers himself ^[1]. Verification habits built on recognition — seeing a face, hearing a voice, joining a call — no longer establish identity on their own.

The usual responses are procedural rather than technical. Common suggestions include confirming large or unusual payments through a separate channel and a known number rather than the one supplied in the request, requiring a second approver for transfers above a threshold, and treating urgency and secrecy as warning signs in themselves. Because the synthetic participants in this case were modelled on real colleagues ^[1], checks that rely on the caller volunteering information are weaker than checks that route around the caller entirely.

The disclosure also changed how such losses are reported. Hong Kong police described the mechanics of the fraud before the company was publicly identified ^[1], and Arup confirmed its role only months later, on 16 May 2024 ^[1]. Public confirmation by a named employer gave security teams a concrete, documented example to train staff against, at a moment when, by its own information chief's account, attacks of this kind were multiplying and growing more sophisticated ^[1].