Deepfake fraud: $25m lost in a fake video call

In early 2024, an Arup employee in Hong Kong sent about $25m after a video call with fake, AI-generated colleagues. How the scam works, and how to protect your business.

In early 2024, a finance employee at Arup, the British engineering group, received a payment request presented as coming from management in the UK. He was suspicious at first. Then he joined a video call where he recognised several colleagues, and made the transfers.

What happened

• Every participant on the call was a deepfake, built from public videos and recordings, according to Hong Kong police.
• The employee made 15 transfers to 5 bank accounts, for about HK$200m, or roughly US$25m.
• The fraud was discovered about a week later, when he contacted head office.
• Arup said its IT systems were not compromised: it was trust that was hacked.

CEO fraud, AI edition

Fake-executive fraud has existed for years: a fake email or call asks for an urgent, confidential transfer. AI makes it more convincing, because a voice or a face can now be imitated. Seeing someone on screen no longer proves who they are.

Simple defences

• Confirm any unusual transfer request by calling a known number, never the one in the message.
• Set a rule: no large transfer without approval by two people.
• Be wary of imposed urgency and secrecy: they are fraudsters’ favourite levers.
• Agree on a verification word or question within the leadership team.

Train rather than blame

The employee had the right instinct when he doubted. What was missing was a clear procedure that allowed him to verify, even when facing an executive. Rules protect the people who follow them.

In the age of deepfakes, verification has to go through a channel the fraudster does not control.

Sources: Hong Kong police, CNN, Financial Times, Business Insider, 2024.

Want to automate your processes without opening new gaps? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.