In January 2024, a finance worker in the Hong Kong office of Arup, the engineering firm behind the Sydney Opera House, joined a video call with the company’s chief financial officer and several colleagues. He recognised their faces. He recognised their voices. By the time the call and its follow-ups were over, he had sent 200 million Hong Kong dollars, about $25.6 million, across 15 transactions.
Every other person on that call was a fabrication.
The case is the clearest real-world demonstration of what synthetic media can do inside an organisation. It is worth studying closely, because the details contradict the usual security advice. The victim was not careless. He was suspicious. It did not save him.
What actually happened
The sequence, as reported by Hong Kong police and later confirmed by the company, went like this.
The employee received an email that appeared to come from the company’s UK office. It specified the need for a secret transaction to be carried out. He did what security training tells people to do: according to police, the worker had initially suspected he had received a phishing email.
Then came the video call. He was duped into attending a video call with people he believed were the chief financial officer and other members of staff, but all of whom turned out to be deepfake re-creations. That resolved his doubts. The worker put aside his doubts after the video call because other people in attendance had looked and sounded just like colleagues he recognized.
The fraud was only discovered later, when the employee made an official inquiry with the company’s headquarters.
Arup confirmed the essentials. A spokesperson told CNN that the company had notified Hong Kong police, and said: we can confirm that fake voices and images were used. The company added that its financial stability and business operations were not affected and none of its internal systems were compromised.
That last point is the one to dwell on. Nothing was hacked. No password was stolen, no server breached. The attack ran entirely through a person’s trust in his own eyes and ears.
Why the usual advice failed
The standard guidance for a suspicious request is to verify it, and the intuitive way to verify is to see or hear the person. For decades that was sound. A phone call exposed an email forger, and a video call exposed a phone impostor.
The Arup attackers understood this and used it. The video call was not the attack. It was the verification step, staged by the attackers, designed to answer exactly the doubt the email had raised. The employee’s own caution was the thing they exploited.
Three features made it work.
A group, not one face. Several familiar colleagues on screen created social proof. Doubting one person is easy. Doubting a room full of people you know is hard.
Authority and secrecy. The request came from the top and was framed as confidential, which discouraged the employee from checking with anyone outside the call.
Many small steps. Fifteen transactions, not one. Each transfer made the next feel routine.
The research on human detection explains why looking harder would not have helped. People identify deepfakes only a little better than chance, and confidence does not track accuracy. A live call with compressed video gives an observer even less to go on.
How big is the problem?
Reliable figures are scarce, and most of the dramatic ones come from companies that sell defences.
The most widely quoted projection is from Deloitte’s Center for Financial Services, which predicts that generative AI could enable fraud losses to reach US$40 billion in the United States by 2027, from US$12.3 billion in 2023, a compound annual growth rate of 32%. That is a consultancy’s forecast built on stated assumptions under different scenarios, not a measurement, and it should be read as such.
What can be said with confidence is narrower. The Arup loss is documented and confirmed. The technique required no access to the company’s systems. This was not a freak event aimed at an unusual target. It was an engineering consultancy with wire transfer authority, which describes a great many businesses.
What would have stopped it
Not sharper eyes. Every effective control in this scenario works without anyone needing to spot the fake.
Verify out of band, and initiate the contact yourself. The decisive check is a call back to a number you already hold, through a channel the requester did not supply. The Arup employee was invited to the call by the people defrauding him. A call he placed himself, to the CFO’s known number, would have ended the fraud in a minute.
Require two people for money. A payment that needs a second approver from a separate reporting line cannot be pushed through by deceiving one person, however convincingly.
Treat secrecy as a red flag, formally. Legitimate urgent and confidential payments are rare. A policy that says secret transaction requests must be escalated, not obeyed, turns the attackers’ main lever into a tripwire.
Slow down large or unusual transfers. Cooling-off periods and limits on new payees buy the time in which someone asks the obvious question.
Make challenge safe. The employee’s instinct was right and he overrode it in front of what appeared to be his boss. People will only question an executive on a call if the culture has told them, in advance and from the top, that doing so is expected and will be thanked.
Agree a verification phrase for the highest-risk roles. A pre-arranged word, shared in person, is trivially cheap and immune to voice and face cloning.
What is not known
How common successful attacks are. Companies have little incentive to disclose, and most losses never become public. The confirmed cases are probably a small sample of the real number.
How well real-time detection tools work. Products claiming to flag synthetic faces or voices during a live call exist. Independent evidence of their accuracy in real conditions is thin.
Whether training helps. Awareness training is widely sold. There is little published evidence that it reduces losses from deepfake fraud specifically, and the Arup case is a reminder that an aware, suspicious employee was still defeated.
The lesson beyond finance
The same pattern applies anywhere a voice or face authorises something. A “CTO” on a call asking an engineer for production credentials. An “IT support” voice walking someone through a password reset. A “candidate” in a remote interview who is not the person who will turn up to work.
In each case the question to ask is not “does this look real?”. It is “would our process stop this even if it looked perfect?”. If the honest answer is no, the process is the vulnerability.
Common questions
What happened in the Arup deepfake scam?
In January 2024 a finance worker in Arup’s Hong Kong office joined a video call with people he believed were the chief financial officer and colleagues, all of whom were deepfake re-creations. He sent 200 million Hong Kong dollars, about $25.6 million, across 15 transactions. Arup confirmed that fake voices and images were used.
Was the employee careless?
No. According to police, he initially suspected the first email was phishing because it asked for a secret transaction. He put his doubts aside only after the video call, because the people on it looked and sounded like colleagues he recognised.
How can a company protect itself from deepfake fraud?
With controls that do not rely on spotting the fake: call-backs to known numbers initiated by the employee, two-person approval for payments, escalation of any request for secrecy, and a culture where questioning a senior person’s request is expected.
How much does deepfake fraud cost?
Nobody knows precisely. Deloitte projects that generative AI could push US fraud losses to US$40 billion by 2027 from US$12.3 billion in 2023, but that is a forecast, and most individual losses are never disclosed.
The bottom line
A cautious employee lost $25.6 million because the step he used to check a suspicious request, seeing and hearing his colleagues, was the step the attackers had forged. Seeing is no longer verifying. The defence is procedural: call back on a number you trust, never move money on one person’s say-so, and treat any demand for secrecy as the alarm it almost always is.
Did this answer your question?
Thanks. That helps us decide what to fix.
Leave a comment