Deepfake video call tricked Arup into paying 25 million dollars

Deepfake video call tricked Arup into paying 25 million dollars
	MANIPULATED MEDIA
	"A video conference with the chief financial officer and other senior colleagues of the engineering firm Arup authorized an employee in Hong Kong to make a series of urgent, confidential transfers totaling about 200 million Hong Kong dollars."
Domain	Business, Finance & Scams
Tactic	Manipulation; Imposture; Fraud or Scam;
Era	Current
First seen	2024
Origin	A fraud carried out against the Hong Kong office of the British engineering firm Arup in January 2024, disclosed by Hong Kong police in February 2024
Last reviewed	2026-10-26
	Further reading: books on Business, Finance & Scams

The deepfake video call that tricked Arup into paying about 25 million US dollars is one of the best-documented cases of fraud using artificial intelligence. In January 2024 an employee in the Hong Kong office of Arup, the British engineering and design firm, joined a video conference that appeared to include the company's UK-based chief financial officer and several other colleagues. Following instructions given on the call, the employee made fifteen transfers totaling 200 million Hong Kong dollars to five bank accounts. Every other participant on the call had been fabricated using deepfake technology. The case, made public by Hong Kong police in February 2024 and confirmed by Arup in May, showed that AI-generated video and audio had become convincing enough to deceive trained staff in a live meeting.

The claim

The employee, who worked in the finance function, first received a message that appeared to come from the company's chief financial officer in the United Kingdom, describing a confidential transaction. The employee was initially suspicious that it might be a phishing email. But they were then invited to a video call in which they saw and heard people who looked and sounded like the CFO and other colleagues they recognized. Reassured, the employee followed the instructions given and made the transfers.

Origin

Hong Kong police said the fraudsters had used publicly available video and audio of the executives, such as recordings of online conferences and company videos, to create digital replicas. During the call, the fake participants delivered instructions but did not engage in much spontaneous interaction, and the call ended abruptly. The fraud was discovered about a week later, when the employee contacted the company's head office.

In May 2024 Arup confirmed that it was the company involved. It said its financial stability and operations were not affected and that none of its internal systems had been compromised. Its chief information officer, Rob Greig, later said publicly that the attack was an example of "technology-enhanced social engineering" rather than a cyberattack in the conventional sense, since no systems were hacked; the attackers manipulated a person.

What the evidence shows

Hong Kong police described the case in a press briefing in February 2024, without initially naming the company. They said the employee had made fifteen transfers totaling HK$200 million, about US$25.6 million, to five local bank accounts. Police said it was the first case in Hong Kong in which fraudsters used deepfakes in a multi-person video conference. They also reported other cases in which fraudsters had used deepfakes and stolen identity cards to apply for loans and open bank accounts.

The case demonstrated several developments:

Real-time impersonation. Earlier deepfake frauds had mainly used cloned voices on phone calls. This case used video of multiple people at once.
Overcoming suspicion. The employee had been suspicious of the initial email. The video call was what persuaded them, because seeing familiar faces felt like confirmation.
Public material as raw data. Executives' public appearances provided enough footage and audio to build convincing fakes.

Other businesses have reported similar attempts. Several major companies have disclosed that fraudsters tried to impersonate their executives using cloned voices or video, in some cases unsuccessfully because employees asked questions only the real person could answer.

Why it matters

The Arup case is significant because it moved deepfake fraud from theory to a large, confirmed loss at a major international firm. It builds on a long tradition of business email compromise, or "CEO fraud," in which criminals impersonate executives to request urgent payments. Such fraud already causes billions of dollars in reported losses each year. Deepfakes add a powerful new layer by making impersonation visual and interactive.

The case has led security experts to recommend changes to how organizations authorize payments, including:

requiring verification through a separate, pre-agreed channel, such as calling back on a known number;
requiring more than one person to approve large or unusual transfers;
using code words or challenge questions for sensitive requests;
training staff that video and voice can be faked.

Lessons for readers

Seeing and hearing someone on a video call is no longer proof of identity.
Treat urgent, confidential requests to move money as warning signs, especially when they bypass normal procedures.
Verify requests through an independent channel you already trust, not through contact details supplied in the request.
Ask questions that only the real person would know, and slow down when pressured.
Organizations should require multiple approvals for large payments.

Sources

Hong Kong Police Force, press briefing on deepfake video conference fraud, February 2024 (reported by RTHK, South China Morning Post and CNN).
Kathleen Magramo, "Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee," CNN, May 17, 2024.
Rob Greig, remarks on the Arup deepfake incident, World Economic Forum, 2024.
US Federal Bureau of Investigation, Internet Crime Complaint Center, public service announcements on business email compromise and synthetic media.