Arup deepfake video-conference fraud in Hong Kong

A finance employee in the Hong Kong office of engineering firm Arup transferred about $25 million to fraudsters after joining a video conference in which the chief financial officer and other colleagues were deepfake recreations. Hong Kong police described the case in February 2024 without naming the company, and Arup confirmed in May 2024 that it was the firm involved.

What happened

Police said the employee first received a message that appeared to come from the UK-based chief financial officer and suspected phishing, because it asked for a secret transaction. Those doubts faded during a multi-person video call in which every other participant looked and sounded like a known colleague but was generated. The employee then remitted a total of 200 million Hong Kong dollars. Police did not name the company or the worker at the time.

Impact

The reported loss is 200 million Hong Kong dollars, which CNN put at about $25 million. Arup told CNN that its financial stability and business operations were not affected and that none of its internal systems were compromised. The fraud came to light only when the employee later checked with head office.

Response

An Arup spokesperson said the company notified Hong Kong police in January 2024 and confirmed that fake voices and images were used, while declining further detail because of the ongoing investigation. Arup's global chief information officer said the number and sophistication of attacks on the firm, including deepfakes, had been rising sharply.

Lessons for security leaders

A live video call can no longer serve as proof of identity for payment approval. Require an out-of-band callback to a number already on file before any urgent or confidential transfer, and make sure no single employee can release large sums alone. Train finance teams that a request stressing secrecy is itself a warning sign, and give them explicit permission to delay a senior executive while they verify.