Hong Kong police disclosed that a finance employee at a multinational firm had transferred HK$200 million (about US$25.6m) after joining a video conference in which the company’s UK-based chief financial officer and other colleagues were deepfake recreations. The firm was later confirmed as the British engineering group Arup.
What happened
- The employee first received a message, apparently from the CFO, about a secret transaction and initially suspected it was a phishing attempt.
- A video call with what appeared to be the CFO and other familiar colleagues persuaded the worker to make 15 transfers to five local bank accounts.
- Police said the fraudsters had used publicly available video and audio of the people being impersonated to create the fakes.
- Arup confirmed in May 2024 that it was the victim and said none of its internal systems had been compromised.
Why it mattered
It was one of the first widely reported cases of a multi-person deepfake video call used for fraud, showing that seeing and hearing a colleague is no longer proof of identity.
Lessons for organisations
Payment processes should require out-of-band verification through a known channel for any urgent or unusual transfer, however senior the requester appears. Staff awareness training should now cover voice and video impersonation, not just phishing emails.
Sources: CNN, CNN (Arup)
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
