The Arup deepfake scam: the $25 million video call where everyone else was fake

A finance worker in Hong Kong sent about $25 million to criminals after a video meeting in which, police said, every other person on the screen was fake.^[2][3] This case file covers how the scheme at engineering firm Arup worked, why no hacking was needed, and the one control that would have stopped the money.

What happened

How it worked

Nothing was broken into. Arup said fake voices and images were used, that its financial stability and operations were not affected, and that none of its internal systems were compromised.^[1] Its chief information officer later called it technology-enhanced social engineering rather than a cyberattack in the usual sense.^[5]

Police said the fraudsters collected genuine video and audio of the executives, including from past online meetings and public material, and used artificial intelligence to generate matching fake voices.^[3][4] According to police, the videos were largely pre-recorded, and the fake participants did not hold a real back-and-forth conversation with the employee.^[4] The criminals also used other channels, including messaging apps, email and one-on-one calls, to make the request feel routine and backed by several people.^[3]

The trick was not the technology alone. It was that a single meeting with familiar faces was treated as proof, and a large, secret, urgent payment could be approved by the same person who was being persuaded.

What it cost

The loss was HK$200 million, reported as about US$25 million to US$26 million depending on the exchange rate used.^[1][4] At the time police disclosed the case, they said the investigation was ongoing and no arrests had been made.^[4] No arrests connected to the Arup theft have been reported since in the sources reviewed for this page.

Arup's CIO said afterward that attacks of this kind happen more often than people realize, and that he was able to make a passable deepfake of himself with free software in about 45 minutes.^[5] Hong Kong police separately reported arrests in other schemes that used AI-generated faces to fool identity checks on loan and bank account applications.^[2][3]

The missing control

The missing control: verifying payment requests out of band. That means confirming a request to move money through a separate channel the requester does not control, such as calling the executive back on a number already on file, before any money leaves.

The employee did eventually do exactly this, by contacting head office, but only after 15 transfers had gone out.^[2][3] A rule that any unusual or confidential payment above a set amount must be confirmed by a call-back to a known number, and approved by a second person who was not on the call, would have forced that check to happen first. A deepfake can copy a face on a screen. It cannot answer the real CFO's desk phone.

What to do in your business

• Set a call-back rule. Any request to pay a new account, change bank details or make an urgent or secret payment gets confirmed by calling the person on a number from your own records, never one supplied in the message or meeting.
• Require two people for large payments. Pick a dollar threshold and make a second person approve anything above it, someone who was not part of the request.
• Treat secrecy and urgency as red flags. Tell staff in writing that no real executive will ever punish them for pausing a payment to verify it.
• Agree on a code word. For owners and finance staff, a private phrase that is never written in email gives a quick way to test a voice or video that seems off.
• Ask your bank about payment holds. Many banks offer delays, alerts or extra confirmation for first-time payees and large transfers. Turn them on.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.