Deepfake video call used to steal $25 million from Arup's Hong Kong office

A finance employee at the British engineering firm Arup’s Hong Kong office was persuaded to make 15 wire transfers totalling roughly HK$200 million (about $25.6 million) after joining a video call with people he believed were the company’s UK-based chief financial officer and other colleagues. Hong Kong police, who disclosed the case in early February without naming the company, said every participant on the call other than the employee was an AI-generated recreation.

According to police accounts reported at the time, the scam began with an email purporting to come from the CFO about a confidential transaction. When the employee expressed doubts, he was invited onto a video call to confirm the instruction; the “senior officers” he saw and heard on the call responded to him, and he later authorised the transfers over the course of about a week. The impersonations were reportedly built from publicly available video and audio of the real executives, harvested from earnings calls, conferences and other footage previously posted online. The fraud came to light only when the employee checked with Arup’s head office about the transaction.

Arup confirmed in May that it was the victim, after Hong Kong media reporting and its own internal investigation made the connection increasingly hard to avoid. No arrests were announced, and the transferred funds were not recovered.

The case became one of the most widely cited examples of “vishing”-style fraud escalated by generative video and voice, and was repeatedly invoked in briefings to executives and boards about the need for out-of-band verification of high-value payment requests — a call back to a known number, not a reply to the same channel the request arrived on — regardless of how convincing a video or voice on the line appears.