The video call where everyone was fake

In early 2024, a finance employee at the Hong Kong office of engineering firm Arup received a message that appeared to come from the company's UK-based chief financial officer. It asked for a secret transaction. He first suspected a phishing email.

He then joined a video call with people who looked and sounded like the CFO and other colleagues. According to Hong Kong police, they were all deepfakes, made from public video and audio found online.

Reassured, he made 15 transfers totalling HK$200 million, about US$25.6 million. Police announced the case in February 2024 without naming the firm. In May, Arup confirmed it was the victim, that fake voices and images were used, and that its internal systems were not compromised.

A deepfake is video or audio made by AI to look and sound like a real person. The tools learn a face and voice from examples. Senior people at big companies often appear in public talks and videos, which gives fraudsters plenty to copy.

Police said the videos were pre-recorded and did not really talk with the victim. The trick worked because seeing familiar faces is a powerful signal of trust. The scam beat the employee's first, correct instinct, not any computer system.

The idea behind this caseLesson: Deepfakes and voice clones →

1. 1Require a second approval, through a separate channel, for any large or unusual payment, whoever seems to be asking.
2. 2Confirm urgent requests by calling the person back on a number you already have, not one given in the message or call.
3. 3Treat "secret" and "urgent" together as a warning sign, never as a reason to skip checks.
4. 4Agree a simple code word or question that leaders and finance staff use to verify each other.
5. 5Train finance teams with real examples like this one, so they know a familiar face on video is not proof.