The $25 Million Video Call: How a Deepfake CFO Fooled an Arup Employee
A finance worker joined a video call with what looked like his CFO and colleagues. Every one of them was fake. What happened at Arup in 2024, and the checks that would have stopped it.
Most fraud stories start with a careless click. This one starts with a careful employee who did the sensible thing, felt suspicious, and was then talked out of it by a video call.
What happened
In early 2024, a finance employee at the Hong Kong office of Arup, the London based engineering firm behind the Sydney Opera House, received a message that appeared to come from the company's UK office. It asked for a confidential transaction.
He was suspicious. It looked like it could be phishing.
Then he joined a video call. On screen were people who looked and sounded like the company's chief financial officer and other colleagues he recognised. They were not real. Each one was a deepfake, a computer generated likeness built to look and sound like a real person.
Reassured, the employee made 15 transfers totalling about HK$200 million, roughly US$25 million. The fraud was discovered afterwards, and Arup reported it to Hong Kong police.
Arup later confirmed that fake voices and images were used. It said none of its internal systems were compromised, and that its finances and operations were unaffected.
Why it worked
It defeated the instinct to check. The employee's suspicion was correct. The attackers anticipated it and answered it with the one thing most of us treat as proof: seeing a familiar face.
It borrowed authority. A request from the CFO, in front of other senior colleagues, carries weight. Questioning it feels awkward.
It added secrecy. Calling the deal confidential discouraged the employee from mentioning it to anyone who might have spotted the problem.
Nothing was hacked. There was no malware to detect and no breach to alert on. Every transfer was made by an authorised person using normal tools.
The lessons
1. Seeing is no longer proof
Video and voice can now be faked well enough to fool people who know the real person. Treat a familiar face on a call the way you would treat a familiar name in an email: as a claim to verify, not as verification.
2. Verify through a channel you choose
The fix is simple and boring. For any unusual or urgent payment, confirm it by contacting the requester through a channel the requester did not provide: a phone number already on file, an in person conversation, or an internal system message. A fraudster can control the call you were invited to. They cannot control the number you already had.
3. Make large payments a two person job
Require a second approver for transfers above a set amount, and make that rule unbreakable, including for requests from senior leaders. A rule that can be waived "just this once" will be waived for the attacker.
4. Make confidentiality a red flag
Legitimate confidential deals still go through normal approval. A request that asks you to skip the usual process and tell no one is a warning sign in itself.
5. Make it safe to say no
Staff need to know they will never be punished for delaying a payment to verify it, even if the request turns out to be real. That single message removes most of the pressure attackers rely on.
What this means for everyone else
You do not need a finance department to be a target. Families receive cloned voice calls from "relatives" in trouble, and small businesses receive fake supplier requests to change bank details. The pattern is the same: a convincing person, urgency, and a request to move money.
So is the defence. Slow down, and verify through a channel you choose. For families, a shared safe word does the same job as a callback rule.
Frequently asked questions
What happened at Arup?
In early 2024 a finance employee at Arup's Hong Kong office transferred about HK$200 million, roughly US$25 million, after a video call with people who looked and sounded like the company's chief financial officer and colleagues. They were deepfake recreations.
Were Arup's computer systems hacked?
No. Arup said none of its internal systems were compromised and that its finances and operations were not affected. The attack worked on a person, not on the network.
How many payments were made?
According to reporting on the case, the employee made 15 separate transfers before the fraud was discovered.
Why did the employee believe it?
He was suspicious of the first email, but the video call removed his doubts because the people on screen looked and sounded like colleagues he knew.
What is the single best defence against this kind of fraud?
A payment rule that does not depend on what you see or hear: any unusual or urgent transfer is confirmed through a separate, known channel, such as calling the requester on a number already on file, and approved by a second person.
Does this only affect large companies?
No. The same technique, a convincing fake voice or face plus urgency, is used against small businesses and families. The defence is the same: verify through a channel the caller did not choose.