TL;DR
- 01What happened
In January 2024, a finance employee at the Hong Kong office of UK engineering firm Arup, acting on instructions in the name of the UK head-office CFO, sent about HK$200 million (about US$25.6 million) to five accounts in 15 transfers over one week. What made the instructions believable was a video call showing the CFO and colleagues; everyone on screen was a fake built from publicly posted video and audio. Hong Kong police disclosed the case on February 2, and Arup confirmed it was the victim in May.
- 02Why it was hard to tell
The employee suspected the first message was phishing, but a meeting full of familiar faces and voices dispelled the doubt. The call was pre-recorded with no dialogue; the fake CFO ended it on a pretext, and later instructions came by messaging app and other channels.
- 03The missing layer
The employee spotted the fraud by checking with head office, but only after 15 transfers had gone through. What failed was the layer that confirms a payment instruction is genuine, through a channel other than the one it came in on, before it is carried out.
What happened
- Who
- A finance employee at the Hong Kong office of Arup, a major UK engineering firm. The instructions came in the name of the UK head-office CFO.
- Loss
- About HK$200 million (about US$25.6 million), sent in 15 transfers to five Hong Kong bank accounts within one week.
- How
- In mid-January a message in the CFO’s name proposed a “secret transaction”. The employee was suspicious, but the CFO and colleagues appeared on a video call the employee was invited to, and all of them were fakes. Police said it was a recording made from video and audio posted on YouTube and elsewhere, with no dialogue with the employee. The fake CFO ended the meeting on a pretext and continued the instructions by messaging app, email and one-to-one video calls.
- Discovery
- The employee checked with the UK head office. The case was reported to police on January 29.
- Internal systems
- Arup said none of its internal systems were compromised and its finances and operations were not affected. Its CIO later called it “technology-enhanced social engineering”.
- Investigation
- Still under investigation as of June 2024 (LegCo reply). As of October 2026, no arrests or recovery of funds in this case have been reported.
Glossary
Deepfake — AI-made video or audio that imitates a real person. Publicly posted video and audio are the raw material.
Business email compromise (BEC) — Fraud that poses as an executive or supplier to order a payment or a change of bank details. Here a video call was added to the email.
Callback — Calling the person back on a contact registered in advance, not the one the instruction came from, to confirm it is really them.
The point to stop it was between ③ and ④: after the meeting dispelled the doubt, and before the first transfer, there was a chance to confirm with head office through a channel other than the meeting.
Material from YouTube and elsewhere.
The employee suspects phishing.
No dialogue; the meeting ends on a pretext.
Instructions continue by messaging app and more.
Timeline — disclosure and response
- A message in the name of the UK head-office CFO reaches the employee. It is about a secret transaction, and the employee suspects phishing.
- The employee joins the video call and, following instructions, makes 15 transfers to five accounts.
- After checking with head office, the employee realises it is a fraud and the case is reported to police.
- Hong Kong police’s Cyber Security and Technology Crime Bureau (CSTCB) discloses the case at a briefing, without naming the company.
- Arup confirms to CNN and others that it was the victim: “fake voices and images were used”.
- Hong Kong’s Secretary for Security answers in the Legislative Council: the meeting was pre-recorded with no interaction, and the case is under investigation.
Facts rest on the Hong Kong government’s Legislative Council reply (primary), Arup’s statement and its CIO’s interview, and reporting of the police briefing. The date of the video call has not been disclosed, and reports differ on how many people appeared in it.
After disclosure
- Hong Kong police: Advised testing a suspicious video call by asking the person to move their head or by probing with questions, and calling to check when a relative or friend asks for money (LegCo reply).
- Arup: Said attacks such as invoice fraud, phishing, WhatsApp voice spoofing and deepfakes were rising in number and sophistication.
Why it wasn’t stopped
This case was not a failure of the employee’s care or of the meeting software. The payment instruction was checked only inside the channels it arrived through (the messages and the meeting), and those channels were fake end to end.
A meeting full of familiar faces and voices was taken as proof that a payment instruction was genuine.
Proof works before a transfer is made; detection works after the fraud surfaces. In between, the faces and voices seen on the call are treated as the reason to believe the instruction.
Head office not yet asked
Detection worked: the employee doubted the first message and in the end found the fraud by checking with head office. But that check came after the transfers, and although “I saw the CFO on a call” and “the CFO ordered this transfer” are separate facts, the first was accepted as grounds for the second. That distance is the detection–proof gap, and it is a structural one.
The same structure appears in eKYC liveness bypass (fabricated video passing an identity check).
How to counter this
Confirm a payment instruction through a channel other than the one it arrived on, before paying. However good fake video gets, confirming with the person on a contact registered in advance tells you whether the instruction is genuine regardless of the video. Make it a rule that this check is never skipped, least of all for large transactions or instructions labelled “secret” or “urgent”.
Industries and operations to watch
- IndustryFinance & FinTech
- Finance and accounting teams that can be told to pay by an overseas head office or parent company. The more executives’ video and voice are public through talks and social media, the more raw material there is for fakes.
- OperationApproval & sign-off
- Paying on the strength of a manager’s instruction or approval. Here, seeming to meet the instructing person on a call stood in for approval.
Do today’s controls close it?
| Control | This case | Why |
|---|---|---|
| Caution about suspicious messages | Partial | The employee doubted the first message, but the following meeting dispelled the doubt. |
| Confirming with a manager on a video call | Ineffective | The meeting used to confirm was itself fake video and voices. |
| Approval by more than one person | Partial | It still passes if approvers rely on the same meeting or the same channel’s instructions. |
| Checking with head office | Partial | It revealed the fraud, but only after the transfers. |
- Confirm with the person through a separate channel. Call back on a phone number or account registered in advance, such as the internal directory. Contacts given in the instruction, or checks inside the same meeting or chat, do not count.
- Hold the transfer until it is confirmed. Transfers that meet set conditions, such as amount or a new payee, are not made until the check is done. Treat “secret” and “urgent” as reasons to hold.
- Record who confirmed, and through which channel. For each transfer, record who checked, the channel and the time, in a form that can later be shown to a third party: in other words, as proof.
Three things to confirm in your organisation about payment instructions from managers or head office
- Is there a set procedure to confirm a payment instruction in a manager’s name with them through a separate channel?
- Is that check impossible to skip, whatever the amount or a “secret” label?
- When an employee doubts an instruction, is it clear who they can stop and consult?
Note: if the registered contact itself is hijacked, the separate-channel check passes too. The extra step also delays urgent legitimate payments. The police’s spotting tips (asking the person to move, testing with conversation) work against recorded fakes, but video generation keeps improving, so spotting alone cannot be relied on.
Sources
- Primary, LegCo replyHong Kong SAR Government, Security Bureau “LCQ9: Combating frauds involving deepfake”
- Primary, Arup CIO interviewWorld Economic Forum “‘This happens more frequently than people realize’: Arup chief on the lessons learned from a $25m deepfake crime”
6 more (reporting, analysis)
- Reporting, quotes Arup’s statementCNN “Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee”
- Reporting, quotes Arup’s statementFortune “A deepfake ‘CFO’ tricked the British design firm behind the Sydney Opera House in $25 million fraud”
- Reporting, police briefingThe Standard “HK’s first deepfake video conference scam involving HK$200 million”
- Reporting, AFPHong Kong Free Press “Multinational loses HK$200 million to deepfake video scam”
- ReportingCNN “Finance worker pays out $25 million after video call with deepfake ‘chief financial officer’”
- ReportingSouth China Morning Post “‘Everyone looked real’: multinational firm’s Hong Kong office loses HK$200 million after scammers stage deepfake video meeting”
References: “The last layer left for cyber defense in the age of AI”, “Proof-as-Auth: sign in without ever sending your key”