A finance employee at the multinational engineering firm Arup was reportedly deceived into transferring $25 million by fraudsters using purported deepfake technology to impersonate the firm's CFO in a video call, according to the Hong Kong police.
Curated from incidentdatabase.ai →
The employee in Arup's Hong Kong office received an email from someone presenting as the firm's UK finance chief, asking for a confidential transaction, and was suspicious of it. What removed the suspicion was a video call: every other participant on it, including senior colleagues he recognised, was generated. He then made fifteen transfers to five Hong Kong accounts totalling about 25 million US dollars. Hong Kong police disclosed the case in February 2024 and Arup confirmed itself as the company in May. The detail that matters for anyone designing a payment process is that the controls worked exactly as intended: the employee doubted the email and sought confirmation through a second channel, and the second channel was the one that had been faked.
