In early 2024, an employee in Arup’s Hong Kong operation transferred approximately HK$200 million—reported at the time as roughly £20 million—after fraudsters posed as senior colleagues in a video conference. Arup later confirmed that fake voices and images were used. The case shows why a familiar face or voice on screen is not proof of identity, and why large payments need independent checks that do not rely on the call itself.
What happened in the Arup deepfake scam?
Hong Kong police received a report on January 29, 2024, that an employee had been deceived into transferring approximately HK$200 million. Police details became public on February 5, while the company was initially unnamed. Arup was identified in media reports in May and confirmed that it had reported a Hong Kong fraud incident involving fake voices and images. The Guardian’s February account and its May report describe those stages.
The amount was reported as approximately HK$200 million, commonly converted in coverage to about £20 million or US$25 million. Those are approximate currency equivalents, not separate confirmed totals. Hong Kong police reporting carried by The Guardian said the employee made 15 transfers to five local bank accounts.
How the fraud unfolded
- Initial approach: The employee reportedly received a message that appeared to come from the company’s UK-based chief financial officer about a confidential transaction.
- Apparent corroboration: The employee joined a group video call that appeared to include several recognizable senior employees.
- Payment instructions: The request was presented as authorized, and the employee transferred money in multiple transactions.
- Discovery: The employee became aware of the deception after contacting the genuine head office.
The call combined several cues that can feel like independent confirmation: a familiar face, a familiar-sounding voice, senior job titles, other apparent colleagues, and pressure to keep the matter confidential. But all those cues arrived through the same potentially manipulated interaction. They did not independently verify the request or the destination bank accounts.
#1 Best Overall
What is confirmed—and what remains unclear
| Point | What the public record supports |
|---|---|
| Company and incident | Arup confirmed in May 2024 that it had reported a Hong Kong fraud incident involving fake voices and images, after police initially described an unnamed company. Source: The Guardian, May 17, 2024. |
| Money and transfers | Approximately HK$200 million; police reporting carried by The Guardian described 15 transfers to five local accounts. Pound and US-dollar equivalents vary with exchange rates and publication date. Source: The Guardian, February 5, 2024. |
| Source material | Hong Kong police said criminals were believed to have used publicly available video material and AI manipulation. Source: Hong Kong Government, June 26, 2024. |
| Exact production method | The public record does not establish which software, AI model, conferencing platform, or live-generation method was used. No specific product has been publicly identified. |
| Internal systems | Arup said its internal systems had not been compromised and that its financial stability and operations were unaffected, as reported in May 2024. That statement is not a complete public forensic account of every account, device, or external service. Source: The Guardian, May 17, 2024. |
Was the video call live?
Not conclusively, based on the public information. Reports described a deepfake video conference, while Hong Kong police said the criminals were believed to have used manipulated public video and AI-generated voices or images. The available official account does not establish whether the meeting was fully interactive and generated in real time, prerecorded, or a hybrid. It also does not identify a particular AI model.
Was Arup hacked?
Arup said its internal systems were not compromised. The publicly described mechanics point to impersonation and social engineering used to induce payments, rather than establishing that attackers breached Arup’s core network. That does not prove that no individual account, device, or external service was accessed; it reflects the scope of Arup’s public statement.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
Why video is not identity verification
Seeing someone on screen establishes only that an image appeared in a call. Hearing a familiar voice does not confirm the caller’s telephone number or account. A group meeting can create social proof, while publicly available speeches, interviews, company videos, and social-media clips can supply material for impersonation. A demand for secrecy can further isolate the employee from ordinary checks.
For payment decisions, authentication means verifying a person and instruction through a trusted process. Familiarity is not authentication. A real executive account can also be compromised, and an authentic meeting can contain fraudulent payment instructions. The control must therefore verify the request and beneficiary independently of the person making it.
Recommended Free Tools
Payment controls that reduce the risk
The strongest safeguards are ordinary financial controls designed to work even if a caller’s face and voice cannot be distinguished from the real person.
- Separate request and release: Do not let one employee both request and release a high-value transfer. Require at least two independent approvers for material payments.
- Set approval thresholds: Route transactions above defined amounts to the appropriate controller, treasury leader, CFO, or board-level approver.
- Use a known-channel callback: Confirm unusual instructions by calling a number already in the company directory or vendor record—not contact details supplied in the message or call.
- Keep payment instructions in an approved workflow: A chat, email, phone call, or video meeting should not replace the formal payment process.
- Verify beneficiaries: Use bank-account verification and beneficiary allowlists. Treat changes to existing payment details as high-risk requests requiring confirmation through a separate, previously established channel.
- Add friction for new or unusual payments: Consider a cooling-off period for new beneficiaries, limits on exceptional transfers, and monitoring for rapid payments to newly introduced accounts.
- Make secrecy an escalation trigger: Confidentiality should not exempt a payment from controls; it should prompt additional independent approval.
- Make approvals auditable: Keep records of who requested, verified, approved, changed, and released a payment, using channels separate from the requester.
Small businesses do not necessarily need a large treasury platform to apply these principles. Dual approval, a callback to a known number, payment limits, and bank alerts can establish meaningful barriers. Emergency procedures should add approvers and recordkeeping rather than create a verbal bypass.
Rank #4
Where security software fits—and where it does not
Email and collaboration security can help detect impersonation, phishing, and business-email-compromise attempts, but it cannot by itself authorize a bank transfer or prove who is on a video call. Microsoft describes impersonation and related protections in its Defender for Office 365 overview and discusses a broader security approach in its Zero Trust guidance. Those tools are one layer in a program that still needs payment controls.
Synthetic-media detection may help flag suspicious audio or video, but results can vary with media quality and attack methods; detection can produce false positives and false negatives. Treat it as a risk signal that prompts a separate check, not as a final identity test or the sole basis for releasing funds. A company considering a specialist tool should examine its handling of replayed and prerecorded content, latency, audit logs, integration, and false-positive review.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
What to do during a suspicious executive request
- Stop the payment process. Do not release funds while an unusual request is being checked.
- Do not share more information. Avoid disclosing credentials, one-time codes, bank details, or confidential data.
- Move to the established workflow. Ask for the request to be submitted and approved through the company’s normal financial process.
- Verify independently. End the call and contact the executive through a known corporate number or directory entry, then alert the finance controller, security team, or fraud hotline.
- Preserve evidence. Retain messages, meeting invitations, call details, recipient account information, and transaction timestamps; do not delete material before reporting it.
- If money has moved, call the bank immediately. Ask it to recall the transfer or freeze destination funds, then notify the relevant police and cybercrime authorities under the organization’s incident procedure.
What the Arup case teaches businesses
The case does not show that every video call can be convincingly faked, identify the exact technology used, or prove that a detector would have caught the fraud. It does show why a video meeting should never substitute for independent payment authorization. The key questions for any organization are whether the requester and approver are separate, whether verification uses a channel the requester did not provide, whether new beneficiaries face extra checks, and whether staff can stop a payment without being overruled by urgency or seniority.
Employees should be empowered to challenge even senior colleagues and to report suspicious requests without blame. The central control question is not whether the employee spotted visual artifacts; it is whether the payment process allowed a single interaction to stand in for independent authorization.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
