// AI threat desk · 30 Sept 2026
Home/AI-ATK · AI-Powered Attacks
AI-Powered AttacksHighUS$25.6M

Deepfake CFO on a video call cost Arup's Hong Kong office about US$25.6M

In January 2024, a finance employee at the Hong Kong office of British engineering firm Arup joined a video conference where the 'CFO' and colleagues were all deepfakes. Following their instructions, the employee transferred about US$25.6M to five local bank accounts. It was Hong Kong's first publicly reported deepfake video-call fraud against a company, and it shows the risk of approving payments because you 'saw' the person asking.

29 Sept 2026, 22:55 HKT · 2 min read
Office towers in Central, Hong Kong, at night
File photo: Office towers in Central, Hong Kong, at night. Photo: rawpixel (CC0)
Key takeaways
  • Fraudsters posed as the CFO of Arup's UK head office by message, then ran a multi-person video call using pre-recorded deepfake videos.
  • The employee sent about US$25.6M to five local bank accounts. It came to light only when the employee checked with head office.
  • The same method appeared again in May 2024, when an employee of a multinational trading company lost nearly US$510,000.

The scam began with a message about a confidential deal

According to a written reply to the Legislative Council by Secretary for Security Chris Tang on Jun 26, 2024, the victim received a phishing message from someone posing as the UK head office's chief financial officer. It described a confidential transaction and invited the victim to a multi-person video conference. The fraudsters used videos pre-recorded with deepfake technology. When police disclosed the case on Feb 2, 2024, they said the employee first suspected a phishing email but dropped those doubts after the call, because the attendees looked and sounded like colleagues he knew. Acting Senior Superintendent Baron Chan Shun-ching said everyone on the call except the employee was fake.

Payments went to five local accounts, and a call to head office exposed it

The LegCo reply says the victim authorised transfers to five local bank accounts, with losses of about US$25.6M. RTHK, citing police, reported that the money was sent in 15 transactions. Police said the fraud was discovered only when the employee later checked with head office.

Arup says its finances and internal systems were not affected

An Arup spokesperson confirmed to CNN that the company notified Hong Kong police in January 2024 and that fake voices and images were used. The spokesperson said the company could not give details while the investigation continues, and that its financial stability and business operations were not affected and none of its internal systems were compromised. Rob Greig, Arup's global chief information officer, said the company faces regular attacks, including invoice fraud, phishing, WhatsApp voice spoofing and deepfakes, and that their number and sophistication had risen sharply in recent months.

A second case cost nearly US$510,000

The LegCo reply says police had received three cases involving deepfake technology as of May 31, 2024. Besides Arup, in May 2024 an employee of a multinational trading company received a WhatsApp message from someone posing as the UK head office's CFO. After a video conference of nearly 30 minutes, the fake boss told the employee to transfer nearly US$510,000 to one local account. The third, in August 2023, used AI face-swapping and stolen identities to apply for loans worth about US$25,600; police arrested nine people.

What to do now

  1. Verify any large or 'confidential' payment request by calling back on a number you already have, never one given in the message or the call. (Police advise phone verification; calling a known number is standard practice.)
  2. Require two approvers for large transfers. (Standard practice.)
  3. On a video call, ask for specific head movements, or ask questions only the real person could answer. (Police advice.)
  4. Do not accept video calls from unknown contacts. (Police advice.)
  5. If you suspect fraud, call the police Anti-Scam Helpline 18222 or report to police at once, and contact your bank to try to stop the payment. (Police hotline; contacting the bank is standard practice.)
  6. Add this case to your finance team's annual fraud training. (Standard practice.)

FAQ

Which company lost US$25.6M in the deepfake video-call scam?

The Hong Kong office of British engineering firm Arup. Police did not name the company when they disclosed the case; Arup confirmed it to CNN in May 2024.

How did the fraudsters convince the employee the call was real?

They first sent a message posing as the UK head office's CFO, then held a multi-person video call using pre-recorded deepfake videos. The attendees looked and sounded like colleagues the employee knew.

Have there been other deepfake scams like this in Hong Kong?

Yes. In May 2024, an employee of a multinational trading company was told by a fake boss to transfer nearly US$510,000 after a video call of nearly 30 minutes. Police had received three deepfake cases by the end of May 2024.

What is a deepfake?

A deepfake is a fake video or voice made with AI that can make a person appear to say things they never said. Fraudsters usually build them from publicly available video.

How can I spot a deepfake on a video call?

Police advise asking for specific head movements, testing the person through conversation, and verifying any payment request by phone. Do not accept video calls from unknown contacts, and call 18222 if in doubt.

HKCERTDeepfakeHKMAPhishing
Related storiesSee all in AI-Powered Attacks →
Explore with AI
ChatGPT
Claude
Perplexity
Grok