What happened
In January 2024 a finance employee in the Hong Kong office of Arup, a UK engineering firm, received a message that appeared to come from the company's chief financial officer in the UK. It asked for a secret transaction. CNN reported that the employee at first suspected it was a phishing email.
Then came a video conference. On screen were the CFO and several colleagues the employee recognised. Hong Kong police later said that everyone else on the call was fake. The acting senior superintendent, Baron Chan, said he believed the fraudsters had downloaded videos in advance and used artificial intelligence to add fake voices. Convinced, the employee made 15 transfers to five local bank accounts, totalling HK$200 million. The fraud came to light when the employee checked with the head office, about a week later according to Global News.
Hong Kong police described the case in early February 2024 without naming the company. In May 2024 Arup confirmed that it was the victim.
The email
The early press reports differ on one word. CNN's first report, in February, said the employee received a message. Global News, citing police remarks broadcast in Hong Kong, said an email. In June 2024 Hong Kong's Secretary for Security settled it in a written reply to the Legislative Council: the case began when the employee received a phishing email from a fraudster impersonating the chief financial officer. After the video conference, the fraudster kept giving instructions by instant messaging.
All sources agree on what the first contact asked for: a confidential transaction, in the name of the most senior finance person in the company. So the attack began with an email, and the employee's instinct about it was right. The money was lost on the video call.
Why it worked
The employee did the sensible thing at first and doubted the message. The fraudsters had prepared for that doubt. A video call with familiar faces is exactly what a cautious person might ask for as proof. Here the proof was fake too. The request for secrecy kept the employee from asking anyone outside the call, and the authority of the CFO made questions feel out of place.
Arup's global chief information officer, Rob Greig, told CNN that the number and sophistication of such attacks had been rising sharply in recent months.
What it cost
HK$200 million, which CNN put at about US$25.6 million. Arup said its financial stability and operations were not affected and that none of its internal systems were compromised. No recovery was reported in the sources.
What would have helped
A rule that a video call cannot break. Requests to move money, especially secret ones from senior people, are confirmed through a separate channel the requester did not choose: a call to a number in the company directory, or a word with a colleague in person. Secrecy is a warning sign in itself. A real executive can wait ten minutes for a call back.
What a warning inside the message would have shown. Antilure marks wording that asks for secrecy and flags a display name that impersonates someone else. Its banner says: don't reply or pay, check with the sender another way. That is the doubt the employee already had, written into the message, before any call was arranged.
Sources
- Finance worker pays out $25 million after video call with deepfake 'chief financial officer', Heather Chen and Kathleen Magramo, CNN, 4 February 2024.
- Company out $35M after scammers stage video call with deepfake CFO, coworkers, Kathryn Mannie, Global News, 5 February 2024. The $35 million in the headline is in Canadian dollars.
- British engineering giant Arup revealed as $25 million deepfake scam victim, Kathleen Magramo, CNN, 16 May 2024.
- LCQ9: Combating frauds involving deepfake, written reply by the Secretary for Security, Hong Kong SAR Government, 26 June 2024.
- Arup victim of multimillion-dollar deepfake video scam in Hong Kong, Lizzie Crook, Dezeen, 17 May 2024.