An Arup employee in Hong Kong sent HK$200M (US$25.6M) after a video call where everyone else was a deepfake. How the fake meeting worked and what stops it.
Social Engineering Examples·12 sources
In January 2024, a finance employee at Arup's Hong Kong office joined a video conference with what looked like the company's UK chief financial officer and several colleagues. Hong Kong police say every one of them except the employee was a deepfake, built from public video. The employee made 15 transfers totalling HK$200 million, about US$25.6 million, to five Hong Kong bank accounts. No money has been publicly reported as recovered. Status: Documented incident, under investigation.
| When | Event |
|---|---|
| Mid-January 2024 | A message, supposedly from the UK CFO, about a confidential transaction. The employee suspects phishing |
| Next | A video conference where the "CFO" and "colleagues" appear |
| Over about a week | 15 transfers, HK$200 million in total, to five local accounts |
| 29 January 2024 | The employee checks with head office, finds the fraud, and police receive the report |
| 2 February 2024 | Police describe the case publicly, without naming the company |
| May 2024 | The Financial Times names Arup, and Arup confirms |
Police said two or three other staff at the branch were approached the same way. Only one lost money.
Police said the fraudsters took public video and audio of the executives from YouTube and used deepfake tools to make them appear to read a script. The meeting was effectively a pre-recorded performance. The employee was asked to introduce themselves, the fake participants gave instructions, and the call ended suddenly. The Hong Kong government later told the Legislative Council there was "actually no interaction" between the employee and the fraudster on the call.
Arup said: "We can confirm that fake voices and images were used." See deepfake scams and CEO fraud.
Tip: seeing your boss on video isn't approval. For any large payment, call them back on a number you already have.
See also how to prevent deepfake fraud and how to spot a deepfake.
HK$200 million, about US$25.6 million, sent in 15 transfers to five Hong Kong bank accounts.
Hong Kong police said every participant except the employee was fake, built from public video.
Arup says none of its internal systems were compromised. The money was sent by an employee who was deceived.
No arrest or charge has been publicly linked to the case. Police were still investigating as of June 2024.
Social Engineering Examples. “Arup's $25.6M deepfake video call fraud (2024)”. Accessed 3 November 2026. https://socialengineeringexamples.com/arup-deepfake-cfo-video-call-2024
Attackers selected the group's UK-based CFO and other staff as impersonation targets and collected public video and audio of them. Hong Kong Police said the material was found on YouTube. Arup is trust-owned rather than listed, so this was not investor-relations material; it is the ordinary public footage any large professional-services firm's leadership generates.
Public video and audio of senior staff is not realistically suppressible at Arup's size, and police traced this set to YouTube. The workable response is to assume the material already exists and harden the steps downstream, not to try to remove it.
That footage was used to generate deepfake video and cloned voices. Police described the product as a pre-recorded video conference rather than a live puppeteered call, and said the fraudsters used deepfake technology to imitate the voices of their targets reading from a script.
There is no practical control on generating synthetic media from footage that is already public. The defense sits at verification, not at content generation.
A phishing message impersonating the UK-based CFO opened the scheme in mid-January 2024, raising a confidential transaction that had to be carried out and establishing a reason for secrecy before any video was shown. The employee's first reading of it was that it was a phishing attempt.
Treat any request that demands secrecy around a payment as an automatic trigger for independent review at manager level, whoever appears to be asking. The employee's initial suspicion was correct; what was missing was a route to act on it that did not run back through the requester.
The employee was invited onto a video conference populated by the deepfaked CFO and other deepfaked colleagues. Police said everyone visible except the employee was fabricated, which manufactured social proof that a single impersonated caller could not achieve. Police gave no count of fake participants and Arup has never confirmed one.
Do not treat seeing and hearing people on a call as identity evidence. Verify high-value instructions on a channel the requester did not choose. A call full of familiar senior faces is a reason for more scrutiny, not less.
The synthetic participants issued instructions and did not converse. Police said the employee was asked to give a self-introduction but did not otherwise interact with anyone on the call, and that the meeting then ended abruptly. Pre-recording removes the risk that an unscripted question breaks the illusion, at the cost of any real dialogue.
Hong Kong Police advised asking participants to move their heads or answer unscripted questions. Against pre-recorded video this defeats the attack outright, because pre-recorded participants cannot respond at all. The organizational work is making it socially normal for a junior employee to challenge a room of seniors.
Reassured by the call, the employee acted on the payment instruction. The Hong Kong Government's account adds that the fraudster ended the meeting on a pretext and continued the transfer instructions over instant messaging, so the video conference served as the credibility step rather than as the channel for the whole scheme. No source describes what payment controls Arup had in place; Arup declined to discuss detail while the investigation was open.
Require out-of-band verification against an independently sourced number, plus dual authorization, for large or unusual transfers, with no exception for seniority or secrecy. Treat a channel switch, here from video conference to instant messaging, as a trigger to re-verify rather than as a continuation of an approved conversation.
The employee made 15 transfers to five Hong Kong bank accounts over about a week, splitting HK$200M across multiple accounts and transactions, a pattern harder to freeze quickly than one large transfer. The fraud surfaced only when the employee followed up with the group's headquarters.
Bank-side monitoring for repeated same-week transfers to newly added payees can flag this pattern before every tranche clears, and a cap on cumulative transfers to new payees forces a second review before a scheme can be split into many smaller payments.
Browse by what this case has in common with others in the library.
Fraudsters faked WPP CEO Mark Read on WhatsApp and staged a Teams call with a cloned executive voice. The agency…
An attacker sent a LastPass employee WhatsApp calls and a voicemail using an AI copy of the CEO's voice. The…
KnowBe4 hired a North Korean operative using a stolen US identity and an AI-enhanced photo in 2024. Malware started on…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
Advance Machine Company's West Coast sales manager repeatedly rifled Tennant Company's sealed, covered dumpster in California to steal sales leads.
Fake QR stickers on UK council parking machines sent drivers to cloned payment sites. 123 of 373 councils were hit…
A Pennsylvania shredding-business owner's 2010 qui tam suit alleged that Shred-It, Iron Mountain.
Scammers hijacked a real invoice thread with a lookalike domain and got an Arkansas school district to wire $3.2M. $1.1M…
Argan's Fiscal 2024 cybersecurity disclosure described fraudulently induced outbound wire transfers in March 2023 and reported $2.7 million of loss,…
Fraudsters posing as Tecnimont's group CEO, other executives, and a fictitious Swiss lawyer used spoofed emails and a staged series…
Greenpeace alleged in a civil suit, dismissed in both forums without any finding on the merits, that Dow Chemical and…
A Costa Rica-based telemarketing ringleader used VOIP-spoofed Washington D.C. caller ID and fake government-official personas to convince hundreds of mostly…
A deepfaked Martin Lewis Facebook ad led to a fake adviser, a Revolut account, £5,000 of savings and £70,000 in…
Anthropic says a UK cybercriminal used Claude to build ransomware they couldn't write alone, then sold kits for $400 to…
Two Scottish small businesses lost £31,000 and over £5,000 after callers impersonating bank fraud-team staff talked owners into wiring money.
An unrelated MHRA search warrant found care-home patient prescription and NHS records rotting in unlocked crates and bin bags at…
A Metropolitan Police officer spotted customers' passports and tax-credit paperwork clearly visible through transparent bin bags left on the street.
Fraudsters faked WPP CEO Mark Read on WhatsApp and staged a Teams call with a cloned executive voice. The agency…
A compromised email sent a Wheeling, WV nonprofit a fake solar panel invoice. It paid $30,750 to an Oklahoma man's…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
Fraudsters impersonating FACC's CEO by email convinced finance staff to wire roughly EUR 50M for a fake acquisition project; EUR…
A small Columbus, Ohio public materials manufacturer disclosed in a February 2026 SEC 8-K that it lost $898,325 to an…
Fraudsters faked WPP CEO Mark Read on WhatsApp and staged a Teams call with a cloned executive voice. The agency…
A spoofed-email scheme impersonating MacEwan University's trusted general contractor, Clark Builders, tricked staff into redirecting $11.8 million CAD in construction…
Social Engineering Examples