This week the engineering firm Arup confirmed what Hong Kong police first described in February: a finance employee transferred about HK$200 million, roughly US$25.6 million, after a video call in which the “chief financial officer” and several colleagues were deepfakes.13
What happened
According to police, the employee first received a message in January, apparently from the UK-based CFO, about a confidential transaction. He was suspicious until a group video call put familiar faces and voices in front of him. He then made 15 transfers.2 Police said the participants were recreated from publicly available video and audio.1
Arup told CNN that fake voices and images were used, and that its financial stability, business operations and internal systems were not affected.3 That last point is the lesson. Nothing was hacked. A process was.
Why it matters to the board
Most payment controls assume the risk is a spoofed email. The standard advice, “call to confirm”, quietly assumes that seeing and hearing someone proves who they are. This case breaks that assumption. Executives who appear on earnings calls, conference panels and podcasts have already published the training data.
The exposure sits with the people who can move money quickly and with the executives whose authority they act on. It is a governance problem as much as a technical one.
Three questions for your next board meeting
- Which payments can be approved on the strength of a call or meeting alone, and what is the dollar ceiling?
- Do we have an out-of-band check (a known number, a pre-agreed phrase, a second approver) that a convincing video cannot satisfy?
- When did our finance team last rehearse an urgent, secret request from a senior executive?
How we help
We map who can move money and on whose word, then rebuild approval paths that hold up against impersonation. Our Heist Design war-game runs this exact scenario against your leadership team, so the first time they meet a deepfake CFO is in a rehearsal. Brief a CISO.
References
- South China Morning Post, “‘Everyone looked real’: multinational firm’s Hong Kong office loses HK$200 million after scammers stage deepfake video meeting”, February 2024. scmp.com
- CNN, “Finance worker pays out $25 million after video call with deepfake ‘chief financial officer’”, 4 February 2024. cnn.com
- CNN, “Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee”, 16 May 2024. cnn.com
- South China Morning Post, “UK multinational Arup confirmed as victim of HK$200 million deepfake scam”, May 2024. scmp.com