The Arup deepfake: a video call where everyone else was fake

In early 2024 a finance employee at the Hong Kong office of Arup, the British engineering firm, received an email from the company's chief financial officer in the UK asking for a confidential transaction. The employee suspected phishing. Then came a video call. The chief financial officer was on it, along with several colleagues the employee recognised. By the end of that day the employee had made 15 transfers, worth HK$200 million or about $25.6 million, to five bank accounts in Hong Kong.

Every other face and voice on the call was generated, built from public video and audio of real Arup staff. The call did the one thing the email could not: it gave the employee people to see. A room of familiar colleagues all behaving normally is exactly the evidence a careful person looks for, and it was the part the attackers had made.

The fraud came to light only when the employee checked with head office afterwards. Hong Kong police announced the case in February 2024, and Arup confirmed it was the victim in May. No arrests have been announced.

• —Detection inside the meeting. A face swap holds up frame by frame but slips between frames, and a cloned voice carries its own traces. Scored during the call, both show up while the transfer can still be stopped.
• —A verdict for every participant, not one for the meeting. When the whole room is synthetic, a check on one face is not enough.
• —A rule that a video call never authorises a payment on its own, however many senior people are on it.
• —Callbacks to numbers already on file before any confidential transfer leaves the building.