Deepfake: Architectural and engineering office, Hong Kong 2024
An employee in Hong Kong received an email from the supposed CFO in London about a confidential transaction.
- Incident · 01.2024 · Hong Kong, Hong Kong
- Evidence: confirmed by an authority
- Deepfake
- Deception (social engineering)
- Fake payment instruction
- AI link
As of
What happened
In a subsequent video conference, the other participants looked and sounded like familiar colleagues, but were fake. Over around a week, he made 15 transfers to five accounts; the fraud only came to light when he checked back with headquarters.
Role of AI: All the other participants in the video conference (including the CFO) were deepfakes, created from earlier video recordings according to the police.
- Affected
- Arup (Hong Kong office)
- Loss
- HKD 200 million (around USD 25 million)
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- Email from the supposed CFO, followed by a video conference with AI-generated participants
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
CEO fraud, diverted payment, fake invoice
Mostly add-on 5 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Never approve payment orders on the strength of a video call alone; confirm them via a second, known channel.
Sources
- UK multinational Arup confirmed as victim of HK$200 million deepfake scam that used digital version of CFO to dupe staff (opens in a new window) South China Morning Post · 2024-05
- Deepfake fraud costs engineering giant Arup £20m (opens in a new window) Computing · 2024-05