U.K. engineering group loses $25M in Hong Kong deepfake video scam

UK engineering group Arup fell victim to a sophisticated deepfake scam, losing HK$200 million ($25 million) in one of the world's largest known incidents of this type. The fraud involved criminals using AI-generated video and audio to impersonate a senior manager during a video conference, tricking staff into making financial transfers.

The scam, which occurred in Hong Kong, highlights the growing threat of deepfake technology in cybercrime. An Arup employee received a message supposedly from the UK-based chief financial officer about a "confidential transaction." This led to a video conference with fake participants, including a digitally cloned CFO. The employee made 15 transfers to five Hong Kong bank accounts before discovering the deception.

Arup confirmed the incident, stating it happened in January and involved fake voices and images. The company said its financial stability and operations were not affected, and internal systems were not compromised. Hong Kong police are investigating, but no arrests have been made so far.

This case, along with a similar attempt on WPP, underscores the need for increased awareness and security measures against deepfake scams. Experts suggest that companies need to invest in more advanced IT solutions, while banks should implement better alert systems for suspicious transactions.

Arup's global chief information officer emphasized that the sophistication of such scams has been "rising sharply" in recent months, hoping their experience can raise awareness about evolving cybercriminal techniques.

Read more with the Financial Times.