Everyone on the call was fake

In mid-January 2024, a finance worker in the Hong Kong office of a multinational firm gets a message. It says it is from the chief financial officer in London, and it talks about a transaction that has to be carried out and kept secret.¹

The worker reads it and thinks: phishing.¹

That was correct. It takes one video call to change the worker's mind.

The meeting

The message comes with an invitation to a video conference. The worker joins.

The CFO is on the call, and so are several colleagues, people the worker knows by face and by voice. A few outsiders are there too.² All of them look right and sound right. The worker is asked to introduce themselves, and then the people on the screen start giving instructions. There is no discussion, and the meeting ends abruptly.²

Afterwards the instructions keep coming by instant message and email, and in one-to-one video calls.²

The worker does what the CFO said. Fifteen transfers, to five bank accounts in Hong Kong. US$25.6 million in total (HK$200 million).³

Then the worker checks with head office.¹

Nobody in London knows anything about a secret transaction. The CFO was never on a call. Neither were the colleagues. The worker was the only real person in the meeting.

On 29 January the police get the report. By then all fifteen transfers have gone through.⁴

What the police said

Hong Kong police told the story at a briefing in early February, without naming the company or the worker. Acting Senior Superintendent Baron Chan Shun-ching put it this way:

"(In the) multi-person video conference, it turns out that everyone [he saw] was fake."¹

More details came out over the next few days.

The attackers found public video and audio of the real executives on YouTube. They used deepfake technology to copy their voices.⁴ In Chan's words, "I believe the fraudster downloaded videos in advance and then used artificial intelligence to add fake voices to use in the video conference."³

The video was pre-recorded, so there was no dialogue with the victim.⁴ Chan described the call to the South China Morning Post. "During the video conference, the scammers asked the victim to do a self-introduction but did not actually interact with the person. The fake images on screen mainly gave orders before the meeting ended abruptly."² He thought that staying out of a conversation made the call more convincing, not less.⁵

The message did not go to one person. It went to several employees in the Hong Kong branch. One of them followed it.²

Police said deepfake scams in the city until then had been one-on-one video calls. A whole meeting of fakes, for a sum this large, was the first they had seen.⁶

The company

For three months the victim was "a multinational firm". In May 2024 the Financial Times reported that it was Arup, and Arup confirmed it.⁷

Arup is a British engineering firm that did the structural engineering for the Sydney Opera House. It has about 18,000 people in 34 offices.⁸ A company like that is not careless with numbers.

Its statement was short:

"We can confirm that fake voices and images were used. Our financial stability and business operations were not affected and none of our internal systems were compromised."⁹

Read the last part again, where Arup says that none of its internal systems were compromised. There was no malware and no stolen password. The attackers never got into Arup's systems, and they did not need to, because they went after a person.

This kind of attack is called social engineering, and some call it human hacking. There will be more of it. Attackers look for the weakest link, and for a long time that was technology such as an unpatched server or a reused password. Companies have spent years making those systems harder to break into. The better that work goes, the more often the weakest link is a person who is allowed to use them. At Arup, every transfer was made by an authorised person, through the proper system, in the proper way. There was nothing for a security tool to see.

Rob Greig, Arup's chief information officer, later said he would not even call it a cyberattack:

"What happened at Arup – I would call it technology-enhanced social engineering. It wasn't even a cyberattack in the purest sense. None of our systems were compromised and there was no data affected. People were deceived into believing they were carrying out genuine transactions that resulted in money leaving the organization."¹⁰

He also had a view on the word itself:

"Deepfake sounds very glamorous but what does it actually mean? It means someone successfully pretended to be somebody else."¹⁰

Why it worked

It is tempting to think the fake CFO must have been hard to tell from the real one. The evidence says otherwise. By the standard of what is available now, this was a basic attack.

The video was a recording. It could not answer a question. The voices were copied from videos that anyone can watch on YouTube. A recording cannot hold a conversation, so the attackers did not start one. The meeting was short and ended abruptly.

That limit was gone seven months after the call, when a free, open source tool called Deep-Live-Cam went to the top of GitHub's trending list. It takes a face from a single photo and puts it on a live webcam feed. The fake face follows the pose and the expressions of the person in front of the camera, and it matches the lighting.¹¹ After the incident Greig tried to make a real-time deepfake of himself with open source software. It took him about 45 minutes. "It wasn't particularly convincing," he said, "but it was surprising what can be achieved in such a short period of time."¹⁰

So US$25.6 million was taken with the crude version, a fake that could survive a glance but would have failed in a conversation. The next one will answer back. At Arup, three other things did the work.

The crowd on the call removed the doubt that the worker had about the message. According to police, the worker set the suspicion aside because the other people on the call looked and sounded like people they recognised.¹ One face can be questioned. A room full of familiar faces, all acting as if the request is normal, is much harder to question. The attackers understood that the cheapest way to make one fake believable is to add more fakes.

The secrecy of the request was the warning sign, and it was also the mechanism. A worker who has been told to keep something confidential does not lean over to the next desk and ask if it sounds right. One question to one real colleague would have ended the attack. We know this because that is what did end it, a week late.

The direction of the meeting was one way, because the worker did not speak apart from saying who they were. Senior people talked and a junior person listened. That is what many meetings with executives feel like, so nothing seemed wrong. It also meant the recording was never tested.

The worker's first judgement was right, and the attack used all three to get them to overrule it. The worker noticed the phish, and then the attackers showed them what looked like proof.

It was not a one-off

At the same February briefing, police described how deepfakes were already routine in local fraud. They had made six arrests. Eight stolen Hong Kong identity cards had been used for 90 loan applications and 54 bank account registrations between July and September 2023. On at least 20 occasions, deepfakes of the people on the cards were used to get past facial recognition checks.¹

A year later, in January 2025, Hong Kong police arrested 31 people who ran a scam operation out of two industrial units in Kowloon Bay. They worked in two shifts and recruited young people, students among them. The group trained the recruits to find targets on dating apps in Taiwan and in the Southeast Asian countries of Singapore and Malaysia. The recruits used deepfake images of attractive people to build fake romances that turned into fake investments. The proceeds were more than US$4.37 million (HK$34 million).¹²

Nothing in the reporting connects that group to the Arup case. When Arup confirmed the loss, police said no arrests had been made.⁷ The point is a different one. In Kowloon Bay, deepfake fraud had shifts and a training programme for new staff. It had stopped being a trick and become a job.

Arup describes the same trend from the side of a company that receives these attacks. Greig's statement in May 2024 listed the company's regular attacks as "invoice fraud, phishing scams, WhatsApp voice spoofing and deepfakes". Their number and sophistication had been "rising sharply", he said.⁷ The same month, the Guardian reported that the chief executive of WPP, the largest advertising group in the world, had been the target of a scam that used a clone of his voice.⁷

What to do about it

After the case, Hong Kong police advised people to ask questions during the meeting and to ask people on camera to move their heads. They also advised people to confirm the request through another channel.²

Questions and head movements are tests for a fake, and both would have caught a recording in January 2024. Neither will hold. A live deepfake is a real person wearing someone else's face, so it answers the question and it turns its head when asked.¹¹ The same goes for the usual tips about odd blinking and strange lighting, and about lips that are out of sync with the voice. All of them assume the fake is worse than a real person in a way you can see. That gets less true every month, and nobody announces the day it stops being true.

So plan for the point where nobody on the call can tell the difference. A fake colleague then looks and sounds like the real one, and answers questions the way the real one would. If your defence is spotting the fake, at that point you have no defence.

The advice to confirm the request through another channel does not test the fake at all. It does not matter how good the video is if the payment waits until someone calls the CFO back on a number that was already in the company directory. The attacker controls the call. The attacker does not control the channel you choose yourself.

Verifying a request on a second, independent channel is called out-of-band verification. The method is old and cheap, and it is the one control in this story that does not get weaker as the fakes get better. Our company is named after it.

Out-of-band verification only works if it is done the same way every time. Four rules follow from the Arup case:

A new payee or an unusual transfer is confirmed on a second channel before it is made. A call that arrives with the request is part of the request, so it is not a second channel.
The worker starts the confirmation, with contact details they already had. The number in the message belongs to whoever sent the message.
A request for secrecy triggers the check instead of preventing it. "Keep this confidential" is a reason to verify, and everyone, including the real CFO, has to know that and expect it.
The rule does not depend on how convincing the request is. A rule that applies only when something feels wrong fails against an attack designed to feel right.

Rules are the easy part, and the worker in Hong Kong did not lack a rule. They had the right instinct and gave it up under pressure from people who seemed to outrank them. Holding on to that instinct, in front of what looks like your own CFO, is a skill. People get it the way they get any skill, by doing it before it counts.

At Out of Band we build realistic simulations of these attacks, so the first time someone faces one is not the time it costs US$25 million. If you want to see what that looks like, request demo access.

Sources

Heather Chen and Kathleen Magramo, "Finance worker pays out $25 million after video call with deepfake 'chief financial officer'", CNN, 4 February 2024. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶
Zeljka Zorz, "Deepfaked video conference call makes employee send $25 million to scammers", Help Net Security, 5 February 2024. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶
Dan Milmo, "Company worker in Hong Kong pays out £20m in deepfake video call scam", The Guardian, 5 February 2024. ↩ ↩²
AFP, "Multinational loses HK$200 million to deepfake video conference scam, Hong Kong police say", Hong Kong Free Press, 5 February 2024. ↩ ↩² ↩³
Benj Edwards, "Deepfake scammer walks off with $25 million in first-of-its-kind AI heist", Ars Technica, 5 February 2024. ↩
Harvey Kong, "'Everyone looked real': multinational firm's Hong Kong office loses HK$200 million after scammers stage deepfake video meeting", South China Morning Post, 4 February 2024. ↩
Dan Milmo, "UK engineering firm Arup falls victim to £20m deepfake scam", The Guardian, 17 May 2024. ↩ ↩² ↩³ ↩⁴
Prarthana Prakash, "A deepfake 'CFO' tricked British design firm Arup in $25 million fraud", Fortune, 17 May 2024. ↩
Kathleen Magramo, "British engineering giant Arup revealed as $25 million deepfake scam victim", CNN, 17 May 2024. ↩
"Cybercrime: Lessons learned from a $25m deepfake attack", interview with Rob Greig, World Economic Forum, February 2025. ↩ ↩² ↩³
Benj Edwards, "New AI tool enables real-time face swapping on webcams, raising fraud concerns", Ars Technica, 13 August 2024. ↩ ↩²
Jess Ma, "Hong Kong police arrest 31 who used deepfakes to scam victims in Singapore, Malaysia", South China Morning Post, 5 January 2025. ↩