Arup — HK$200 Million Deepfake CFO Video-Call Fraud

Summary

A finance employee in Arup's Hong Kong office received a message, purportedly from the UK-based chief financial officer, about a secret transaction. The employee doubted it until joining a video conference in which every other participant was a deepfake recreation of a colleague, then made 15 transfers totalling HK$200 million (about US$25.6 million) to five local bank accounts. The fraud came to light when the employee checked with head office. Arup reported it to police in January 2024 and later confirmed that fake voices and images were used and that none of its internal systems were compromised. Police classified the case as obtaining property by deception; no arrests in this case have been reported.

Consequence

• HK$200 million transferred to fraudsters in 15 transactions to five bank accounts.

Who caught it Internal review

Key dates

1. October 16, 2026Checked against sources
2. October 18, 2026Checked against sources
3. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. The elaborate scam saw the worker duped into attending a video call with what he thought were several other members of staff, but all of whom were in fact deepfake recreations, Hong Kong police said at a briefing on Friday.

   Supports: Deepfake video conference; police disclosure

   The scam involving the fake CFO was only discovered when the employee later checked with the corporation’s head office.

   Supports: How the fraud was detected

   Finance worker pays out $25 million after video call with deepfake 'chief financial officer' CNN Reporting or analysis

2. Because the participants “looked like the real people”, Chan said, the employee then transferred a total of HK$200m to five local bank accounts via 15 transactions.

   Supports: Amount, number of transfers and accounts

   It said no arrests had been made so far but the investigation was ongoing and the case was being classified as “obtaining property by deception”.

   Supports: No arrests as of May 2024; case classification

   UK engineering firm Arup falls victim to £20m deepfake scam The Guardian Reporting or analysis

3. A spokesperson for London-based Arup told CNN on Friday that it notified Hong Kong police in January about the fraud incident, and confirmed that fake voices and images were used.

   Supports: Arup identified; reported to police in January 2024; fake voices and images

   “Our financial stability and business operations were not affected and none of our internal systems were compromised,” the person added.

   Supports: No internal systems compromised

   Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee CNN Reporting or analysis