In early 2024, an employee at engineering firm Arup in Hong Kong joined a video call with what appeared to be the company’s CFO and several colleagues. Following their instructions, the employee made a series of transfers totalling around US$25 million. Every other person on the call was a deepfake.
Seeing is no longer believing. For years, the standard advice for “CEO fraud” emails was to verify by phone or video. That defence now has a hole in it.
It’s cheap to copy. Public videos of executives — earnings calls, conference talks, interviews — provide enough material to build convincing voice and face clones.
What finance teams should change
- Verify payment requests through a separate, pre-agreed channel — never the one the request came from.
- Use code words or call-backs to known numbers for high-value approvals.
- Require two-person approval for new payees and urgent transfers.
- Train staff that urgency plus secrecy is the classic fraud signal.
The control that works is process, not perception.
Fraud Watcher analysis
Source: CNN reporting on the Arup case
Leave a Reply