The message looked like it came from the company’s chief financial officer in the UK. It was addressed to an employee in the finance department in Hong Kong, and it talked about the need for a secret transaction.
The employee’s first thought, according to Hong Kong police, was that it was a phishing email.
Then there was a video conference. Several people were on it, and they looked and sounded like colleagues the employee recognised. The doubt went away. Over 15 transfers, the employee sent HK$200 million, about US$25.6 million, to five local bank accounts.
Everyone else on that call was fake. “Scammers found publicly available video and audio of the impersonation targets via YouTube, then used deepfake technology to emulate their voices,” Acting Senior Superintendent Baron Chan told reporters. By his account, the videos were pre-recorded and involved no dialogue or interaction with the employee.
The fraud came to light only when the employee later checked with the company’s head office. Police received the report on January 29, 2024, and described the case to reporters in early February. They named neither the company nor the worker, and said no arrest had been made.
In May, Arup confirmed it was the company. The British engineering firm, which did the structural engineering for the Sydney Opera House and employs more than 18,000 people, said it had told Hong Kong police at the start of the year and that fake voices and images had been used. In Arup’s words, “none of our internal systems were compromised.”
The employee’s suspicion had landed on the email, and the email was indeed fake. What settled the doubt was the call, and the call looked like the very thing a careful person would want before moving that much money: several senior colleagues, seen and heard, behind the same request. That reassurance was the part the fraudsters had built.
Rob Greig, Arup’s global chief information officer, later called it “technology-enhanced social engineering.” Speaking to the World Economic Forum about a year afterwards, he said it was not even a cyberattack in the purest sense. No systems were compromised and no data was affected. People had been deceived into believing they were carrying out genuine transactions. Audio and visual cues matter a great deal to humans, he said, and these tools play on them. “I think we really do have to start questioning what we see.”
He also ran a test of his own. Curious after the incident, he tried to make a real-time deepfake video of himself. The result, he said, was not particularly convincing. “It took me, with some open source software, about 45 minutes.”