News
Arup lost $25 million in deepfake video conferencing scam in Hong Kong
Stay informed with free updates
Simply sign up for Cyber Security’s MyFT Digest – delivered straight to your inbox.
British engineering group Arup lost HK$200 million ($25 million) after fraudsters used a digitally cloned version of a senior manager to request financial transfers during a video conference, the Financial Times has learned.
Hong Kong police previously revealed what is one of the biggest known deepfake scams in the world, but did not identify the company involved. The FT confirmed that it was Arup, which employs around 18,000 people worldwide and has annual revenues of more than £2 billion.
The case highlights the threat posed by deepfakes – video, audio or other hyper-realistic material generated by artificial intelligence – when used by cyber criminals to target companies or governments.
Two people familiar with the matter told the FT this month that Arup had been the target of the scam, which Hong Kong police classified as “obtaining property by mistake”.
Asked about the case, Arup said that in January the company “notified the police about a fraud incident in Hong Kong”.
“We can confirm that fake voices and images were used,” the company said, declining to give details because the incident was still under investigation. “Our financial stability and business operations were not affected and none of our internal systems were compromised,” he said.
Hong Kong Police Acting Senior Superintendent Baron Chan told local media in February that a staff member at the targeted company received a message purportedly from the UK-based chief financial officer about a “confidential transaction”.
After a video conference attended by the company’s digitally cloned CFO and other fake company employees, Chan said, the employee made a total of 15 transfers to five Hong Kong bank accounts before finally discovering it was a fraud by signing in. contact the group headquarters.
Police said investigations into the case continued, with no arrests to date.
Arup’s East Asia president, Andy Lee, stepped down in the weeks following the coup, after just a year in the role. He was replaced by Michael Kwok, the company’s former East Asia president. Lee said on his personal LinkedIn page that he has “decided to embark on a new opportunity.” Lee did not respond to a request for comment made via LinkedIn and Arup declined to comment further on his departure.
Theft reported this month that international advertising agency WPP was the target of a botched deepfake scam, in which criminals used a YouTube voice and image clone to set up a video meeting with executives.
Recommended
Liu Meng, an analyst at consultancy Forrester, said many companies, banks and lawmakers were not aware of new forms of fraud, such as those using deepfakes.
“Companies need to acquire more IT solutions to combat cybersecurity scams [and] banks need to alert their customers about suspicious payments when money is about to be transferred,” Liu said, adding that laws should be passed to ensure that banks share more of the financial losses resulting from fraud.
Arup global chief information officer Rob Greig said in a statement that the number and sophistication of deepfakes and other scams have been “markedly increasing” in recent months.
“I hope our experience can help raise awareness about the increasing sophistication and evolution of bad actors’ techniques,” Greig said.
Additional reporting by Gill Plimmer in London and Kaye Wiggins in Hong Kong