Risk register · entry
Q-F · FraudArup deepfake fraud
A clerk wired funds after a video call where every colleague was an AI deepfake.
The fifth quadrant, where the thing was never real. The tell is that the story is too clean.
Why this quadrant
An impersonation con depends on one signal being hard to fake, and for a wire transfer that signal was a face on a call. Every colleague on the call was generated from public video and audio. The clerk made 15 transfers into five Hong Kong accounts over about a week, 25.6 million dollars. No one has been arrested and the money has not been recovered.
The record
- US$25.6 million (HK$200 million) total losscertain
- 15 fraudulent wire transferscertain
- 5 Hong Kong bank accounts receiving the fundscertain
- Transfers occurred over about one week in mid-to-late January 2024certain
- Hong Kong police notified in February 2024certain
- Arup publicly confirmed as the victim on 17 May 2024certain
- As of early 2025, no arrests, no identified perpetrator, funds unrecoveredlikely
- Deepfakes were built from publicly available video and audio of Arup executiveslikely
Sources
The newsletter
One risk story a week, taken apart the way this one was: what was known, what was ignored, and which quadrant it really belonged to.
No spam, one email a week.