Risk register · entry
Q-F · FraudArup deepfake fraud
A clerk wired funds after a video call where every colleague was an AI deepfake.
The fifth quadrant, where the thing was never real. The tell is that the story is too clean.
Why this room
The payoff mechanism stayed simple, a classic impersonation con to extract a wire transfer, but the tail behavior became fat-tailed and hard to bound once generative AI let attackers fabricate the one signal (live face and voice) that made the scam's payout scale from a single phishing email to $25.6 million in a week.
The record
- US$25.6 million (HK$200 million) total losscertain
- 15 fraudulent wire transferscertain
- 5 Hong Kong bank accounts receiving the fundscertain
- Transfers occurred over about one week in mid-to-late January 2024certain
- Hong Kong police notified in February 2024certain
- Arup publicly confirmed as the victim on 17 May 2024certain
- As of early 2025, no arrests, no identified perpetrator, funds unrecoveredlikely
- Deepfakes were built from publicly available video and audio of Arup executiveslikely
Sources
The book
This entry is one of 111 in the register. The full story, and what it cost the people who lived it, is in Risky Business by Claudia Zeisberger, David Munro and Joanna Reijgersberg-Siew.
Join the waiting list