Short answer

Deepfake video call fraud uses AI-generated faces and voices to impersonate executives or relatives in a live call, then asks for an urgent payment. In the Arup case, a Hong Kong employee sent HK$200 million (about US$25.6 million) after a call with fake colleagues. The fix is procedural: verify by a second channel you chose yourself.

Key takeaways

  • A familiar face and voice on a live call is no longer proof of identity.
  • In the Arup case, the employee first doubted a phishing message, then relaxed after a video call with people who looked like colleagues.
  • Urgency, secrecy and an unusual payment request matter more than any visual glitch.
  • Verification works when it uses a separate channel and a number or contact you already had.
  • Families can use the same rule: hang up and call back, or ask for a pre-agreed safe word.

What happened in the Arup case

In February 2024, Hong Kong police described a fraud in which a finance employee at a multinational firm joined a video call with what appeared to be the company’s chief financial officer and other staff. In May 2024 the firm was named as Arup, the British engineering group. CNN reported that the employee sent HK$200 million, about US$25.6 million, and Hong Kong broadcaster RTHK, citing police, said the money went out in 15 transactions.

Two details are worth knowing. The employee had first suspected a phishing email, purportedly from Arup’s UK office, asking for a secret transaction. The video call is what put those doubts to rest. Police said the other participants were AI recreations. Arup confirmed that fake voices and images were used and said none of its internal systems were compromised. The company notified Hong Kong police in January. The attack worked on people, not on software.

Why a live call feels so convincing

We trust faces and voices more than text. Scammers know this, so they combine a believable story with a call that “proves” it. The FBI warned in December 2024 that criminals use AI-generated video to pose as executives or officials in live chats, and AI-generated audio to pose as relatives in a crisis.

You do not need to out-spot the fake. The tell is the request: urgent, secret, outside normal process, and involving money or access.

How companies can protect payments

Treat any video or voice call as an invitation, not an authorisation. Practical rules that stop this kind of fraud:

  • Two people approve. No single employee can release a large or new payment.
  • Call back. Confirm using a number from your own directory, never from the message or call.
  • Check the payee. New or changed bank details always get an independent check.
  • Ban secrecy. Write down that no legitimate request will ask you to bypass these steps.
  • Rehearse. Staff should know they will not be punished for pausing a request from a senior person.

How families can protect themselves

The same trick targets relatives: a “grandchild” or “boss” who is in trouble and needs money now. The FTC advises asking whether there is really an emergency and whether it is really your family member calling, and warns that scammers pressure people to wire money. Hang up and call the person on their usual number, or check with another relative.

A safe word agreed in advance makes this easier. Pick something that cannot be guessed from social media, and agree that anyone asking for money must say it. For more on cloned voices see AI voice clone scams, and for the messages that start many of these schemes see phishing messages.

If you have already paid

Contact your bank immediately and ask for a recall; speed matters. Report to the FBI’s IC3 if you are in the US, including contact details, transaction records and how the contact began, and to your national fraud service elsewhere. Keep the call details, emails and account numbers. Tell your colleagues, because the same group often tries more than one target.

Related reading: how to protect your voice from cloning.

What you can do

  1. 01Never approve a payment or share credentials on the strength of a video or voice call alone.
  2. 02Hang up and call the person back on a number from your own contacts or the company directory.
  3. 03For businesses, require two approvers and a callback for any new payee, changed bank details or unusual transfer.
  4. 04Agree on a family safe word now and use it for any money request, even from a face you know.
  5. 05Treat secrecy as a red flag: a real boss will accept a delay for checking.
  6. 06Report losses quickly to your bank and to the FBI's IC3 (ic3.gov) or your national fraud centre.

Related reading: AI voice clone scams and the data breach tracker.

Frequently asked questions

What happened in the Arup deepfake case?

CNN reported that a finance worker at the engineering firm Arup sent HK$200 million (about US$25.6 million) after a video call with people who looked and sounded like senior colleagues. Arup later confirmed it was the target and said fake voices and images were used.

Can a deepfake happen on a live video call?

Yes. The FBI has warned that criminals use AI-generated video to impersonate executives, police and other authority figures in live video chats. Quality varies, so do not rely on spotting flaws.

How can I check that a caller is really my boss or relative?

End the call and contact them yourself using a number you already had, not one supplied during the call. For family, a safe word agreed in advance adds a second check.

What should a company change after hearing about this?

Add a callback and a second approver for payments, make clear that no executive will demand secrecy, and rehearse the process so staff feel safe saying no to a senior person.

Sources

  1. British engineering giant Arup revealed as $25 million deepfake scam victim, CNN Business (via ABC17 News), 2024-05-16
  2. Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (PSA I-120324), FBI Internet Crime Complaint Center, 2024-12-03
  3. Family emergency scams, Federal Trade Commission, 2026-11-05

This article reflects public information as of 2026-11-05. AI tools and rules change quickly; we update articles when new facts are published. Spot an error? See our editorial and corrections policy.