British engineering giant Arup revealed as $37 million deepfake scam victim

A renowned British design and engineering corporation, recognized for iconic structures like the Sydney Opera House, has confirmed falling victim to a deepfake scam, resulting in a staggering $37 million payout by one of its employees based in Hong Kong.

Arup, headquartered in London, revealed to CNN that it reported the fraud incident to Hong Kong authorities in January. The company disclosed that the scam involved the use of fabricated voices and images, marking a concerning development in the realm of cyber deception.

While specific details of the scam remain undisclosed due to an ongoing investigation, Arup emphasized that its financial stability and operational integrity remained unaffected, with no breach of internal systems.

According to Hong Kong police, the elaborate scheme involved a finance employee who was deceived into attending a video conference with individuals impersonating the company’s CFO and other executives through deepfake technology. Despite initial suspicions stemming from a phishing email, the employee was swayed by the convincing appearance and voices of the imposters.

Subsequently, the employee authorized transfers totaling 200 million Hong Kong dollars, equivalent to approximately $37 million, across 15 transactions. The incident underscores the growing threat posed by deepfake technology, which utilizes AI to produce remarkably realistic fake videos.

Arup’s Global Chief Information Officer, Rob Greig, highlighted the surge in cyberattacks faced by businesses worldwide, including invoice fraud, phishing scams, and deepfake manipulation. These incidents have become increasingly sophisticated and frequent, prompting heightened vigilance within the organization.

In response to the escalating threat landscape, Arup’s East Asia regional chairman, Michael Kwok, emphasized the importance of awareness and vigilance among employees. Kwok, who recently assumed the role, urged staff to remain informed and alert to identify evolving scam techniques.

The incident has sparked concerns among global authorities regarding the proliferation of deepfake technology and its potential misuse. Arup’s swift response and proactive measures reflect the ongoing efforts to mitigate cyber risks in an era of advancing technological threats.