Arup’s HK$200M Deepfake Call: The CFO Fraud Manual Rewritten
In February 2024, a finance employee at Arup's Hong Kong office paid out roughly HK$200 million (US$25.6M) across fifteen transfers after a video conference in which every other participant — including the UK-based CFO — was a deepfake, built from public footage and commodity cloning tools. Police detailed the case on February 4, and by year-end it stood as the largest documented deepfake-enabled financial fraud: phishing to set the pretext, a synthetic multi-person call to seal it. This account reconstructs the con, the tooling economics, and the verification-protocol redesign it forced.