how it happened
- whofraudsterspublic footage of executives
- the gapone employeeevery face on the call was fake
- the result~$25M lostin a single day
what everyone assumed
A live video call with recognizable people is the strongest authenticity signal most of us have, stronger than an email or a phone call. The assumption is that seeing and hearing someone is proof it is them.
what happened
Believing the meeting genuine, the employee made a series of transfers as instructed. Every participant had been recreated with AI from public footage and audio. The deception held through the entire call and only failed when the employee, later, checked with the real headquarters.
step by step
- an employee joins a video call with senior colleaguesEvery other participant has been recreated with AI from public footage and audio.the assumption breaks here
- fifteen transfers in a single dayMade as instructed, believing the meeting genuine.
- a later check with headquarters exposes itThe deception held for the whole call.
- early 2024loss of about $25 million confirmedAround HK$200 million, reported by Hong Kong police and confirmed by Arup.
how it surfaced
In early 2024 Hong Kong police reported, and the engineering firm Arup confirmed, a loss of around HK$200 million, roughly $25 million, across fifteen transfers in a single day, executed after a deepfake video meeting.
A face and a voice on a screen are now things software can manufacture.
Visual and audio presence is no longer proof of identity, which means the controls that authorize money cannot rest on it.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersEvery face on the call is fake, built from videos of your leadership found online.what it costs youMoney leaves in several transfers the same afternoon, and the real CEO hears about it the next day.
- or it goes like thisit happenedFacebook and Google, 2019howInvoices arrive in a real supplier's name with new bank details.what leavesmonths of supplier paymentswho ends up with ita fraudster abroad
- or it goes like thisit happenedOrion, 2024howAn employee gets a convincing request and sends several wires.what leavesmoney that is not recoveredwho ends up with ita criminal scheme
sources
your turn
what you can do about it
this week
Find out whether a transfer can be approved on a familiar voice or face alone.
Your payment approvals likely trust a recognizable voice on a call or a face in a meeting at some step. That trust is exactly what the Arup attackers manufactured. Whether a transfer can be authorized on presence alone, with no out-of-band check, is the question this loss makes concrete.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →