Anatomy of the $25.6 Million Arup Scam: Everyone Recognized the Faces. No One Verified Them

In early 2024, a deepfake fraud video call led to a US$25.6 million loss at Arup, a global engineering and design consultancy. A finance employee in the company’s Hong Kong office authorized 15 wire transfers totaling HK$200 million (about US$25.6 million) after joining a call with what appeared to be the company’s chief financial officer (CFO) and senior colleagues from London. All of them were AI deepfakes. Two and a half years later, the case remains unsolved, with no publicly identified suspects and no funds recovered. This costly lesson about deepfake fraud and identity verification raises a deeper question: When a familiar face or voice can be faked, what actually proves who someone is?

Every control was working perfectly. The company still lost US$25.6 million.

It is mid-January 2024, and a video call begins the way thousands of business calls do. Faces appear on screen: the CFO is there, alongside familiar colleagues from the London office. An urgent confidential transaction needs to close, and the employee joining from Hong Kong is asked to help make it happen. Nothing about the call looks obviously wrong. And that is exactly what makes this case worth studying.

This was not a traditional cyberattack involving a breached firewall, stolen passwords, or malware. The publicly reported incident did not involve a compromise of Arup’s core IT systems. Instead, the attackers exploited something much older than AI: trust. AI simply made it easier to convincingly deceive.

How Deepfake Fraud Defeated Identity Verification

Step One: The Scammers Did Their Research

Weeks before the deepfake call, the attackers mapped Arup’s organizational structure and identified key financial decision-makers. From platforms like YouTube and corporate conferences, they gathered audio and video from interviews and corporate presentations – the kind of appearances senior executives make every day – featuring Arup’s UK-based CFO and other executives, which they used to train generative AI models.

None of this required breaking into Arup’s systems. It simply gave the attackers enough material to recreate the CFO’s face and voice, making the exposure public, not technical.

Step Two: The Email and Social Engineering

A message arrived that appeared to come from the CFO, asking for a confidential transaction and applying quiet pressure to keep the matter within a small group. The employee was initially suspicious, and that matters: his security instincts kicked in, at least for a moment. Instead of stopping there, however, the attackers added another layer of credibility: an invitation to a video meeting.

Step Three: The Deepfake Call

This is when the deception became convincing and the scammers broke through the employee’s reservations. The employee joined the call and saw what appeared to be the CFO and other senior colleagues: familiar faces, familiar voices, discussing the transaction and the company’s internal processes. For years, video has been treated as one of the strongest ways to confirm that someone is who they claim to be. After all, if you can see someone and hear them in real time, what more proof could you need?

Step Four: The Transfer

The employee authorized 15 transfers totaling HK$200 million, or about US$25.6 million, into five bank accounts in Hong Kong. The transactions got past existing financial checks, designed to evaluate the amount, the account, and the approval process. But those controls were not designed to answer the more basic question behind it all: was the person giving the instructions really who they claimed to be?

Step Five: The Discovery

Still uneasy, the employee eventually contacted headquarters directly to confirm what had happened. That is when two very different accounts of the same week collided. The people on the video call had not been who they appeared to be. By then, however, the money was already gone.

Recognition Is Not Identity Verification

The real weakness is the chain of trust. The problem was not one broken product but a set of five sequential steps, each building on the previous one: public information, an email, a video call, an employee’s trust, an approval, a bank transfer. Each step made the next one feel more legitimate. The email looked like it had come from the CFO. The video looked like it showed the CFO. The conversation sounded legitimate, so the employee believed the transaction was legitimate, and the bank received what appeared to be a properly authorized instruction.

A video call is a useful way to communicate, but it should never be enough on its own to approve a high-value transaction. A familiar voice can explain why something feels urgent, but it should not be treated as proof that the request is genuine. A face on a screen can look exactly right and still not prove that the person behind it is who they appear to be.

For anything high-risk, organizations need a Zero Trust approach: never assume, always verify, and rely on independent evidence beyond a call or email.

This Is Not Just an Arup Problem

The Arup case was not the first warning.

In 2022, scammers used years of publicly available interviews and TV appearances to create a deepfake of Binance executive Patrick Hillmann. It was convincing enough to fool members of the crypto community during online meetings Hillmann never attended.

In 2025, a finance director at a multinational company in Singapore was convinced during a video call that he was speaking with senior executives and authorized a transfer of US$499,000. Thankfully, in that case the money was recovered within days once the banks and police intervened.

Reflecting on the Arup incident in 2025 in an interview with the World Economic Forum, the company’s Chief Information Officer, Rob Greig, put the scale of the threat simply: “We are attacked every day.” Greig later created a real-time deepfake of himself using open-source software in only about 45 minutes. The result was not perfect, he said, but it showed how quickly this technology has become accessible to people with very little technical skill.

Thus, if you work in financial services, critical infrastructure, government, transport, energy, or any organization where trusted identities can unlock money, data, systems or physical access, this is not a future threat. Deepfake fraud and identity verification gaps are here now. Impersonation now drives over 85% of fraud attempts, and AI lets attackers run it at an industrial scale (Source: Veriff, 2026)

What Organizations Can Do

For high-risk actions, organizations need to build cryptographic identity verification into the process and not leave it up to human judgement.

1. Separate the Conversation from the Approval

A call or email can carry a request, but approval should happen through another controlled system. In other words: Talk in one channel, approve in another.

2. Verify Independently

Make independent identity verification routine. For a high-value transaction, verify the request through a separate channel: a trusted number already on file, a pre-agreed method, or a second approver who was not part of the original call. The goal is to make this routine, so asking never feels like an accusation.

3. Train for the Deepfake Scenario

Traditional security training still focuses on suspicious links and strange email addresses, and those skills still matter. But employees may now receive a convincing email followed by an equally convincing deepfake video call involving people they recognize. That scenario deserves a place in security training too.

4. Protect the Person Who Pauses for Caution

Imagine an employee who pauses on a suspicious US$20 million request, asks for independent identity verification, and delays the payment. If the organization punishes that friction, people learn to stop asking questions. If it supports them, caution becomes part of the culture. The safest organization is not the one where nobody ever slows things down. It is the one where people know when slowing down is the right thing to do.

5. Apply Zero Trust Principles

Never assume that a familiar face, voice, or video proves identity. Always verify.

What Can IDEMIA Public Security Do for Your Organization?

Let’s go back to that call in Hong Kong. Every face on the screen was recognized. Not one of them was verified. That gap between “I know this face” and “I can prove this person is real, present, and who they claim to be” sits at the heart of a deepfake fraud that ended with 15 transfers worth US$25.6 million.

IDEMIA Public Security’s Identity Proofing Platform (IPP) is designed to add stronger evidence at that critical point. IPP combines identity verification with liveness detection to help confirm there is a real person behind the identity, not a photo, replay, or manipulated feed. Backed by more than 50 years of expertise in biometrics and secure identity, IDEMIA Public Security’s technologies are independently evaluated by NIST, the U.S. Department of Homeland Security and iBeta. In 2026, IDEMIA ranked first in NIST’s FRTE 1:N mugshot and visa-border evaluations.

Sources:
1. Arup lost $25mn in Hong Kong deepfake video conference scam
2. PRMIA Case study – ARUP.pdf
3. Cybercrime: Lessons learned from a $25m deepfake attack | World Economic Forum
4. Account Takeover Fraud Statistics [2026] | Veriff.com
5. Face Technology Evaluations – FRTE/FATE | NIST