A British multinational design and engineering company, Arup, was the victim of a deepfake scam that resulted in one of its Hong Kong employees paying out $25 million to fraudsters. The company confirmed that fake voices and images were utilized in the scam. Despite the incident, Arup stated that their financial stability and business operations were not affected, and none of their internal systems were compromised. The company reported the fraud incident to Hong Kong police in January and is currently under investigation.
During the intricate scam, the employee, who worked in finance, believed he was attending a video call with the company’s chief financial officer and other staff members. However, all the individuals on the call were actually deepfake recreations. The employee initially suspected a phishing email from the UK office but was convinced by the realistic appearance and voices of the individuals during the video call. As a result, the employee transferred a total of 200 million Hong Kong dollars in 15 transactions, totaling around $25.6 million.
The term “deepfake” refers to fake videos created using artificial intelligence that appear highly realistic. This technology has raised concerns about the potential for damaging misuse, such as the spread of pornographic AI-generated images of celebrities on social media. Arup, as a top engineering consulting firm with a global presence, stated that they are subject to various attacks, including invoice fraud, phishing scams, WhatsApp voice spoofing, and deepfakes. The company noted that the number and sophistication of these attacks have been increasing in recent months.
Authorities worldwide are becoming increasingly concerned about the growing sophistication of deepfake technology and the malicious applications it may be used for. In an internal memo, Arup’s East Asia regional chairman emphasized the importance of staying informed and alert about identifying different techniques used by scammers. The company’s global chief information officer highlighted that Arup, like many other businesses, is facing rising risks of cyber-attacks and scams. The incident has prompted a need for increased awareness and vigilance to protect against such scams.
The incident involving the deepfake scam at Arup highlights the evolving challenges faced by businesses in the digital age. As technology advances, so do the methods used by scammers to deceive individuals and organizations. Arup’s experience serves as a cautionary tale for other companies, reminding them of the importance of cybersecurity measures and employee training to prevent falling victim to such sophisticated scams. This incident underscores the importance of ongoing efforts to strengthen cybersecurity defenses and educate employees about identifying and responding to potential threats effectively.
