British company duped off £20m with an AI-generated video of its CFO

The British engineering company Arup has confirmed it was the victim of a deepfake fraud after an employee was duped into sending HK$200m (£20m) to criminals by an artificial intelligence-generated video call.

Hong Kong police said in February that a worker at a then-unnamed company had been tricked into transferring vast sums by people on a hoax call “posing as senior officers of the company”.

Arup said in a statement that it was the company involved, confirming that at the beginning of the year it had “notified the police about an incident of fraud in Hong Kong”. It confirmed that fake voices and images were used.

It added: “Our financial stability and business operations were not affected and none of our internal systems were compromised.”

The Arup global chief information officer, Rob Greig, who oversees the company’s computer systems, said the organisation has been subject to frequent attacks including deepfakes.

“Like many other businesses around the globe, our operations are subject to regular attacks, including invoice fraud, phishing scams, WhatsApp voice spoofing and deepfakes. What we have seen is that the number and sophistication of these attacks has been rising sharply in recent months,” he said.

Greig said he hoped that Arup’s experience would “raise awareness” of the increasing sophistication of cyber-attackers. The Financial Times first reported that Arup was the company targeted by the fraudsters.

Arup, one of the world’s leading consulting engineering firms, employs more than 18,000 people and famously provided the structural engineering for the Sydney Opera House including its distinctive concrete shells. Recent project involvements include the Crossrail transport scheme in London and the Sagrada Família in Barcelona.

The Guardian revealed last week that the head of the world’s biggest advertising group was targeted by a deepfake scam using an AI voice clone. The WPP chief executive, Mark Read, revealed the fraud in an email to senior colleagues and warned them to look out for calls claiming to be from top executives.

Hong Kong media quoted a senior police superintendent, Baron Chan, saying that the employee had been invited on to a conference call with “many participants”. Because the participants “looked like the real people”, Chan said, the employee then transferred a total of HK$200m to five local bank accounts via 15 transactions.

The Hong Kong police force said in a statement on Friday that an employee had been “deceived of some HK$200m after she received video conference calls from someone posing as senior officers of the company requesting to transfer money to designated bank accounts”.

It said no arrests had been made so far but the investigation was ongoing and the case was being classified as “obtaining property by deception”.