UK firm falls victim to whopping £20,000,000 deepfake scam

Hackers stole HK$200 million from a British business (Picture: Getty)

British engineering firm Arup has confirmed that it was the company at the centre of a £20 million deepfake scam earlier this year.

In February, Hong Kong police reported that a finance worker had been duped into paying HK$200 million of his company’s money to fraudsters because of an elaborate deepfake video call appearing to be with his boss.

In a statement to the Financial Times, which confirmed Arup was the victim, the company confirmed fake images and voices had been used, but said: ‘Our financial stability and business operations were not affected and none of our internal systems were compromised.’

Arup’s global chief information officer, Rob Greig, said the company had seen a sharp rise in the number and sophistication of deepfakes and other scams in recent months.

‘I hope our experience can help raise awareness of the increasing sophistication and evolving techniques of bad actors,’ he said.

The employee at the centre of the attack joined a video call with what appeared to be the business’s chief financial officer.

Initially suspicious after a message from the CFO mentioned a ‘secret transaction’, suggesting it was a phishing scam, he also said the CFO appeared to be ‘a little off’.

However, after other colleagues dialled in and supported the move, the staffer agreed to make 15 transfers into five local bank accounts.

It later transpired that everyone on the call, not just the CFO, were deepfakes.

Fake colleagues appeared on the video call (Picture: Getty/iStockphoto)

‘[In the] multi-person video conference, it turns out that everyone [he saw] was fake,’ said Senior Superintendent Baron Chan Shun-ching, speaking to the city’s public broadcaster RTHK in February. 

The scam was discovered when the worker checked with the company’s head office later, which was not aware of the transaction requests.

It later appeared that all of the AI-generated videos were created using past online conferences, while the fraudsters also used WhatsApp and email to make the scam even more credible.

Speaking at the time, Senior Superintendent Chan added: ‘I believe the fraudster downloaded videos in advance and then used artificial intelligence to add fake voices to use in the video conference.’

While the name Arup may not be familiar to many, their work will be, having been involved in the construction of Sydney’s famous opera house, and London’s new Elizabeth line.

Sophisticated deepfakes are causing increasing concern, particularly in an election year. In January, voters in the US received a recorded phone call that appeared to be from President Joe Biden telling people not to vote in the New Hampshire primary election, but the voice was an AI-generated deepfake.

Around the same time, explicit AI-generated images of Taylor Swift began circulating the internet, months after young girls in a Spanish town were targeted and deepfake naked images of them circulated online.

And last year, a mum fell victim to a phone scam after she received a call from an AI voice clone of her daughter, saying she had been kidnapped.