Arup AI media incident — Jul 2025

In early 2024, the multinational engineering firm Arup suffered a significant financial loss after an employee was tricked into transferring funds during a video call featuring deepfaked versions of company leadership. The incident serves as a stark example of how advanced synthesis technology is being weaponized to bypass traditional corporate security protocols.

What happened

The attack began when an employee at Arup's Hong Kong office received a phishing email from the company's UK office requesting a "secret" transaction. Although the employee was initially suspicious, their concerns were alleviated after joining a video call that included the Chief Financial Officer and several other colleagues. The employee recognized the faces and voices of the participants, leading them to believe the request was legitimate.

Following the call, the employee executed 15 separate transfers totaling 200 million Hong Kong dollars (approximately USD 25.6 million) to five different bank accounts. The fraud was only discovered after the transfers were completed. Rob Greig, Arup's Chief Digital Information Officer, characterized the event as "technology-enhanced social engineering" rather than a traditional cyberattack, noting that there was no system compromise or unauthorized access to data. Instead, the attackers successfully manipulated an employee into performing authorized transactions under false pretenses. Greig noted that the ease of creating such content is high, stating that he was able to create a deepfake video of himself in less than an hour.