Arup AI media incident — Nov 2026
An employee at the engineering firm Arup in Hong Kong was deceived into transferring US$25 million after participating in a video call featuring deepfake.
- Reported date
- Nov 9, 2026
- Target
- Arup
The exact incident date was not established. This entry is dated by its source report.
In early 2024, an employee at the engineering firm Arup in Hong Kong was deceived into transferring approximately US$25 million after participating in a video call. The call featured deepfake versions of the company's CFO and other colleagues, leading the employee to believe the request for funds was legitimate.
What happened
The attack utilized sophisticated synthetic media to impersonate senior leadership during a high-stakes financial transaction. By leveraging deepfake technology to replicate the faces and voices of the CFO and other staff members, the attackers successfully bypassed the employee's internal verification processes. The incident highlights the growing risk to corporate finance teams, as attackers increasingly use publicly available audio and video samples from earnings calls, webinars, and social media to train AI cloning tools. Because the voices and appearances of the participants sounded and looked genuine, the employee proceeded with the transfer without performing the usual security checks. This case serves as a stark reminder that in an era of advanced AI, organizations must move away from relying on trust and instead implement strict verification protocols, such as mandatory call-backs on known numbers and the use of pre-agreed code words for sensitive financial approvals.