CEO Fraud Deepfakes: How the $25.6M Arup Scam Worked and How to Stop the Next One

---

Picture the meeting. A finance employee joins a video call with his company's UK-based CFO and several colleagues he recognizes. Faces match. Voices match. The CFO authorizes a confidential transaction and the employee starts wiring money. Every participant on that call except him was a deepfake. That is CEO fraud deepfake in its mature form, and it cost engineering firm Arup $25.6 million, per CNN (2024).

What is executive deepfake fraud? Executive deepfake fraud uses AI-generated video or voice of senior leaders to trick employees into transferring money or data. In 2024, an Arup employee in Hong Kong paid out $25.6M after a deepfaked video call with a fake CFO. Out-of-band verification and payment controls defeat these attacks.

What Is Executive Deepfake Fraud (CEO Fraud 2.0)?

Executive deepfake fraud, also called CEO fraud deepfake or a deepfake CEO scam, is business email compromise with a face and a voice. Classic BEC relied on a spoofed email from "the boss" demanding an urgent wire. It worked for years because employees obey authority under time pressure. BEC remains one of the costliest crime categories the FBI tracks, with $2.77 billion in reported losses in 2024 alone, per the FBI IC3 annual report.

The deepfake upgrade closes the loophole that used to save people: picking up the phone or joining a call to check. Now the check itself can be faked. In the Regula Deepfake Trends 2024 survey, 49 percent of businesses worldwide reported encountering both audio and video deepfake fraud, roughly doubling since 2022.

Finance teams are the target because they sit at the intersection of authority, urgency, and payment rails. An attacker does not need to breach your network. They need one employee, one believable executive, and one approved transfer. The same techniques power deepfake phishing against staff at every level, and the wider family of deepfake scams against consumers. This post covers the executive variant, the most expensive branch.

Case File: The Arup Deepfake, Step by Step (Hong Kong, 2024)

Arup is a 10,000-person British engineering firm whose portfolio includes the Sydney Opera House. In early 2024 its Hong Kong office lost HK$200 million to a deepfake operation that Hong Kong police described as one of the first of its kind. Here is the timeline, reconstructed from CNN's reporting and Hong Kong police briefings.

The setup: a phishing email that almost failed

In January 2024, a finance employee in Arup's Hong Kong office received a message claiming to come from the company's UK-based CFO. It described a confidential transaction that needed his help. The employee was suspicious. He suspected phishing, which is exactly the right instinct, and the attack should have died there.

The video call where everyone was fake

Then came the video conference. On the call, the employee saw and heard the CFO along with several colleagues he recognized. Police later concluded that every other participant was an AI-generated recreation, built from publicly available video and audio of the real employees. The fakes greeted him, issued instructions, and ended the call. His doubts dissolved because the scammers let him do the verification step, on a stage they controlled.

15 transfers, HK$200M (about $25.6M) gone

Following the instructions, the employee made 15 transfers totaling HK$200 million, about $25.6 million, to five Hong Kong bank accounts. The fraud surfaced only about a week later, when he followed up with the company's head office. Hong Kong police disclosed the case in February 2024 without naming the firm, and Arup confirmed in May 2024 that it was the victim. Arup's global CIO Rob Greig said the firm had been facing a rising number and sophistication of attacks, including deepfakes.

Note what was never touched: Arup's systems. No malware, no breach. The attack ran entirely on borrowed faces and process gaps.

Other Documented Executive Deepfake Cases

Arup is the largest publicly confirmed loss, but the pattern has been building since 2019, and two near misses show what stops it.

UK energy firm, 2019. The CEO of a UK energy company believed he was on the phone with his boss, the chief executive of the German parent company. The voice carried the right accent and cadence. He wired about $243,000 to a supposed Hungarian supplier, per Wall Street Journal reporting of the insurer's account. Suspicion only set in when the "boss" called again from an Austrian number asking for a second payment. This is the earliest widely documented executive voice clone fraud.

Ferrari, 2024. An executive received WhatsApp messages, then a live call, in the cloned voice of CEO Benedetto Vigna, complete with his southern Italian accent, about a confidential acquisition, per Bloomberg. The executive asked a question only the real Vigna could answer: the title of the book he had recommended days earlier. The caller hung up. Total loss: zero.

WPP, 2024. Fraudsters cloned the voice of CEO Mark Read and paired it with public video footage in a Microsoft Teams meeting targeting an agency leader, per the Guardian. Alert staff and verification steps killed the attempt.

How Executive Deepfake Scams Work: The 5-Stage Attack Chain

Executive deepfake fraud is methodical. Understanding the chain shows where to break it.

1. Reconnaissance. Attackers map your org chart from LinkedIn, press releases, and vendor announcements. They learn who approves payments and who the approver reports to.
2. Media harvesting. Earnings calls, keynotes, podcasts, and promo videos supply training material. Three seconds of audio can produce an 85 percent voice match, per McAfee (2023). Executives are the easiest people on earth to harvest.
3. Pretext. A confidential deal, an acquisition, a regulator issue. Secrecy is load-bearing: it isolates the victim from the colleagues who would sanity-check the request.
4. Live deepfake contact. A phone call, voicemail, WhatsApp call, or a full video meeting on Zoom or Teams. This stage answers the common question of how deepfake attacks happen over Zoom: attackers join with real-time face swap and voice conversion tools, or replay pre-rendered participants while controlling the meeting flow, as in the Arup case. Our guide to deepfake video call scams covers the on-call warning signs.
5. Payment pressure. Urgent transfers to mule accounts, often split into many smaller payments, like Arup's 15, to stay under review thresholds and complicate recalls.

How to Protect Your Company From CEO Fraud Deepfakes

Deepfake fraud prevention for businesses is mostly process, not technology. Every control below would have stopped or shrunk the Arup loss.

Out-of-band verification for every payment change

Any new payee, changed bank details, or unusual transfer gets verified through a channel the requester did not choose. Call the executive back on the number in your directory, not the one in the meeting invite. The rule must hold even when the request arrives by video, because the video is now the attack surface.

Dual authorization thresholds

No single employee should be able to move large sums alone, whatever rank appears to be asking. Set thresholds where a second approver, ideally in a different office, must independently confirm. Fifteen transfers to five new accounts in days should be structurally impossible, not just discouraged.

The Ferrari question: challenge protocols that work

Teach staff to ask a question only the real person can answer: a recent shared meal, a book recommendation, the topic of last week's one-on-one. It costs nothing, it is socially awkward for exactly three seconds, and it ended the Ferrari attack cold. Pair it with a standing executive promise: you will never be punished for verifying.

Run a deepfake simulation exercise

You phish-test your staff; now drill them on synthetic media. Here is how to run deepfake simulation exercises in practice: with leadership consent, have your security team or an external firm clone an executive voice from public audio, place a controlled "urgent payment" call to finance, and measure who verifies, who escalates, and who complies. Debrief without blame and fix the process gaps the drill exposes. Repeat twice a year.

Verify suspicious media with a deepfake detector or API

When a voicemail, video message, or recorded call feels off, analyze the file itself. Our deepfake detector analyzes video, image, and audio with 95 percent accuracy and returns a verdict of Authentic, Likely Synthetic, or Inconclusive with a TrustScore from 0 to 100. Files are deleted from primary storage within 60 seconds of analysis unless you opt into retention, which matters for confidential material. Security teams can wire the same checks into ticketing, email triage, or call review through our deepfake detection API, available from the $49 Starter plan.

CTA: Security teams: add deepfake checks to your workflow with our detection API, or verify files free, 50 detections per month. Create a free account

FAQ

How did the Arup deepfake scam happen? A Hong Kong finance employee got a phishing email from a fake UK CFO, grew suspicious, then joined a video call where the CFO and colleagues all appeared real. Every other participant was a deepfake. He made 15 transfers totaling $25.6 million before a check with head office exposed the fraud.

How common is deepfake fraud against businesses? Common enough to plan for. 49 percent of businesses reported audio and video deepfake fraud in Regula's 2024 survey, and Deloitte projects generative AI could drive US fraud losses to $40 billion by 2027 (2024).

Can a live video call be deepfaked in real time? Yes. Real-time face swap and voice conversion tools run on consumer hardware, and quality keeps improving. Quality also varies under pressure, which is why challenge questions and unscripted requests, like asking the person to turn their head or reference a private detail, still expose many fakes.

How do you verify a video call is real? During the call: ask a question only the real person can answer and request an unscripted action. After the call: confirm any request through a known phone number or channel, and run recorded media through a deepfake detector before money or credentials move.

What should an employee do if a CEO request feels off? Pause, then verify on a channel you control, like the executive's known number or their assistant. Escalate to security even if you are unsure. Leadership's job is making that pause safe: no one at Arup needed courage to stop the loss, they needed a rule that said verification is mandatory.

Conclusion: Process Beats Detection Alone

Executive deepfake fraud succeeds where one employee can be isolated, pressured, and believed. Controls remove all three: out-of-band verification breaks isolation, dual authorization breaks pressure, and challenge questions break belief. Detection tools then backstop the process for the media that slips through. Get the payment controls in this guide adopted in writing, drill them, and give your team a fast way to verify any file a fake CFO leaves behind. The next CEO fraud deepfake call your finance team takes should be a short one.

CTA: Verify suspicious video, audio, or images free, 50 detections per month, or see our detection API for security workflows. Get started free

Related reading