Short answer
A deepfake video call cost the engineering firm Arup about US$25.6 million in early 2024, and no one hacked its systems. A finance employee joined a call with what appeared to be senior colleagues, then made transfers as instructed. The most practical defense is a payment rule rather than trying to spot fakes. Any new payee or changed bank detail gets a callback to a number you already have. Insurance for this kind of loss varies widely by policy, so the wording needs to be reviewed.
What happened on the deepfake video call
According to the World Economic Forum, a finance employee in Arup’s Hong Kong office joined a video call with what looked like the company’s CFO and several colleagues. Every other participant was fake. The employee then made 15 transfers totaling about US$25.6 million (roughly HK$200 million), and Hong Kong Police confirmed the case.
Arup’s chief information officer, Rob Greig, described it in a WEF interview as “technology-enhanced social engineering”. Arup’s systems were not breached. The attackers persuaded a person to send the money.
Why spotting the fake is the wrong defense
Deepfake quality keeps improving, so a defense that depends on someone noticing a flaw will fail eventually. A finance employee on a call with several familiar faces has little reason to doubt it.
A rule works better because it does not depend on judgment in the moment. Any new payee or changed bank detail gets a callback to a phone number you already have on file. Do not use a number supplied in the email, chat or call that made the request. The phishing and IT security checklist includes this step.
Why this matters for small architecture and engineering firms
The Arup case involved a global firm, so it is not a typical example of a small practice. The lesson still transfers. Attackers need source material to imitate someone, and that material is easy to find.
A principal who presents at industry events, posts videos on LinkedIn or appears in webinars has put plenty of voice and video online. Firm websites and recorded calls can add more. Architects and engineers also move large payments, such as retainers and subconsultant invoices, which makes payment requests look routine.
Real-world example
Consider a hypothetical eight-person architecture firm. The office manager receives a message from the principal asking for a quick video call. On the call, the principal appears on screen and explains that a consultant’s bank details have changed. A payment is due today.
Under the firm’s callback rule, the office manager says she will confirm the change first. She calls the consultant using the number in the signed contract. The consultant knows nothing about new bank details, and the payment stops.
The rule worked because it did not require her to decide whether the video was real.
What to check in your payment process
Firms may want to review:
- Whether any new payee or changed bank detail requires a callback to a known number.
- Whether one person can approve and release a large payment alone.
- Whether staff feel comfortable pausing a payment when a senior person asks for urgency.
- Whether the firm knows how much public video and audio of its principals exists.
- Whether the policy includes social engineering coverage, and what its limit is.
Where insurance fits with deepfake fraud
A loss like this is generally called a social engineering loss. Coverage often sits in a cyber or crime policy, and it is frequently subject to a sublimit that is much lower than the main policy limit. Some policies also require specific verification procedures before they respond.
Some renewals may also add exclusions or restrictions related to deepfakes, so the current wording matters. The comparing cyber quotes page shows where to find the social engineering line. The glossary entry on social engineering explains the term.
Hardcover insight
Firms often assume a large cyber limit covers a fraudulent transfer. In practice, the social engineering sublimit may be far smaller, and the policy may attach conditions to it. Checking that one line before a loss is much easier than discovering it afterward.
Related questions
Was the Arup deepfake case a hack?
No. Arup’s systems were not breached. Attackers used fake video and audio to persuade an employee to send money.
When did the Arup deepfake fraud happen?
It happened in early 2024. Some articles give a different year, but the WEF reporting places it in 2024.
How much did the deepfake video call cost?
Reports put the total at about US$25.6 million across 15 transfers. Some outlets round the figure to $25 million.
How can a firm protect against deepfake payment fraud?
A callback rule for new payees and changed bank details is a practical starting point. Separating who approves and who releases payments also adds a check.
Does cyber insurance cover deepfake fraud?
It depends on the policy. Coverage may fall under social engineering or crime provisions, often with a sublimit and conditions. Review the actual wording.
Do I need to spot a deepfake to stay safe?
No. A verification rule protects the firm even when the fake looks convincing.