Deepfake Executive Call Triggers $25M Transfer

An Arup employee transferred $25 million to fraudulent accounts after joining a video call featuring deepfake impersonations of company executives. The case shows how realistic-looking executive impersonation can pressure employees into approving high-value payments, even when the request appears to come from familiar leaders.

Key findings

• An Arup employee transferred $25 million to fraudulent accounts after a video call involving deepfake executive impersonations.
• The incident demonstrates that deepfake fraud can use a familiar business workflow, an executive-led call followed by a payment request, to create trust and urgency.
• Hong Kong banks are testing deepfake-detection controls, but the article notes that limited public testing detail makes real-world effectiveness difficult to assess.
• Ping An Digital Bank reported more than 96 percent detection accuracy in tests involving manipulated or synthetic selfies, while HSBC said no tested deepfake attempts bypassed its controls.

Who’s being targeted

• Commonly targeted roles: Finance and treasury teams, Accounts payable staff, Payment approvers, Executive assistants, Senior executives, Relationship managers.
• Affected industries: Engineering services, Financial services, Banking.
• Attack channels: vishing.
• Impersonated: Arup company executives.

Awareness takeaways

• Independently verify high-value payment requests using a known phone number or another approved channel, even if the requester appears on a video call.
• Treat unexpected changes to payment instructions or destination accounts as a stop-and-verify event.
• Do not rely on a familiar face or voice alone to authenticate an executive; deepfake impersonation can convincingly imitate both.

Red flags to watch for

• The payment request relies on a video-call identity that could be synthetically generated.
• The requested destination accounts are fraudulent rather than established, verified company or vendor accounts.
• A high-value transfer is requested without independent confirmation through a known channel.