London-based architecture and design firm Arup Group were defrauded of some US$25 million (HK$200m) after scammers used AI-generated “deepfakes” to falsely pose as the group’s CFO and request transfers from an employee to bank accounts in Hong Kong.

Arup, which employs about 18,000 people globally, has annual revenues of more than £2bn.

Cheng Leng and Chan Ho-him, writing for Financial Times »

The case highlights the threat posed by deepfakes — hyper-realistic video, audio or other material generated using artificial intelligence — when used by cyber criminals to target companies or governments.

“We can confirm that fake voices and images were used,” the company said, declining to give details because the incident was still being investigated. “Our financial stability and business operations were not affected and none of our internal systems were compromised,” it said.

Hong Kong police acting senior superintendent Baron Chan told local media in February that a member of staff at the targeted company had received a message purporting to be from the UK-based chief financial officer regarding a “confidential transaction”.

CNN »

According to police, the worker had initially suspected he had received a phishing email from the company’s UK office, as it specified the need for a secret transaction to be carried out. However, the worker put aside his doubts after the video call because other people in attendance had looked and sounded just like colleagues he recognized.

He subsequently agreed to send a total of 200 million Hong Kong dollars — about $25.6 million. The amount was sent across 15 transactions, Hong Kong public broadcaster RTHK reported, citing police.

“Deepfake” normally refers to fake videos that have been created using artificial intelligence (AI) and look extremely realistic.

Elsewhere » Fortune | CFO  | CFO Dive | Architects’ Journal