British engineering giant Arup revealed as $25 million deepfake scam victim

Hong Kong
CNN
—

A British multinational design and engineering company behind world-famous buildings such as the Sydney Opera House has confirmed that it was the target of a deepfake scam that led to one of its Hong Kong employees paying out $25 million to fraudsters.

A spokesperson for London-based Arup told CNN on Friday that it notified Hong Kong police in January about the fraud incident, and confirmed that fake voices and images were used.

“Unfortunately, we can’t go into details at this stage as the incident is still the subject of an ongoing investigation. However, we can confirm that fake voices and images were used,” the spokesperson said in an emailed statement.

“Our financial stability and business operations were not affected and none of our internal systems were compromised,” the person added.

Hong Kong police said in February that during the elaborate scam the employee, a finance worker, was duped into attending a video call with people he believed were the chief financial officer and other members of staff, but all of whom turned out to be deepfake re-creations. The authorities did not name the company or parties involved at the time.

According to police, the worker had initially suspected he had received a phishing email from the company’s UK office, as it specified the need for a secret transaction to be carried out. However, the worker put aside his doubts after the video call because other people in attendance had looked and sounded just like colleagues he recognized.

He subsequently agreed to send a total of 200 million Hong Kong dollars — about $25.6 million. The amount was sent across 15 transactions, Hong Kong public broadcaster RTHK reported, citing police.

“Deepfake” normally refers to fake videos that have been created using artificial intelligence (AI) and look extremely realistic.

Earlier this year, pornographic AI-generated images of pop star Taylor Swift spread across social media, underscoring the damaging potential posed by AI technology.

As a top engineering consulting firm, Arup has 18,500 employees across 34 offices around the world. It was responsible for landmarks such as the Bird’s Nest stadium, site of the 2008 Beijing Olympic Games.

“Like many other businesses around the globe, our operations are subject to regular attacks, including invoice fraud, phishing scams, WhatsApp voice spoofing, and deepfakes. What we have seen is that the number and sophistication of these attacks has been rising sharply in recent months,” Rob Greig, Arup’s global chief information officer, said in the emailed statement.

People ski on a slope in front of China's National Stadium, also known as the Bird's Nest, in Beijing on January 7, 2010. The structure was designed by Arup for the 2008 Summer Olympics and Paralympics.

Authorities around the world are growing increasingly concerned about the sophistication of deepfake technology and the nefarious uses it can be put to.

In an internal memo seen by CNN, Arup’s East Asia regional chairman, Michael Kwok, said the “frequency and sophistication of these attacks are rapidly increasing globally, and we all have a duty to stay informed and alert about how to spot different techniques used by scammers.”

Kwok returned to the role earlier this month, replacing Andy Lee, who announced his departure from Arup on his LinkedIn page about a week ago after 26 years at the company.

This story has been updated with additional information.