A UK engineering firm has admitted to having fallen victim to a deepfake fraud, losing over USD 25 million (HK$200m, £20m) after an employee was deceived into transferring funds by criminals using an artificial intelligence-generated video call, The Guardian reported.
Arup, the British company, disclosed that it had notified the police in Hong Kong earlier this year about a fraud incident involving fake voices and images.
In February, the Hong Kong police revealed that an employee of an unnamed company had been deceived into transferring significant sums by individuals impersonating senior company officials.
Arup’s global chief information officer, Rob Greig, hoped that their experience would raise awareness of cyber attackers’ growing sophistication. The Guardian cited The Financial Times as the first to report that Arup was the targeted company in the fraudulent scheme.
Arup, a multinational firm based in London, offers a comprehensive range of professional services encompassing design, engineering, architecture, planning, and advisory services across various domains within the built environment.
The British newspaper cites the company’s statement: “Our financial stability and business operations remained unaffected, and none of our internal systems were breached.”
Rob Greig, responsible for overseeing the company’s computer systems, noted that the organisation has been targeted by numerous attacks, including instances involving deepfakes.
“Like many other businesses around the globe, our operations are subject to regular attacks, including invoice fraud, phishing scams, WhatsApp voice spoofing and deepfakes. We have seen that the number and sophistication of these attacks has been rising sharply in recent months,” he said.
Arup, one of the world’s leading consulting engineering firms, employs more than 18,000 people and famously provided the structural engineering for the Sydney Opera House including its distinctive concrete shells. Recent project involvements include the Crossrail transport scheme in London and the Sagrada Família in Barcelona.
According to a recent report by The Guardian, the world’s largest advertising conglomerate fell victim to a deepfake scam involving an AI-generated voice clone.
Mark Read, the CEO of WPP, disclosed the incident in an email to senior colleagues, cautioning them to be vigilant against calls purporting to be from top executives. WPP plc, headquartered in London, is a multinational conglomerate specialising in communications, advertising, public relations, technology, and commerce.
The Hong Kong media, citing a senior police superintendent, stated that the employee was lured into a conference call with “many participants.” The officer explained that since the participants “looked like real people,” the employee proceeded to transfer HK$200m to five local bank accounts through 15 transactions.
No arrests had been made so far but the investigation was ongoing and the case was being classified as “obtaining property by deception”.
