The $25 million video call

Picture a normal workday in early 2024. A message lands that appears to come from your company's chief financial officer in London. It mentions a confidential transaction, and you are suspicious enough to join a video call to talk it through. The CFO is there, along with other colleagues you recognize. They look right, they sound right, and the request now feels routine.

That is roughly what happened to a finance employee in the Hong Kong office of Arup, the British engineering firm behind the structural work on the Sydney Opera House. Everyone else on that call was a deepfake. This piece walks through what is publicly confirmed, then turns it into habits any finance team can adopt this week.

What happened, and what Arup confirmed

Hong Kong police first described the case at a briefing on Friday, Feb. 2, 2024, without naming the company. According to CNN's report on that briefing, the employee received a message that claimed to be from the UK-based CFO and talked about the need for a secret transaction. The employee first suspected a phishing attempt. Those doubts faded during a multi-person video call in which the other participants looked and sounded like colleagues the employee knew. Senior Superintendent Baron Chan told public broadcaster RTHK that everyone on the call turned out to be fake.

The employee went on to send a total of HK$200 million. The Guardian, citing Hong Kong media reports of Chan's comments, says the money went to five local bank accounts in 15 transactions. The fraud came to light only when the employee later checked with the company's head office.

In May 2024, after the Financial Times identified the company, Arup confirmed it was the victim. A spokesperson told CNN that Arup had notified Hong Kong police in January and that fake voices and images were used. The company said its financial stability and business operations were not affected and none of its internal systems were compromised. It declined to share more detail because the investigation was ongoing. A Hong Kong police statement quoted by the Guardian at the time said no arrests had been made and the case was classed as obtaining property by deception.

About that $25 million figure

The headline number needs one clarification. The transfers were in Hong Kong dollars. HK$200 million was about US$25.6 million at the time, according to CNN, and about £20 million, according to the Guardian. So "$25 million" is a U.S. dollar conversion, which is why you will see the same case reported as $25 million, $25.6 million or £20 million. Arup itself confirmed the incident and the use of fake voices and images. The amount and the transfer details come from Hong Kong police and local media.

Some details remain thin. Arup has not published a full account, and reports differ on small points, such as whether the first approach was described as an email or a message. What nobody disputes is the core pattern: an urgent, secret payment request, made believable by a video call.

Why the video call worked

It is easy to read this story and think you would have caught it. The employee did the sensible thing at first: they noticed the request looked odd. The video call is what removed the doubt, because seeing several familiar faces is about as strong a signal of "this is real" as most of us ever get.

Arup's global chief information officer, Rob Greig, said in the company's statement to CNN that its operations face regular attacks, including invoice fraud, phishing, WhatsApp voice spoofing and deepfakes, and that the number and sophistication of those attacks had been rising sharply. In December 2024, the FBI's Internet Crime Complaint Center warned that criminals use AI-generated video in real-time video chats with people posing as company executives.

The lesson is uncomfortable but useful. Recognizing a face or a voice is no longer proof of identity. Your process has to do the verifying, so no single person has to be a deepfake detective on a live call.

The habits that stop it

None of these steps need new software. They need agreement, practice and leaders who follow them too.

Call back on a number you already have. If a payment request arrives by email, chat, phone or video, end the conversation and call the person on a number from your company directory, your phone's saved contacts or an earlier, trusted thread. Never use a number, link or meeting invite supplied in the request itself. The FBI gives the same advice in its generative AI fraud alert: hang up and contact the person or organization through a number you look up yourself.

Require two people for big or unusual payments. Dual approval means one person cannot be talked into a large transfer alone. Set a threshold that fits your business, and make "new beneficiary" or "changed bank details" trigger a second approver no matter the amount.

Verify out of band. Use a different channel from the one the request came in on. A request on video gets confirmed by phone. A request by email gets confirmed in person or through your finance system. The FBI's business email compromise guidance recommends confirming changes to account information through a secondary channel.

Treat "secret" as a stop sign. Real acquisitions and urgent deals do exist, but legitimate ones still go through your normal approval path. A request to keep a payment from your usual approvers is a reason to slow down.

Make "let me call you back" normal

Process only works if people feel safe using it. An employee who thinks the CFO will be annoyed by a call-back may skip it. So say it out loud, from the top: any request for money or sensitive data gets verified, and no one is ever in trouble for checking.

Here is a short routine your finance team can copy:

1. Write down your verification rule in one sentence and pin it where payments happen. For example: "Every new payee, bank change or urgent transfer gets a call-back on a known number and a second approver."

2. Ask your CEO and CFO to tell the team, in writing, that they expect to be called back and will never bypass the rule.

3. Give everyone a polite script: "Happy to help. I'll call you right back on your usual number to confirm."

4. Run a short drill each quarter. Have a leader send a harmless test request and praise the person who verifies it.

5. Agree on an escalation contact for when something feels off, and make reporting a near miss feel like a win.

6. Review the rule after any incident, close call or change in tools, without looking for someone to blame.

The Arup case is famous because of the technology. The defense is ordinary: a pause, a phone call and a second pair of eyes. Share this with your finance team and with anyone at home who handles money for the family, because the same trick works on a video call from a "relative."

Sources

• CNN, "Finance worker pays out $25 million after video call with deepfake 'chief financial officer'," Feb. 4, 2024: CNN report on the Hong Kong police briefing

• CNN, "British engineering giant Arup revealed as $25 million deepfake scam victim," May 16, 2024: CNN report on Arup's confirmation

• The Guardian, "UK engineering firm Arup falls victim to £20m deepfake scam," May 17, 2024: Guardian report

• FBI Internet Crime Complaint Center, "Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud," Dec. 3, 2024: IC3 PSA I-120324-PSA

• FBI Internet Crime Complaint Center, "Business Email Compromise: The $55 Billion Scam," Sept. 11, 2024: IC3 PSA I-091124-PSA

Or let NimBot handle it

A call-back rule only works when everyone has practiced it. You can do all of this yourself, and it works. If you'd rather not run it alone, NimBot handles the training, the drills and the reminders for your whole team. Try it at app.nim.bot.