# Deepfake fraud: what happens when a video call can be faked > For a century a voice on the phone or a face on a call was good enough proof of who you were talking to. AI has quietly ended that. The best-documented case is a Hong Kong finance employee who joined a video call with their chief financial officer and colleagues, all fake, and sent HK$200 million. Here is what happened, why it works, and the one habit that defeats it. Updated 2026-11-03 · Payaries · https://www.payaries.com/blog/deepfake-fraud-seeing-is-no-longer-believing ## The Arup case > **Written 3 November 2026.** From CNN, Fortune and other reports of 2024. The Arup case is the best-documented deepfake payment fraud; many other quoted figures online are not, so this piece sticks to what major outlets reported. Payaries is a technology platform, not a security adviser. This article reports public information and is not legal or security-consulting advice. Facts in fast-moving stories change — read the primary sources linked below. In January 2024 an employee in the Hong Kong office of the engineering firm Arup received a message that appeared to be from the company's UK-based chief financial officer asking for a confidential transaction. They joined a video call that appeared to include the CFO and other staff, but the other participants were AI-generated. Police said the deepfakes were built from publicly available footage. The employee made **15 transfers totalling HK$200 million (about US$25.6 million) to five Hong Kong bank accounts**. Arup reported it to police that month, police made the case public in February, and Arup confirmed it was the victim in May 2024. It said its internal systems were not compromised and its financial stability was not affected. Nothing was hacked in the usual sense. The attackers did not break into a network; they impersonated authority, which is cheaper and works on people instead of software. ## Why it works - **It borrows authority.** A request that appears to come from the CFO, on a video call with colleagues, in a confidential matter, is built to override the employee's own doubt. - **The raw material is public.** Interviews, conference talks and social video give enough footage and audio to clone a likeness. Executives are the easiest targets because they are the most recorded. - **Controls assume identity is proven by a face.** Many approval processes were written when seeing or hearing someone was proof. - **Payment rails are fast and often irreversible.** Once funds leave to a mule account they are hard to claw back, and faster still if sent by instant or crypto rails, a point we return to in [the ransomware economy](https://www.payaries.com/blog/ransomware-economy-crime-as-a-business). ## Beyond payments The same capability scales in other directions: fake customer-support calls in a relative's cloned voice, fake job candidates, and fabricated clips during elections or a crisis. The harm to civilisation is less any single scam than the slow erosion of default trust in audio and video, which is a public good that took generations to build. When anything can be faked, everything can be denied. ## The habit that defeats it: verify out of band 1. Treat urgency, secrecy and unusual payment instructions as the warning sign, whoever appears to be asking. 2. **Call back on a number you already hold**, not one supplied in the message or on the call. 3. Require two people to approve payments above a threshold, and for any change of beneficiary details. 4. Agree a code word with family and key colleagues for emergency requests. 5. Do not rely on “detecting” a deepfake by eye. Artefacts like odd blinking are disappearing; process beats perception. The same logic applies to machine-to-machine payments. A payment instruction should be proven by something an impersonator cannot copy: a cryptographic signature, not a face. That is why signed requests and [verified webhook signatures](https://www.payaries.com/guides/verify-crypto-webhook-signatures) matter more as faking gets easier. ## Sources - [British engineering giant Arup revealed as $25 million deepfake scam victim — CNN (16 May 2024)](https://edition.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk) - [Arup deepfake fraud scam victim, Hong Kong — Fortune (17 May 2024)](https://fortune.com/europe/2024/05/17/arup-deepfake-fraud-scam-victim-hong-kong-25-million-cfo) ## Questions **What was the Arup deepfake scam?** In early 2024 a finance employee at engineering firm Arup's Hong Kong office joined a video call where the CFO and colleagues were AI-generated fakes, and made 15 transfers totalling HK$200 million (about US$25.6 million) to five bank accounts. Arup confirmed it was the victim in May 2024. **How can you tell if a video call is a deepfake?** You often can't, reliably. The robust defence is procedural: verify unusual requests by calling back on a number you already hold, and require two-person approval for large payments or changes of payee. **Can crypto payments be reversed after a deepfake scam?** Generally no: on-chain transfers are final, which is why verifying the instruction before sending matters. Card and bank payments have limited dispute and recall routes, but fast transfers are also hard to recover. ## Try it Run a real invoice before you commit: [Payaries — www.payaries.com](https://www.payaries.com/signup). Payaries is a multi-chain crypto payment gateway — https://www.payaries.com ## Keep reading - https://www.payaries.com/blog/how-ai-is-making-cyberattacks-faster-and-cheaper — How AI is making cyberattacks faster, cheaper and harder to spot - https://www.payaries.com/guides/verify-crypto-webhook-signatures — How to verify crypto payment webhook signatures - https://www.payaries.com/guides/sign-crypto-payment-api-requests — How to sign crypto payment API requests (HMAC-SHA256) - https://www.payaries.com/blog/how-to-defend-against-cyberattacks-what-works — How to defend against cyberattacks: the checklist that matches how attacks actually happen - https://www.payaries.com/blog/what-is-cryptocurrency — What is cryptocurrency? A plain-English guide