A finance worker got an email he thought was a scam. So he asked to confirm it on a video call. The CFO showed up. So did his colleagues. Every face was fake. He wired $25.6 MILLION.

Arup is a British engineering firm. It designed the Sydney Opera House and Beijing's Bird's Nest stadium. 18,500 employees. 34 offices.
In January 2024, a finance worker in its Hong Kong office received an email.
It claimed to be from the company's chief financial officer in the UK. It asked him to arrange a confidential transaction.
He thought it was phishing. He was right.
So he did the careful thing. He asked to confirm it on a video call.
The CFO joined. So did several colleagues he recognized.
They looked right. They sounded right.
They told him to move the money. He stopped doubting and started transferring.
He made 15 transfers to five Hong Kong bank accounts.
200 million Hong Kong dollars. About $25.6 MILLION.
The whole thing took a week.
Then he called head office in the UK to follow up.
Nobody there knew anything about a confidential transaction.
Every person on that video call had been a deepfake. The CFO. The colleagues. ALL OF THEM.
The scammers had built the fakes from public footage. Earnings calls. Online meetings. Clips scraped off the internet.
The only real person on the call was the man being robbed.
Arup reported it to Hong Kong police in January 2024. The firm was not named publicly until CNN identified it in May.
"We can confirm that fake voices and images were used," said Rob Greig, Arup's global chief information officer.
The money was never recovered. No one has been charged for the call.
Greig later tried to deepfake himself using free tools. It took him 45 minutes.