Hong Kong police have launched an investigation after an employee of engineering consultant Arup was tricked by deepfake imagery and sound into sending criminals HK$200m (US$25m) earlier this year.
Arup confirmed last week to newspaper The Guardian that it was the victim of the theft, after Hong Kong police notified media of the crime in February, without naming the company targeted.
Then, police superintendent Baron Chan told Hong Kong broadcaster RTHK that the employee received a message purportedly from the company’s chief financial officer inviting them to a video conference to discuss confidential transactions that had to be made.
People on the video conference looked and sounded like fellow company staff, but were fake, created using past video conferences, police said.
The employee complied, sending the money to five local bank accounts in 15 different transactions.
The employee only discovered the scam after speaking to head office.
In a statement to The Guardian last week, Arup’s global chief information officer, Rob Greig, said his company had been subject to frequent attacks, including deepfakes.
“What we have seen is that the number and sophistication of these attacks has been rising sharply in recent months,” Greig said, adding he hoped Arup’s experience would raise awareness of the risk.
Arup’s statement said: “Our financial stability and business operations were not affected and none of our internal systems were compromised.”
