In February, a multinational company’s finance team member in Hong Kong made headlines after he transmitted HK$200 million (US$25 million) to cybercriminals who pretended to be the chief financial officer and other colleagues, using deepfake technology, in what the worker thought was a legitimate video conference.
Now it’s been revealed that it was UK engineering group Arup that fell victim to the elaborate scam.
When the cybercrime was first brought to light earlier this year, Hong Kong police’s Baron Chan Shun-ching told local reporters: “(In the) multi-person video conference, it turns out that everyone [he saw] was fake.”
Prior to the video conference, the finance employee received an e-mail purportedly from the CFO based in the UK. It was about a “confidential transaction” that the HK staff member feared might be a phishing attempt – the deepfake video conference was what it took for the worker to think he was receiving an actual order from the top.
The fraudulent crime spanned 15 transfers amounting to the abovementioned sum. It wasn’t until a follow-up with the British headquarters that the HK side confirmed one of their employees had been duped.
In a statement last Friday, Arup said: “Unfortunately, we can’t go into details at this stage as the incident is still the subject of an ongoing investigation. However, we can confirm that fake voices and images were used.
“Our financial stability and business operations were not affected, and none of our internal systems were compromised.”
It was reported that Arup notified authorities in Hong Kong in January. To date, no arrest has been made as the probe continues.
Meanwhile, the Financial Times quoted Arup global chief information officer Rob Greig as saying: “I hope our experience can help raise awareness of the increasing sophistication and evolving techniques of bad actors.”
What do you think about this story? Share your thoughts in the comments below.
