A deepfake video call in Hong Kong
In late January 2024 an employee in the Hong Kong office of a multinational firm, following instructions from a 'chief financial officer' in a video conference, transferred about HK$200 million to five local accounts. On 4 February police said everyone on the call except the victim was an impersonation built from public video and voice; the firm turned out to be the British engineering company Arup, which confirmed on 16 May that fake voices and images were used.
Why it matters
The news agency AFP described it as one of the first cases of its kind in the city. The fraud did not rest on breaking into systems but on trust in familiar faces and voices in a call with several people; Arup itself says its systems were not compromised. This is the testimony of the police and of the victim company: the offenders are not named, and the sources do not say whether any money came back.
What is known. Police were told on 29 January 2024, by which time about HK$200 million had gone out in fifteen transfers (AFP, from police). The government's written reply to the Legislative Council of 26 June 2024 says the same in substance: in late January the victim received a phishing email from someone posing as the chief financial officer of the head office in the United Kingdom, was invited to a group video conference about 'confidential transactions', and authorised transfers to five local bank accounts. The police believe the video conference was recorded in advance from downloaded public video clips and voices, so there was no interaction with the victim; after giving the instruction the fraudster ended the meeting under a pretext and went on giving payment instructions by instant messaging. On 26 June the case was still under investigation; on 4 February there had been no arrests. Who. Police did not name the company. On 16 May 2024 Arup confirmed to CNN that it was the firm: it had notified Hong Kong police in January, 'fake voices and images were used', its financial stability and operations were not affected and no internal systems were compromised. In February 2025 its chief information officer, Rob Greig, told the World Economic Forum that he would call it 'technology-enhanced social engineering' and that no data was affected. Disagreements. The press and the Forum say 'video call', while the police say the video was pre-recorded and without dialogue; how many participants were fabricated is not specified in the texts read. The dollar figure varies with the exchange rate: 25.6 million (CNN), 26 (AFP), 25 (the Forum). No source read gives the day of the transfers, so the date is January 2024, not a day. What the record does not claim: that the video was synthesised in real time; who is behind the fraud; whether the money was recovered; which program or model was used. Other cases in the government's reply (an August 2023 face-swap loan fraud of HK$200,000; a May 2024 attempt of nearly HK$4 million) are not part of it.