Hong Kong deepfake fraud: HK$200M stolen via synthetic video calls
Deepfake Video Call Nets HK$200M in Hong Kong Fraud
A finance employee at Arup, a London-based multinational engineering and design firm, fell victim to a sophisticated deepfake fraud scheme in January 2024 after being deceived in a video conference call using synthetic video and voice impersonation of senior colleagues Bank Info Security.
The employee transferred HK$200 million (approximately US$25.5 million) across 15 separate wire transfers to five Hong Kong bank accounts controlled by the fraudsters. The scam targeted Arup's Hong Kong office and represents one of the most significant documented cases of deepfake-enabled financial fraud to date.
How the Scam Unfolded
Fraudsters fabricated an entire video meeting featuring deepfake renderings and cloned voices of what appeared to be senior management colleagues. The synthetic impersonation was convincing enough to persuade the finance employee to initiate multiple transfers over time. The attack succeeded because it exploited the trust typically placed in internal video communications and the visual and auditory authenticity of the deepfake technology deployed.
Hong Kong police characterized the incident as obtaining property by deception and assigned it to the Regional Technology and Financial Crime Unit, Kowloon West for investigation Bank Info Security. At the time of public reporting, police stated: "After initial investigation, the case is classified as obtaining property by deception and is being handled by the Regional Technology Financial Crime Unit, Kowloon West. Investigations are still ongoing and no arrest has been made so far."
Broader Implications for Financial Institutions
The case represents a watershed moment for financial crime detection. Hong Kong police had previously sounded an alarm about the first-ever-detected use of deepfakes to deceive financial institutions, warning banks and enterprises that synthetic media attacks could penetrate even high-trust internal communication channels. The Arup incident confirmed this threat landscape was not hypothetical—it was active and damaging.
The success of the fraud underscores a critical vulnerability in enterprise security: the assumption that video conferencing and voice communications from known contacts remain trustworthy. As deepfake technology becomes more accessible and realistic, the forensic burden on finance teams to verify transaction authorizations grows exponentially.
As of July 2026, no arrests have been reported in connection with the case, and the investigation remains open. The incident has prompted multinational companies and financial institutions across Hong Kong and Southeast Asia to reassess authentication protocols for high-value transactions and to implement verification procedures independent of visual or voice confirmation alone.