AI Autopsy · video notes
The $25.6M deepfake call: 3-step defense checklist
Seeing a face on a call is not verification. Here is the checklist from the video, and the case it comes from. Send it to whoever approves payments.
The checklist
- Hang up and call back on a number you already have. Not a number, link or invite from the message asking for money. The FBI: “Verify the identity of the person calling you by hanging up the phone, researching the contact of the bank or organization purporting to call you, and call the phone number directly.” For payment or account changes it also says to “use secondary channels”.
- Ask for the code word. The FBI suggests families “create a secret word or phrase” to verify identity. Using one at work is our adaptation. Hong Kong police also advised people to “ask questions to test the participant's identity” on a suspicious video call.
- Two people approve any unusual payment. Switzerland's national cyber security centre recommends payment processes with “dual control principle, joint signature by two people”.
Our rule: secret + urgent + money = stop. Then run steps 1 to 3.
Our rule, not a quote. The FBI and the other sources above don't use this wording. We built it from the case: the scam began with a “secret transaction”.
Download the printable checklist (.md)
What happened
- A finance worker in Arup's Hong Kong office got a message, apparently from the company's UK-based chief financial officer, about the need for a “secret transaction”.
- The worker first suspected phishing, then joined a video call where the other people looked and sounded like colleagues.
- Hong Kong police later said everyone else on that multi-person call was fake. Police said the fakes were built from publicly available video and audio of the people being impersonated.
- Some retellings describe the fakes as live, real-time deepfakes. Hong Kong's government says the meeting was pre-recorded: “Since the meeting was pre-recorded, there was actually no interaction between the informant and the fraudster.” (LegCo written reply LCQ9, 26 June 2024.) Hong Kong Free Press (AFP) reported the same.
- The worker made 15 transfers, totalling HK$200 million (about US$25.6 million), to five local bank accounts over about a week.
- The fraud came to light when the worker checked with the company's head office. Arup notified Hong Kong police in January 2024, and confirmed in May 2024 that it was the company: “We can confirm that fake voices and images were used.”
How we checked. Every fact above appears in at least two reputable outlets, or on an official page we opened. On live vs pre-recorded, we follow the Hong Kong government's own reply (LCQ9), which says pre-recorded.
Sources
Every fact on this page comes from these pages, opened on 8 October 2026. Things change: check the live page before you rely on it.
- Hong Kong Government, “LCQ9: Combating frauds involving deepfake”, written reply to the Legislative Council (26 Jun 2024) Pre-recorded; HK$200 million; case status.
- CNN, “Finance worker pays out $25 million after video call with deepfake ‘chief financial officer’” (4 Feb 2024; syndicated copy) Original: edition.cnn.com
- CNN, “British engineering giant Arup revealed as $25 million deepfake scam victim” (16 May 2024; syndicated copy) Original: edition.cnn.com
- Fortune (17 May 2024)
- The Register (5 Feb 2024)
- Hong Kong Free Press (5 Feb 2024)
- The Standard, Hong Kong (4 Feb 2024)
- Retellings that call the fakes live or real-time: Nametag (17 May 2024)
- Adaptive Security (16 May 2024)
- FBI IC3, PSA I-120324-PSA: criminals use generative AI to facilitate financial fraud (3 Dec 2024) Call back; secret word.
- FBI IC3, PSA I-091124-PSA: Business Email Compromise (11 Sep 2024) Secondary channels.
- Swiss National Cyber Security Centre, weekly review 23 (15 Jun 2021) Dual control.
A workflow, not professional security or legal advice.
No sponsor and no affiliate links on this page. Vendors are named so you can check them yourself, not as recommendations.
Follow Hourwiz
- YouTube@hourwiz (opens in a new tab)
- Instagram@hourwiz.ai (opens in a new tab)
- Facebookhourwizhq (opens in a new tab)