Convincing faces, unauthenticated seats: the Hong Kong deepfake was a meeting-identity failure

The week

In early February 2024, Hong Kong police described the case. An employee of a multinational company’s Hong Kong office had been deceived into moving money. In 15 transfers, the employee sent about HK$200 million, roughly US$25 million, to accounts the fraudsters controlled. The employee acted after a video conference in which the company’s UK-based chief financial officer and other colleagues appeared to be present. Police said those participants, who looked and sounded as they always did, were deepfakes.

The sequence, as reported from the police briefing, followed a familiar fraud pattern with one new step. The employee first received a message, apparently from the CFO, about a secret transaction, and suspected it was phishing. The video call dispelled that doubt. The fraud came to light only when the employee later checked with the company’s head office. Police did not name the company at the time.

A deepfake is video or audio generated or altered by artificial intelligence to make a real person appear to say or do something they never did. Until recently, convincing fakes took time, skill and expensive equipment. Generative AI tools, the same family of technology behind chatbots and image generators, have made them far easier to produce. The company was identified in May 2024 as the engineering firm Arup, which confirmed that fake voices and images had been used.

The case was not the first time an executive’s likeness had been used to move money. Voice-only impersonation had already been reported, most often cited in a 2019 case in which the chief executive of a UK energy firm was reportedly persuaded by a cloned voice to send about €220,000. What changed by 2024 was the medium. The Hong Kong fraud used several moving, speaking faces at once, in the setting where staff meet colleagues every day.

The same fortnight brought two other signals that AI impersonation had moved from novelty to everyday risk. On February 8, the Federal Communications Commission released a declaratory ruling, adopted on February 2, that AI-generated voices in robocalls are artificial voices under the Telephone Consumer Protection Act, the U.S. law that restricts automated and prerecorded calls. A cloned voice in a robocall would therefore be treated under the same rules as any other artificial or prerecorded voice, and such calls need the prior express consent of the person called.

The ruling had a clear trigger. In January 2024, voters in New Hampshire had received robocalls using a cloned voice of President Biden that urged them not to vote in the state’s primary. The FCC had opened an inquiry into AI and robocalls in November 2023, and 26 state attorneys general had urged it to treat AI-generated voices as artificial voices under the Act. The ruling gave those attorneys general firmer ground to bring cases.

On February 14, Microsoft and OpenAI reported that several state-affiliated groups had used large language models for reconnaissance, scripting and drafting phishing content. A large language model is the kind of AI system that powers chatbots, trained on vast amounts of text to produce fluent writing on request. Reconnaissance means researching targets; phishing means deceptive messages designed to trick someone into acting.

The report named five groups: one linked to Russia, one to North Korea, one to Iran and two to China. Their uses were mundane. They researched technologies and organizations, got help with scripts and code, translated material and drafted content likely meant for spear-phishing. Microsoft said it had not yet seen particularly novel AI-enabled attack techniques, and the accounts linked to these groups were disabled.

Put together, the week showed that the tools for faking a face, a voice or a convincing message were now in the hands of criminals and governments alike. None of the three developments involved a new kind of attack. Each made an old one cheaper, faster or more convincing.

Most commentary filed the Hong Kong case under business email compromise with better special effects. Business email compromise, or BEC, is the familiar fraud in which a criminal impersonates an executive or supplier by email to get someone to send money. Business email compromise is at bottom a payments problem, decided by callbacks and dual release, and that remained true here.

The new element here was the meeting. A video call with several familiar faces did what an email could not: it removed doubt. The employee was persuaded by a channel that most organizations treat as trusted by default, though it rarely authenticates anyone. To authenticate is to prove that someone is who they claim to be. A face on a screen proves nothing of the kind; it only looks as if it does.

That makes the meeting itself a control surface, a place where an organization can put checks. It has three points where a bank can act: how someone gets into the meeting, what counts as proof of identity once inside, and how an instruction leaves the meeting and becomes a transaction.

The argument below starts with the two technologies that made the attack cheap, then takes the three control points in order. It then tests the argument against the most common alternative, better detection, and closes with the costs of a loss and the controls a bank should be able to show. Banks appear in two roles throughout: as organizations whose own staff can be deceived, and as the institutions through which their clients’ money moves.

Cheap fakes, open meetings

Two technologies meet in this story. The first is the deepfake. Modern AI systems can learn what a person looks and sounds like from recordings, and then generate new video or audio in that person’s likeness. Senior executives are especially exposed because there is often plenty of public material of them: earnings calls, conference talks, interviews, company videos. The fake does not need to be perfect. On a video call, with compressed images, small windows and the ordinary glitches everyone has learned to ignore, “good enough” is very convincing.

The second technology is the collaboration platform: Microsoft Teams, Zoom, Google Meet, Webex and their peers. These tools are designed to make meetings easy to join. Anyone with a link can usually request entry. Participants show up under a display name, which is simply text, often typed by the participant. The platform may know whether a person is signed in to the company’s own account, but it rarely makes that obvious to everyone else in the meeting.

A video meeting is like a conference room with a glass wall. You can see who is sitting at the table, but the building has no receptionist checking badges, and anyone can write any name on their place card. Most of the time everyone at the table is who they appear to be, so people stop thinking about it. That habit is exactly what the fraudsters exploited.

Collaboration platforms do have security features. They can tell internal users from external ones, hold outsiders in a virtual waiting room called a lobby, and label external participants. The issue is less a lack of tools than how they are configured and how people have been trained to read the signals.

How a meeting fraud is assembled

The attack has a recognizable sequence. It begins with reconnaissance: learning who approves payments, who the senior executives are, how they speak and what projects might plausibly need urgent funding. Public filings, press coverage, conference videos and professional networking profiles supply most of that. The February 14 report from Microsoft and OpenAI described state-affiliated groups using language models for exactly this kind of research, and criminal groups have the same tools.

Next comes the pretext. A confidential acquisition, a regulatory matter or a sensitive settlement is ideal, because secrecy discourages the target from checking with colleagues. In the Hong Kong case, reporting of the police account said the first contact was a message about a secret transaction, which the employee initially suspected was phishing. The video call was the answer to that suspicion.

The meeting itself need not be technically ambitious. An attacker who controls the agenda can keep the target listening rather than talking. Several “participants” who nod along and say little are easier to fake than one long, unscripted conversation. Real-time face and voice synthesis has improved, but a scripted meeting with a passive audience lowers the bar further. The target’s own expectation does the rest: people see what they expect to see from colleagues they know.

The final stage is the money. Instructions are framed as urgent and split into several transfers, which can keep each one under internal thresholds and make the pattern harder to spot. The funds land in accounts that move them on quickly. By the time anyone checks with the real executive, the money has left the first accounts.

Why executives’ likeness has become an exposure

Every organization that puts its leaders on video in public is supplying training material. That cannot be avoided for a listed bank, which holds earnings calls and investor days. It is a smaller issue for a credit union or a private wealth manager whose leaders rarely appear on camera. Even there, voice samples are easy to gather from a voicemail greeting or a short phone call.

The practical response is not to hide executives. It is to assume that their face and voice can be copied, and to remove face and voice from the set of things that authorize action. The rest of this article follows from that assumption.

Getting in: the invitation and the join path

Enterprise collaboration platforms distinguish internal users from external ones, but the distinction is easy to miss. A participant joining from another tenant (another organization’s account on the same platform), a personal account or an anonymous link usually appears with a display name the attacker chose. External labels exist, yet they are often small, and many firms have trained staff to ignore them because so many legitimate meetings include outsiders.

The controls are configuration choices that security and collaboration teams can make in a week. Restrict anonymous join for meetings organized by finance, treasury and executive offices. Make external participants wait in a lobby and show a clear external banner. Block or flag display names that match internal executives when the account is external. Require meetings about payments, acquisitions or confidential transactions to be organized from inside the corporate tenant, by a known person, using the corporate directory, the company’s official list of staff and their accounts.

Which settings matter

The main platforms expose similar controls under different names. Microsoft Teams administrators can decide whether anonymous users may join meetings, which external organizations may communicate with their users, and who may bypass the lobby. Zoom can restrict meetings to authenticated users and require a waiting room. Webex and Google Meet offer comparable options. Most of these settings can be applied by policy to a defined group of users rather than to the whole organization.

That grouping is the key design choice. A bank does not need the same meeting rules for its marketing team and its treasury desk. A policy group covering finance, treasury, payments operations, executive assistants and senior executives captures the people whose meetings can move money. The group should be small enough that tight settings do not paralyze ordinary business, and maintained by the identity team as people change roles.

Executive assistants deserve particular attention. They often organize meetings on behalf of executives, forward invitations and act on instructions relayed by phone. An attacker who can convince an assistant that a meeting is real can get it onto the calendar of people who would never accept an unknown invitation.

Meetings outside the corporate platform

None of the platform settings apply when the conversation moves to a personal messaging app. Several later impersonation attempts against large companies began on consumer messaging services, where a profile photo and a display name are all the identity on offer. A bank cannot configure WhatsApp or Signal for its staff’s personal accounts.

The answer is a policy, not a setting. Requests involving money, credentials or confidential data are only valid if they arrive through corporate channels. A message on a personal app that asks to move a conversation into a “private” call is itself a warning sign. Staff need to hear this rule from senior leaders, because executives are often the ones who prefer personal apps for convenience.

Each setting has a cost. Lobby rules slow down meetings with clients and advisers. Blocking executive name lookalikes produces false positives, alerts that turn out to be harmless. The trade-off is acceptable for a narrow group of high-risk roles. Applying it to everyone would generate the kind of friction that leads people to switch to personal tools, which is worse.

These settings can be measured. A useful monthly report covers the high-risk group. It shows how many meetings included external or anonymous participants and how many external accounts used a display name matching an internal executive. It also shows how many lobby admissions were granted without the organizer’s review. The numbers start high and should fall as habits change. A sudden rise in executive lookalike names is itself an early warning that the organization is being targeted.

How the work differs by institution

A large bank has a collaboration engineering team, a security operations center that can watch for lookalike names, and the scale to justify custom detection rules. Its challenge is breadth. Thousands of staff join meetings with clients, vendors and advisers every day, and any tightening must be targeted carefully.

A community bank or credit union faces the opposite problem. Its collaboration platform is often run by a managed service provider or a single administrator, and default settings may never have been reviewed. Its advantage is size: staff know the CFO personally and may find a second-channel check natural. The most valuable step is often a one-time review of meeting and external access defaults, done with the provider, followed by a short written rule.

Broker-dealers and wealth managers sit in a third position. Much of their exposure comes from clients rather than staff. A wealthy client, or someone impersonating one, may give instructions on a video call or a phone call. Their controls need to cover client authentication and the handling of client instructions as much as internal meetings.

Inside the meeting: what counts as proof

The second point is cultural and procedural. Staff are taught to verify identity on the phone, but few organizations have a rule for video. A face that looks and sounds right has, until recently, been treated as the strongest proof available. Generative video and voice tools have removed that assumption, and the February 14 report from Microsoft and OpenAI showed that attackers were already using language models to research targets and polish their approaches.

Banks need an explicit rule: a face or voice in a meeting is not proof of identity for any request involving money, credentials or confidential data. Credentials are the passwords, codes and access rights that let someone into systems. The rule should name what is proof. Practical options include confirmation through the corporate chat system from the person’s authenticated account, a callback to a directory number, or approval inside a workflow system that requires the person’s own login and multifactor authentication. Multifactor authentication means proving identity with more than one thing, such as a password plus a code from a phone.

The key idea is the second channel. A fraudster who controls the video call does not usually also control the real executive’s phone, chat account and approval system. Checking through a separate route that the organization already trusts breaks the illusion.

The rule only works if senior people follow it visibly. A chief financial officer who tells finance staff, in writing, that every request from them will be confirmed by a second channel removes the social cost of checking. Without that, an employee who challenges an apparent executive on camera bears the risk of being wrong. Few junior employees want to tell the CFO, in front of colleagues, that they doubt the CFO is real. A standing rule turns that awkward moment into a routine step.

Choosing the second channel

Second channels differ in strength. A callback works only if the number comes from the corporate directory, not from the message or the meeting invitation. Corporate chat confirmation is strong when the chat account requires multifactor authentication, and weak if an attacker has already compromised that account. Approval inside a payment or workflow system is strongest, because it ties the confirmation to the transaction itself and leaves an audit trail.

Some organizations add shared challenge phrases or questions only the real person could answer. These help in emergencies but decay quickly. Phrases are forgotten, shared too widely or written down. Personal questions can often be answered from social media. Challenge phrases work best as a backup for when systems are down, not as the main control.

The help desk is a meeting too

The same logic applies wherever a person’s appearance or voice unlocks something. IT help desks reset passwords and multifactor devices for staff who call or join a video session. In 2023, attackers who breached MGM Resorts were widely reported to have started by calling its help desk while posing as an employee. A deepfake makes that approach more convincing.

Help desk procedures should therefore follow the same rule as finance. A reset for a privileged user or a senior executive should require verification through a channel the attacker is unlikely to control. A manager’s confirmation through the corporate directory or an in-person check both qualify. The request is about credentials rather than money, but the credentials can lead to money.

Training needs to change with the rule. Annual awareness modules that show examples of phishing emails do little for this risk. Short, role-specific exercises work better: a finance analyst practicing the second-channel check, an assistant practicing how to decline an unverified meeting request. For New York-regulated institutions, the 2023 amendments to the NYDFS cybersecurity regulation already require annual training that covers social engineering, which gives a natural place to put this material.

Getting out: the handoff from conversation to transaction

The third point is where an instruction leaves the meeting. In the Hong Kong case, a conversation became 15 transfers. The safeguard is to make sure that no meeting, however senior, can directly cause a payment. Instructions should be re-originated in the payment or treasury system by the person who has authority, under their own credentials, and then released by a second person. Re-originated means entered fresh by the authorized person, not passed along second-hand. Dual release, sometimes called the four-eyes principle, means that two people must each approve before money moves.

For banks this applies in two places. The first is the bank’s own treasury, accounts payable and corporate finance functions. The second is clients. Commercial and private banking teams receive instructions from corporate treasurers and family office principals on video calls. Their procedures should state that a call is never an instruction, and client agreements should support that.

Who bears the loss

The legal allocation of loss explains why the handoff matters so much. In the United States, consumer electronic transfers are covered by Regulation E, but wire transfers fall outside it. Commercial wires are governed largely by Article 4A of the Uniform Commercial Code. Under Article 4A, a payment order sent by an employee with authority is the customer’s order, even if that employee was deceived.

Where a bank and its customer have agreed a commercially reasonable security procedure, and the bank follows it in good faith, the customer generally bears the loss from an order that passes that procedure. A deepfake that persuades an authorized employee to send a wire defeats the customer, not the bank’s security procedure. The money is, in law, sent by the customer.

This allocation shapes incentives. A bank may feel little direct exposure from a client’s deepfake loss. The client, however, will ask why the bank’s systems made the loss easy, and the relationship suffers. Other jurisdictions allocate losses differently, and Hong Kong’s rules are not the same as Article 4A, so banks operating internationally should check the position with counsel in each market.

The bank’s position as receiving institution also matters. The Hong Kong funds went to accounts the fraudsters controlled. Mule account detection, including scrutiny of new accounts receiving large, unusual inbound transfers, is the last point where a deepfake-driven payment can be stopped. A mule account is a bank account used to receive and pass on stolen money, sometimes opened with false details and sometimes belonging to a person recruited to lend it.

The receiving bank’s share of the problem

Receiving banks see the other end of the fraud, and they have tools the sending side lacks. They know when an account was opened, what its normal activity looks like and whether incoming funds leave again within hours. A large inbound transfer to a weeks-old account, followed by rapid outbound transfers to several other accounts, is a classic mule pattern.

Deepfakes reach this side too. Mule accounts are often opened with stolen or synthetic identities, and deepfake images can be used to defeat the selfie and liveness checks that many banks use in digital onboarding. Hong Kong police, at the briefing where they described the video call, also described cases in which stolen identity cards and AI-altered images were used in loan and account applications. The same technology attacks the meeting and the account that receives the money.

That makes onboarding controls part of the defense against meeting fraud. Liveness detection, document verification and checks for inconsistencies between the applicant’s data and their device should be tuned with deepfakes in mind. Monitoring rules for newly opened accounts should be stricter than for established ones, with clear authority for staff to hold funds pending review.

Banks can also offer this protection as a service. Corporate clients increasingly ask their banks for payment controls such as named approvers, dual authorization in the online banking platform and checks that the payee name matches the account. Making those features the default for large outbound wires, rather than an option, moves the handoff control into the bank’s own systems, where it does not depend on the client’s meeting hygiene.

Defaults carry a trade-off. Corporate treasurers dislike friction, and a bank that imposes dual authorization on a small client with one finance employee may lose the client to a competitor. A tiered approach helps: mandatory dual authorization above a threshold set with each client, and the option to waive it only with a documented acknowledgment of the risk. That acknowledgment also helps show that the security procedure was commercially reasonable.

Three layers against one attempt

Take a mid-sized bank and one of its corporate clients, a manufacturing firm. A treasury analyst at the client receives a message from the “CFO” about an urgent, confidential acquisition payment, followed by a video call with the “CFO” and two “board advisers.”

At the client, the meeting arrives from an external account. Because the client has set lobbies and external banners for its finance team, the analyst sees a prominent “external” label next to the CFO’s name. That is the first warning. Suppose the analyst misses it. The client’s written rule says no request for money is valid until confirmed in the company chat from the CFO’s own account. The analyst messages the real CFO, who replies that there is no such deal. The fraud ends there.

Suppose instead the analyst is persuaded and tries to send the wire. The bank has made dual authorization the default for large outbound payments, so a second approver at the client must sign in and approve. If that also fails, the bank’s own mule monitoring notices a large, unusual inbound transfer to a newly opened account at the receiving end and holds it for review. Any single layer might fail. The chance of all of them failing together is much smaller.

The layers only multiply if they are independent. If the second approver sits beside the analyst in the same fake meeting, dual authorization adds little, because both people have been deceived by the same evidence. Independence means the second approver reviews the payment in the payment system on its own merits, with the supporting documents, and is expected to ask where the instruction came from.

Why spotting fakes is the wrong goal

A natural reaction to this case is to ask for better detection: train staff to notice odd blinking or lip movements, or buy software that flags synthetic video. Both have some value. Neither should be the main defense.

The trouble with training people to spot fakes is that it asks them to win a contest against tools that keep improving. Whatever tells give away a fake today may be gone in the next version. Staff who have been told to “look for glitches” may also become falsely confident when they see none. And ordinary video calls are full of glitches anyway: frozen frames, lagging audio, poor lighting. People have learned, sensibly, to ignore them.

Detection software faces a similar race. It may catch some fakes and miss others, and it can produce false alarms that teach people to click past warnings. It is a useful extra signal, not a foundation.

The sturdier approach is to design processes that do not depend on anyone judging whether a face is real. If no money moves without a second channel, a fresh entry in the payment system and a second approver, then it does not matter how good the fake is. The fraudster would need to control the real executive’s chat account, phone and approval login as well as the video call. That is a much harder task, which is why the three control points above rest on process and configuration rather than on spotting the fake.

Where detection does belong

Detection has a stronger case in one setting: customer onboarding and remote identity verification. There, a bank must decide whether a stranger is who they claim to be, often with no prior relationship and no second channel. Liveness checks and synthetic media detection are among the few tools available. Investment there is sensible, provided it is tested regularly against current techniques.

Inside the organization, the situation differs. Staff and executives already have authenticated accounts, devices and directory entries. The organization does not need to judge a face, because it already has better evidence of identity. Using that evidence is cheaper and more reliable than any detector.

The strongest objection

The best argument against this approach is that process controls fail under pressure. Fraud succeeds because urgency and authority push people to skip steps. An executive who demands an exception, or a deal team that insists on secrecy, can override a written rule. On this view, process is only as strong as the most senior person willing to bypass it.

The objection is correct about the weakness and wrong about the remedy. Detection does not fix it, because the same executive pressure that overrides a callback would override a warning from a detection tool. The remedy is to put the control where pressure cannot reach it. Dual release can be enforced by the payment system’s configuration, and a standing rule can carry the executives’ endorsement in advance. Exceptions should be possible, but recorded, and reviewed by someone outside the chain of command.

A second objection is cost. Every callback, lobby and second approval slows legitimate business. That cost is real and should be measured. For the small set of transactions above a threshold, though, a delay of minutes is a modest price against a loss of the size seen in Hong Kong.

The loss, and the questions after it

The direct loss in the Hong Kong case is plain: about US$25 million in 15 transfers. For most organizations a loss on that scale would be a board-level event, and money sent to fraudsters is often hard to recover once it has moved on.

The indirect costs can be larger. A firm that loses money this way faces questions from auditors, insurers, clients and, for regulated institutions, supervisors. Why did one employee have the ability to send such sums? Why did no second person check? Why were meeting settings left open? Those are governance questions, and they are asked of leadership, not of the employee who was deceived.

Insurance and recovery

Insurance often responds less fully than expected. Crime policies may cover social engineering fraud only under a separate sublimit, and some exclude losses where an employee voluntarily sent funds. Cyber policies may not respond at all if no system was breached. Finance and risk teams should read their policy wording against a deepfake meeting scenario before it happens, not after.

Recovery depends on speed. Banks can sometimes recall a wire or freeze funds if the receiving institution is alerted quickly, before the money moves on. That makes the incident response plan part of the control set. Staff need to know whom to call at the bank, at any hour, and the bank needs a process to act on that call immediately. Law enforcement reporting should be part of the same plan.

For banks, there is a further dimension. They are both potential victims and the channel through which their clients’ money moves. A bank that helps clients put strong payment controls in place protects its customers and its reputation. A bank whose systems become the easy route for deepfake-driven fraud risks both.

Supervisors increasingly expect banks to show that they understand this risk. The FFIEC’s 2021 guidance on authentication already asked institutions to assess risks to all users, including employees and third parties, and to use layered controls. Deepfakes do not change those principles. They raise the cost of failing to apply them to meetings and voice channels.

Meetings that involve money

A well-prepared organization treats meetings involving money as a special category. Its finance, treasury and executive meetings use lobbies, external banners and controls on lookalike names. Its staff know, from a written rule backed by senior leaders, that a face or voice is never proof for a money request. Every payment discussed in a meeting is entered fresh in the payment system and approved by a second person. Its bank monitors for mule accounts and offers strong payment controls by default.

Owners and sequencing

The controls cross several teams, and each needs an owner. The collaboration or identity team owns meeting policies and the high-risk user group. The CFO and treasurer own the payment rule and the re-origination requirement. The CISO owns help desk verification, monitoring for lookalike names and the incident response plan. Commercial banking leadership owns client defaults and client agreements. Fraud operations owns mule detection and onboarding checks.

Sequencing is straightforward. The written rule from senior executives comes first, because it costs nothing and changes behavior immediately. Meeting configuration for the high-risk group follows within weeks. Payment system changes and client defaults take longer, because they involve software changes and client communication. A tabletop exercise that walks through a deepfake meeting scenario, with finance, security and the bank relationship manager in the room, tests whether the pieces connect.

Where organizations fall short:

• Trusting the picture. Treating a familiar face and voice as proof of identity.
• Open doors for everyone. Leaving anonymous join and lobby bypass switched on for the roles that can move the most money.
• Rules without sponsors. Telling staff to verify requests without senior executives publicly committing to be verified.
• Meetings as instructions. Allowing a conversation to become a payment without being re-entered and approved in the proper system.
• One layer only. Relying on staff vigilance alone, with no dual release and no monitoring at the receiving end.
• Controls as extras. Offering clients dual authorization and payee checks as optional add-ons rather than defaults for large wires.
• Dependent approvers. Letting the second approver rely on the same meeting or message as the first.
• Forgetting the help desk. Allowing credential resets for senior staff on the strength of a voice or a face.

What finance and treasury should be able to answer

1. For meetings organized by finance, treasury and executive offices, can anyone join anonymously? Are external participants held in a lobby and clearly labeled?
2. Do we have a written rule that a face or voice on a call is never proof of identity for requests involving money, credentials or confidential data? What does count?
3. Have our CFO and CEO told staff, in writing, that every request from them will be confirmed through a second channel?
4. Can any single person move a large sum based on a conversation, without re-entering it in the payment system and getting a second approval?
5. For our clients, are named approvers, dual authorization and payee checks the default for large outbound wires, or an option they must choose?

Two measurements round out the picture: how often external accounts joined meetings using an executive’s name last month, and how well monitoring catches new accounts receiving large, unusual inbound transfers. The three points are independent. Tight join controls do not help if staff accept faces as proof. A strong verification rule fails if one person can still move money directly. Organizations should close all three, starting with the roles that can move the most money.

Each answer should be backed by evidence an auditor could check: the meeting policy assignments, the signed executive statement, the payment system’s approval configuration, and the client agreement templates. An organization that can produce those four documents has turned the Hong Kong case from a cautionary tale into a tested control set.

With hindsight

AI impersonation became a standing fraud pattern. What looked in early 2024 like a startling one-off turned into a category that regulators and law enforcement now address by name.

Attempts against other large companies followed within months, and their failures were as instructive as Arup’s loss. In May 2024, the chief executive of the advertising group WPP told staff about an attempt that used his photo on a messaging account. The fraudsters then arranged a Teams meeting with a cloned voice and video footage, seeking money and personal details. It did not succeed. In July 2024, an attempt to impersonate Ferrari’s chief executive through messages and a call was reported to have ended when an executive asked a question only the real chief executive could answer. Both attempts were stopped by people checking outside the channel the attacker controlled.

Supervisors began to write the risk into guidance. In October 2024, the New York Department of Financial Services issued guidance to the institutions it regulates on cybersecurity risks from AI, naming AI-enabled social engineering, including deepfakes, among the most significant threats. In November 2024, FinCEN, the U.S. Treasury’s Financial Crimes Enforcement Network, issued an alert to financial institutions on fraud schemes using deepfake media. The alert set out red flags and asked institutions to reference it in suspicious activity reports. A suspicious activity report is the confidential filing a bank makes to authorities when it sees signs of possible financial crime. Referencing a specific alert helps investigators spot patterns across many institutions at once.

The FinCEN alert focused heavily on the receiving side: deepfake images and documents used to open accounts and defeat identity checks. That supports the argument here that mule accounts and onboarding are part of the same problem as the meeting. In December 2024, the FBI issued a broader warning that criminals were using generative AI, including voice and video, to make fraud more convincing.

In May 2025, the FBI warned that malicious actors were using AI-generated voice messages to impersonate senior US officials. The target had shifted from corporate finance to government, but the technique was the same.

Payment rules moved in parallel, though not because of deepfakes alone. In the UK, mandatory reimbursement for authorized push payment fraud took effect in October 2024, splitting the cost between sending and receiving firms for consumers, micro-enterprises and charities. In the EU, verification of the payee’s name became mandatory for euro credit transfers in October 2025. The UK regime does not cover a large corporate like Arup, and a payee name check cannot stop a deceived payer who sends money to an account held in the name the fraudster gave. Both regimes still show a shift toward making payment systems, and receiving banks, carry more of the burden of stopping deceived payers.

The robocall ruling also had consequences. In 2024 the FCC fined the political consultant behind the New Hampshire calls $6 million and reached a $1 million settlement with the voice provider that carried them.

All of these warnings described the same weakness: people treating a familiar voice or face as authentication. The technology for faking faces and voices will keep improving, and detection tools will struggle to keep pace. What does not change is the principle that identity should be proven through channels the organization controls, not inferred from how someone looks or sounds.

The Hong Kong case remains one of the most cited examples because the controls that would have stopped it were neither new nor expensive. Lobby settings, a second-channel confirmation rule, re-entry of instructions and dual release are well understood and cheap to put in place. The useful question is no longer whether staff can spot a fake, but whether the organization’s processes would still hold if they could not.