Updated on October 25, 2026
The video call that cost $25 million
In February 2024, Hong Kong police disclosed one of the most significant AI-driven social engineering financial fraud cases ever documented, at the local office of a multinational later identified as the British firm Arup. As reported by CNN, a finance employee joined a video call with people he believed were the company's CFO and other senior colleagues. All of them were fake. They were deepfake recreations, with fabricated voices and images. The result: bank transfers totaling HK$ 200 million, about US$ 25.6 million, sent in 15 transfers to fraudulent accounts, according to Hong Kong police.
Since then, the case has become the leading reference in discussions about multimillion-dollar AI-driven fraud in the corporate environment.
The inevitable question remains: if even a multinational with a structured finance department was vulnerable to this type of deepfake scam, what happens when the target is a smaller company, with less formalized processes and leaner teams?
What this scam reveals about the financial risks of SMEs
The most relevant point of this case for managers of small and medium-sized enterprises is not the lost value, but the mechanism of the attack. The deepfake fraud did not rely on system invasions, did not require password theft, and did not exploit any technical software vulnerabilities. The target was the most difficult element to protect with technology alone: human trust.
SMEs are increasingly targeted precisely because they tend to have less formalized financial approval processes. In companies with 10 to 200 employees, it is common for a single employee to have the authority to approve significant transfers without the need for validation through a secondary channel. This scenario creates a huge window of opportunity for social engineering fraud with AI.
The sophistication of deepfakes has evolved rapidly. Commercially available tools now allow for the cloning of voice and image with short samples of audio and video, often obtained from social media or public recordings. For a criminal, the logic is simple: if the employee sees and hears the boss ordering an urgent transfer, the likelihood of compliance is extremely high, especially under time pressure and confidentiality, classic tricks of social engineering.
Moreover, the deepfake scam in video calls tends to deactivate the triggers of distrust that would normally work in a suspicious email. The visual presence creates an illusion of authenticity that is difficult to question at the moment. Therefore, corporate financial security cannot rely solely on the individual perception of the employee.
Layers of protection that make a real difference
The good news is that there are concrete and accessible strategies to drastically reduce the risk of this type of digital fraud in companies of any size. Effective protection works in complementary layers:
- Mandatory multifactor authentication for financial access: MFA ensures that, even if an employee is convinced to provide credentials during a scam, access and the execution of transactions require a second independent verification that the criminal does not control.
- Out-of-band validation protocols: Any transfer above a predefined amount must be confirmed through a secure secondary channel, different from the channel through which the request was received. A callback to a previously registered number is sufficient to thwart most AI-driven social engineering attacks.
- Continuous behavioral monitoring: Endpoint detection and response (EDR) solutions combined with continuous monitoring identify anomalous behavior in real time, such as unusual access, attempts at unusual financial transactions, or transfers to unregistered destinations.
- Managed, ongoing awareness training: Regular phishing and deepfake simulations with immediate feedback measurably raise your team's maturity. Ongoing awareness programs help your team recognize and refuse fraudulent requests.
- Zero Trust model applied to financial processes: No request, even from a superior, should be fulfilled without independent verification. The premise is simple: do not automatically trust any digital identity without additional validation.
The question every financial manager needs to answer
If an employee in your company were to receive an urgent video call from your chief executive asking for a confidential transfer, what would their next step be?
If the answer is "he would probably execute the transfer," your company has a real vulnerability window, regardless of size or industry. The good news is that closing this window does not require complex technological transformation. It requires clear processes, consistent training, and layers of verification that work even under pressure.
Managed IT contributes directly here: with Zero Trust-based access policies, 24/7 monitoring of anomalous behaviors, MFA implemented throughout the financial approval chain, periodic awareness training, and continuity protocols that ensure dual validation in critical transactions. These capabilities, combined, create a defense architecture that does not rely on the luck of any employee in a moment of pressure.
Deepfake technology will continue to evolve. But companies that build robust processes and well-trained teams are always one step ahead, regardless of how the scam presents itself.
References
- CNN: Finance worker pays out $25 million after video call with deepfake 'chief financial officer'
- CNN: British engineering giant Arup revealed as $25 million deepfake scam victim
Want to understand what layers of protection make sense for the size and profile of your company? Talk to a specialist at Zamak for a Complimentary Initial Consultation, with no obligation.
Frequently asked questions
What is deepfake video call fraud in a corporate setting?
It is a social engineering scam in which criminals use deepfake recreations, with fake voices and images, to impersonate executives during a video call. That is how the Hong Kong office of British firm Arup was tricked, in early 2024, into transferring about US$ 25.6 million to fraudulent accounts, believing it was speaking with the company's CFO and other senior colleagues, as reported by CNN. The attack does not exploit technical software flaws: the target is human trust.
Why are small and midsize businesses increasingly targeted by this type of scam?
SMBs tend to have less formalized financial approval processes: in companies with 10 to 200 employees, it is common for a single employee to have the authority to approve significant transfers without any requirement for validation through a secondary channel. This creates a wide window of opportunity for AI-powered social engineering fraud.
How can a company protect itself from deepfake financial fraud?
Effective protection works in layers: mandatory multifactor authentication for financial access, out-of-band validation protocols (confirming any transfer above a predefined amount through a secondary channel, such as a callback to a previously registered number), 24/7 behavioral monitoring with EDR, and continuous awareness training. A Zero Trust model applied to financial processes ensures that no request, even from a superior, is fulfilled without independent verification.