2024-02
Deepfake & AI Fraud
Arup
Arup employee wires $25M after deepfake video call with fake CFO
What happened
A finance employee in Arup's Hong Kong office was lured by a phishing email into a video conference where every other participant — including the company's CFO — was an AI-generated deepfake built from publicly available footage. Convinced by the realistic video and audio, the employee executed 15 transfers totaling about $25.6M to fraudster-controlled accounts.
Impact
Arup lost $25.6 million, unrecovered, in what became the benchmark case for deepfake-enabled business fraud.
How this could have been prevented
Out-of-band payment verification through pre-established channels — independent of video or voice identity — stops deepfake-driven transfers.
Sources
Would runtime governance have caught this?
Guardion enforces policy on every agent action inline — with visibility, tamper-evident evidence, and DLP for agents and MCPs.
Request a demo