Engineer Arup Is Identified as Deepfake Phishing Scheme Victim
The company declines to confirm media reports of a $25M loss.
Image: Getty Images
The Hong Kong office of Arup, the London-based multidisciplinary engineer, was victimized in a phishing scheme fraud that resulted in the loss of about $25.4 million, according to various media reports.
The story was originally reported in the South China Morning Post, but Arup was only identified in the last few days.
Cyber criminals were said to have used artificial intelligence of video and audio resembling the image and voices of business associates to trick a Hong Kong-based employee into sending payments to accounts created by the criminals, according to the reports.
Details remain unclear, but the financial loss, if true, would be among the highest known so far among design and construction firms, which have been targets in schemes designed to deceive U.S. companies into making payments to fraudulent accounts. This would also, if confirmed, be the first scheme known to have used deepfake video in Zoom calls to carry out a hoax.
A spokeswoman for Arup, Ophelia Quach, said in an email that the company had notified police about a Hong Kong fraud incident in January. "We can’t go into details at this stage as the incident is still the subject of an ongoing investigation," she said.
The company's financial stability, business operations and internal systems were not affected or compromised, Quach said.
Arup reported profit for its latest financial year that ended on March 31, 2023. of $66 million on revenue of $701.4 million, compared to $53 million and $629 million for the year prior.
Looking for quick answers on construction and engineering topics?
Try Ask ENR, our new smart AI search tool.
Ask ENR →
The number and sophistication of the schemes has been "rising sharply in recent months," Rob Greig, Arup global chief information officer, said in a statement emailed to ENR.
"Our operations are subject to regular attacks, including invoice fraud, phishing schemes, WhatsApp voice spoofing and deepfakes," he added. “This is an industry, business, and social issue and I hope our experience can help raise awareness of the increasing sophistication and evolving techniques of bad actors.”
