The Arup Deepfake: a Forensic Timeline of the $25.6M Scam
· Mahdi Kazempour, Founder, Original Pictures
Definition: The Arup deepfake was a January 2024 fraud in which a finance employee, deceived by a synthetic video call impersonating the CFO and colleagues, authorized about US$25.6 million in transfers.
TL;DR: A reconstruction from public reporting: an invitation, a multi-participant deepfake video call, fifteen transfers totaling roughly HK$200 million, and a delayed discovery. Provenance on authentic executive media would have given the employee something to verify; it would not have fixed the process gap that allowed transfers without out-of-band confirmation.
The setup
A finance employee in Arup's Hong Kong office received a video-conference invitation appearing to come from the London-based CFO. Reports indicate the employee had initial doubts, then was reassured by the apparent presence of several familiar colleagues on the call, all of them synthetic.
The transfers
Convinced by faces and voices, the employee made fifteen transfers totaling about HK$200 million, roughly US$25.6 million, to five Hong Kong accounts. Hong Kong Police disclosed the case in February 2024, and Arup confirmed the loss in May 2024. CIO Rob Greig later told the World Economic Forum he reproduced a deepfake of himself with free tools in about 45 minutes.
Three failures
Identity verification rested on human recognition, not cryptography. Process allowed large transfers authorized over video with no out-of-band confirmation. And there was no signing infrastructure that could have let the employee verify the CFO was actually present. Two of the three are technical; one is procedural.
What provenance fixes, honestly
Signed and watermarked authentic executive communications would have given the employee a manifest to check, turning a judgment call into a verification step. It would not, by itself, have closed the process gap. Provenance is a strong control, not a substitute for out-of-band confirmation on large transfers. This is a video-and-voice case, squarely in scope for media provenance.
The incident behind this
Arup deepfake CFO scam, January 2024, Hong Kong: about US$25.6 million across 15 transfers to 5 accounts. Sources: CNN (16 May 2024), Fortune, Financial Times, WEF remarks by Rob Greig.
FAQ
Could detection have caught it live?
Live detection is unreliable and degrades as cloning improves. Provenance on the authentic side, plus an out-of-band confirmation step, is the durable control.
Where Original Pictures stands today
Original Pictures ships three things today: a Sign API, a Verify API, and the SDKs that wrap them. One POST /v1/sign attaches a C2PA-format manifest, an invisible TrustMark watermark, and an OpenTimestamps anchor. The open-source verifier checks any of it without calling us.
Two things are on the near roadmap, and we name them as roadmap, not as shipped: C2PA Conformance Program recognition (target Q3 2026, until then our manifests use the published C2PA v2.2 format and any C2PA-aware validator can read them, but third-party validators will show our signer as not-yet-listed), and a consumer capture app (Q3 2026). We do not sell a capture SDK, and we do not claim Trust-List membership we do not yet hold.
Bottom line: The Arup case is the reference for enterprise deepfake fraud. Sign authentic executive media so impersonations are checkable, and pair it with out-of-band confirmation, because technology and process both failed here.
Related
Original Pictures is progressing through the C2PA Conformance Program; our signing certificate is not yet on the official C2PA Trust List. Target: Q3 2026. We will not describe ourselves as "C2PA-certified" until it is true.
Original Pictures provides content-provenance infrastructure. It does not by itself constitute legal compliance with the EU AI Act or any other regime; compliance depends on how you deploy it, your disclosures, and your governance. Figures are drawn from public reporting, verify against primary sources before citing in regulated materials. Nothing here is legal advice.
Last verified 2026-05-25. Author: Mahdi Kazempour, Founder, Original Pictures.