In January 2024, a finance employee at Arup's Hong Kong office received a message that appeared to come from the company's UK-based chief financial officer. It concerned a confidential transaction, and he did the right thing: he suspected phishing. Then he joined a video call, saw the CFO and several colleagues he recognized on screen, and his doubts dissolved the way doubts do when the room looks right. He went on to make 15 transfers to five Hong Kong bank accounts - HK$200 million in total, about $25 million.
Everyone he saw on that call was fake. Hong Kong police outlined the scheme in February 2024 without naming the victim, and in May the Financial Times confirmed the company was Arup, the engineering firm of about 18,000 people. Officers called it the first case of its kind the city had seen: a bogus video conference in which everyone present except the victim was a deepfake, built from publicly available video and other footage. The employee learned the truth only when he followed up with headquarters.
I want to be careful about what this story teaches, because the easy reading is wrong. He was not careless. He did not skip the training. He suspected the message from the first line, which is more than most of us manage, and then he checked - and the check itself was the trap. The video call was his verification, and presence was his proof. That is the part that has to change now that presence has gotten cheap.
Presence stopped being proof
For most of my working life, identity checks ran on expensive signals. A face meant something because faking a face took a film studio. A voice meant something because you could not borrow one. The whole architecture of everyday trust - a video call outranking an email, a live person outranking a message - rested on one assumption: the attacker could not afford to be in the room.
That May, the same technique reached Mark Read, chief executive of WPP, the largest advertising company in the world. Scammers built a WhatsApp account around a publicly available photo of Read, used it to set up a Microsoft Teams meeting with a senior WPP executive, then showed up with an AI voice clone and real YouTube footage of a second WPP leader, while Read himself was impersonated off-camera through the chat window. The pretext was a new business venture; the goal was money and personal details. This attempt failed - WPP credits the vigilance of the executive who was targeted - and Read wrote a warning to staff I have not stopped quoting since: "Just because the account has my photo doesn't mean it's me."
The harder version of his sentence is this: just because the face moves and the voice sounds right does not mean the person is there. WPP is not a technology backwater; it is the largest advertising company on earth, and its chief executive is one of the most photographed men in his industry. If your defense is that employees will spot the fakes, you are betting on a pixel-level arms race against tools that improve every month, and the detection side keeps losing that race. Remember what actually defeated Arup's man: not low resolution, but a room full of people he knew asking for something urgent and confidential.
Break the channel
My opinion, held stubbornly: stop trying to win at the pixels. The control that works is older than deepfakes and costs nothing. The channel a request arrives on is never trusted, so the verification has to happen on a channel the requester does not control. The video call asks for a wire? Fine. Hang up. Call the CFO back on the number you already had, from before the request - not the number in the email signature, and not the one the WhatsApp account offered. A perfect clone can own the screen and the ear. It still cannot answer the CFO's actual desk phone.
The rule only protects you if it exists before the call comes in. The Arup employee's real failure was improvising under pressure with no agreed protocol - nobody had ever told him what to do when a room that looked verified asked for money, so he weighed the request against his own instincts and lost. A company where the CFO expects a callback and takes no offense at one is a company the deepfake cannot reach. Write the rule down: any request that moves money or credentials is confirmed out-of-band, no matter who asks, no matter how urgent, and with no exception for people who look familiar. Especially not for them.
What that means where money moves here
I run a site where money and rank are attached, so I will say plainly how the same principle is wired into Bid Spotlight. No bid moves because somebody told us they paid. No redirect off a checkout screen, no receipt screenshot, no email, no call from anyone claiming to be anyone - none of that can change a position. A bid becomes paid in exactly one way: a signature-verified webhook from the payment processor, checkout.session.completed, arriving on a server-to-server channel the buyer cannot reach or edit, while the handler ignores every other event. "Paid" is a fact about the processor's ledger, not a presentation on a screen.
That is the callback rule wearing server clothes. The confirmation travels a channel the requester does not control. It is not sophisticated, and it is not meant to be. Arup's transfers and the WPP attempt both came through the front door of a trusted channel; the fix is not a stronger door, it is refusing to accept a claim on the channel the claim arrived on.
If you run anything that moves money, write your callback rule this week, before the convincing call comes in - then come see a leaderboard that only moves on signed webhooks: bidspotlight.com