Picture this. A finance staffer at a Hong Kong office gets a message from the company's UK-based CFO about an urgent, confidential transfer. It smells like a phishing scam, so they hesitate. Then they join a video call. The CFO is there on screen, along with two familiar colleagues. They look right. They sound right. Reassured, the staffer makes 15 transfers totalling HK$200 million. Every face on that call was fake. This is not a hypothetical. It happened to engineering firm Arup in 2024, and the techniques have only become cheaper and more convincing since.
What is a deepfake scam?
A deepfake scam is a fraud that uses AI-generated video, voice, or images to impersonate a real, trusted person, usually a boss, supplier, or banker, in order to trick someone into sending money or sensitive data. The fake looks and sounds like the real person, which is what makes it dangerous.
The word "deepfake" combines "deep learning" and "fake." The technology studies real footage of a person, then synthesises new video or audio of them saying and doing things they never did.
How does a deepfake scam work?
A deepfake scam works by scraping public footage of a target, training an AI model to copy their face and voice, then deploying that fake in a live call or recording to authorise a fraudulent request. The whole chain can run on consumer-grade tools.
The typical attack unfolds in clear stages:
- Harvesting: Scammers download public videos from LinkedIn, YouTube, webinars, or recorded earnings calls. A company executive's online presence is usually more than enough raw material.
- Synthesis: AI tools clone the person's face, voice, and mannerisms. Voice cloning now needs only a few seconds of clean audio.
- The hook: The victim receives a message about an urgent, secret transaction, designed to bypass normal approval steps.
- The pressure: A video call or voice note featuring the deepfaked "boss" removes the victim's last doubts.
- The payout: Money moves to accounts the scammers control, often split across several banks to slow recovery.
The Arup fraudsters did exactly this, synthesising the CFO and colleagues from publicly available video, according to the South China Morning Post.
What did the HK$200 million Arup case teach Hong Kong businesses?
The Arup case showed that even a careful employee can be fooled when a live video call appears to confirm a request. The Hong Kong staffer initially suspected phishing, but a fake video meeting with the "CFO" and colleagues was enough to override that instinct, leading to HK$200 million in losses across 15 transfers.
Three lessons stand out for any business owner. First, the human red flag worked at first, the staffer was suspicious of the email. Second, the deepfake video call was the tool that defeated that suspicion. Third, the fraud was only caught later when the employee checked with head office, by which point the money was gone. Almost two years on, no arrests have been announced.
The takeaway is uncomfortable but simple. Seeing and hearing someone on a call is no longer proof that the person is real.
How much do deepfake scams cost businesses in 2026?
Deepfake and AI-driven fraud now account for roughly 11% of global fraudulent activity, and global identity-fraud losses exceeded US$50 billion in 2025, with 2026 expected to be higher, according to fraud-prevention firm Sumsub. Experian's 2026 forecast names agentic AI and deepfakes among the top business threats of the year.
For a small or mid-sized Hong Kong business, the danger is not abstract. You do not need to be a multinational to be targeted. Scammers favour smaller firms precisely because they often lack formal verification procedures and have fewer approval layers between a request and a wire transfer.
What do people get wrong about deepfake fraud?
The most common misconception is that deepfakes are easy to spot or that only big companies are targeted. In reality, 2026-era deepfakes can be convincing on a live call, and small firms with loose approval processes are frequently the easier mark.
Here are the myths worth correcting:
- "I'll be able to tell it's fake." Older deepfakes had glitches. Current ones often do not, especially over a slightly grainy video call.
- "We're too small to be a target." Smaller firms are attractive because controls are weaker, not because the prize is bigger.
- "Our bank will catch it." If you authorise the transfer yourself, the bank sees a legitimate instruction, not a fraud.
- "This is an IT problem." Deepfake fraud targets people and processes, not just systems. Training and procedure matter as much as software.
How can a small business spot and stop deepfake scams?
A small business can defend against deepfake scams by adding a second, out-of-band verification step for any urgent money or data request, and by training staff that "I saw them on a call" is not proof. The fix is mostly procedure, not expensive technology.
Practical defences any Hong Kong SME can put in place this week:
- Call back on a known number: For any urgent or unusual payment request, hang up and call the person on the number you already have on file, never the one provided in the message.
- Use a code word: Agree a private verification phrase for sensitive transactions, something a scraped video could never reveal.
- Slow the "urgent" requests: Scammers manufacture time pressure. A rule that all large transfers wait for a second approver removes their main weapon.
- Restrict channels: Keep payment instructions to verified internal systems, not open email or messaging apps.
- Train the team: Make sure every staffer who can move money knows deepfakes exist and that questioning a "boss" is encouraged, not punished.
Frequently asked questions about deepfake scams
Can a deepfake really fake a live video call?
Yes. The Arup scam used multiple deepfaked participants in a real-time video meeting, which is exactly why the employee felt safe enough to proceed.
How much audio does voice cloning need?
Modern voice-cloning tools can produce a convincing copy from just a few seconds of clear speech, the kind found in any podcast clip or voicemail greeting.
What is the single most effective defence?
An out-of-band callback. Verifying the request through a separate, trusted channel defeats almost every deepfake attempt, because the scammer does not control that channel.
The bottom line for Hong Kong business owners
Deepfake fraud is no longer science fiction. It is a HK$200 million reality that has already struck through a Hong Kong office, and the tools behind it get cheaper every month. The good news is that the strongest defence is not a costly security suite. It is a simple, well-drilled habit of verifying urgent requests through a second channel, paired with a team that feels safe asking "is this really you?"
Technology created this threat, and the right technology partner can help you stay ahead of it. We understand AI. UD stands with you.
Protect your business with UD
Worried your team could be the next target? You do not have to figure this out alone. With 28 years of experience in IT and cybersecurity, UD will walk you through it step by step, from assessing where your business is exposed to putting the right verification and protection in place.