Construction & Development Cybersecurity Solutions & Training

In January 2024, a finance employee in the Hong Kong office of Arup, the global engineering and design firm, received a message that appeared to come from the company's UK-based chief financial officer about a confidential transaction. The employee first suspected phishing.

Then came a video call with what looked and sounded like the CFO and several colleagues. According to Hong Kong police, every one of them was a deepfake built from publicly available video and audio. Reassured, the employee made 15 transfers totaling HK$200 million, about US$25.6 million, to five local bank accounts. The fraud came to light about a week later, when the employee checked with head office. Arup confirmed in May 2024 that fake voices and images were used, and said its internal systems had not been compromised.

The employee did the right thing first: they doubted the message. What defeated that doubt was not a better document but a better illusion. A live video call with recognizable faces and voices satisfies the deepest instinct we have for verifying identity, and once that instinct is satisfied, the earlier suspicion feels like a mistake to apologize for rather than a warning to act on.

The pretext closed every other exit. Confidentiality meant the employee could not mention the transaction to a colleague, seniority made it uncomfortable to ask the person on screen to prove who he was, and the presence of other familiar faces on the call suggested that others had already accepted the request as genuine. A person alone with a secret, facing their leadership on screen, has very little left to hold on to.

A suspicion only protects the company if it reaches the security team. Fraus measures reporting rate next to click rate and makes reporting a one-tap action in Microsoft Teams, so the doubt this employee felt becomes a report instead of a private worry.

Staff who move money need to know that a video call is not proof of identity. Codex teaches finance teams how deepfake impersonation works and how a request for secrecy, speed, and senior sign-off is built to cut verification short, with modules in Arabic and English. The opening move, an email about a confidential transaction, can be rehearsed in Whitebait or Blackbait.

Odin ranks finance and payment staff higher because of what their role can authorize, and notifies the right stakeholders when one of them becomes a concern. Selecting your executives as Blackbait targets reveals the public video, audio, and organizational detail an attacker could use to impersonate them.