TBT CHECKS
In early 2024 an employee at the Hong Kong office of the British engineering firm Arup transferred about £20m (HK$200m) to fraudsters. Beforehand, they had taken part in a video call on which the finance director and other “colleagues” were in fact generated by artificial intelligence. Arup confirmed the incident in May 2024.
Similar attacks also use cloned voices. A few seconds of recording from social media or a company video is enough to fake the boss’s voice in a phone call asking for an urgent transfer.
Experts agree: spotting deepfakes “by eye” is getting harder. Procedures that do not depend on whether the caller looks and sounds convincing are more effective.
Editorial comment
Small businesses often think such attacks only affect corporations. Yet in a small firm the boss has unlimited authority, and an employee will not dare question their “urgent request”. A payment instruction by phone or video, with time pressure and a request for discretion, should automatically trigger verification.
What to do
- Agree a code word or question known only to the team, and use it for unusual payment instructions.
- Confirm every urgent payment instruction through another channel: call back on a known number.
- Introduce a two-person rule for larger transfers.
- Limit public voice and video recordings of management where they are not needed.
What do you think?
Have you come across a scam like this? What worked and what didn’t? Tell us in the comments below the article. We will cover the most interesting views in future editions.
Sources
© THE BUSINESS TIME / Argonauts Media Group Limited. Original editorial content. Copying, downloading and distribution without the publisher’s written consent are prohibited. Illustrative photo: Pexels.
We assess factual corrections and substantive responses. Verified changes are reflected in our reporting.
Contact the editorial desk →
