The AI deepfake scam shows why video calls are no longer enough for payment approva
A recent Rand Group post on X brought the AI deepfake scam back into focus by describing a finance worker who questioned a suspicious email, asked for a video call, and then saw what appeared to be the company’s CFO and other colleagues on screen. The detail that matters is simple: the call itself became part of the fraud.
The case traces back to a Hong Kong incident first reported by the South China Morning Post. According to that report, a multinational company lost HK$200 million, about $25.6 million, after scammers used deepfake technology in a fake executive video meeting. The AI deepfake scam worked because the employee believed several people on the call were real.
The company was later identified as Arup, the British engineering group. The Guardian reported that Arup confirmed fake voices and images were used in the fraud, while saying its financial stability, business operations and internal systems were not affected. That distinction is important. The AI deepfake scam did not need a system breach to work. It exploited trust inside a normal payment process.
Deepfakes use artificial intelligence to create or alter video, images or voices so that a person appears to say or do something they did not say or do. In this case, the danger was not only one fake executive. A McAfee analysis said the employee reportedly had doubts, but the presence of other apparent colleagues helped make the meeting look credible.
The wider fraud picture is also getting worse. The FBI said its Internet Crime Complaint Center received more than 1 million complaints in 2025, with cyber-enabled fraud losses exceeding $17.7 billion. That does not mean every case involved artificial intelligence. But it shows the financial environment in which an AI deepfake scam can spread.
There is a useful side to the same technology shift. AI systems can help security teams scan payment requests, detect unusual vendor behavior and flag abnormal transfer patterns. But the Arup case shows that human approval alone is weaker when attackers can imitate faces and voices. As The AI Decode has reported, public trust in AI remains under pressure as adoption expands across business and consumer tools.
The practical lesson is not to abandon video calls. It is to stop treating them as final proof. Large payments need independent callbacks, pre-agreed verification phrases, multi-person approval outside the same channel and delays for urgent transfer requests. The next question is whether companies will update those controls before the next AI deepfake scam looks even more routine.
