· By Chris Kirby
The £20m deepfake video call: what the Arup scam means for small businesses
Imagine joining a video call with your finance director and a few familiar colleagues. They talk you through a confidential deal and ask you to move some money. You do what you're asked. Later, you find out that none of the people on that call were real.
That isn't the plot of a film. It happened to a member of staff at Arup, the British engineering firm, in early 2024. It's one of the clearest examples yet of where impersonation fraud is heading, and although the sums involved were huge, the idea behind it is something every small business should understand.
What happened at Arup
In January 2024, a finance employee in Arup's Hong Kong office received a message that appeared to come from the company's UK-based chief financial officer. It mentioned a "confidential transaction". The employee then joined a video call with what looked and sounded like the CFO and other colleagues.
According to Hong Kong police, the employee went on to make 15 transfers totalling HK$200 million, about £20 million, to five different bank accounts. Everyone else on that call was a deepfake: a computer-generated fake of a real person's face and voice (BBC; The Guardian).
Arup confirmed that "fake voices and images were used". Importantly, it also said that none of its internal systems were compromised (The Guardian).
Nobody broke in
That last point is the one worth sitting with. When people picture a cyber attack, they usually imagine someone breaking into computer systems: cracking passwords, planting viruses, stealing files. None of that happened here.
The criminals didn't need to get into Arup's systems at all. They simply pretended to be someone the employee trusted, and asked for money. The employee's own access, and their own good intentions, did the rest.
This is what security people call impersonation, or social engineering. It works because it targets people rather than technology, and people are naturally inclined to help a senior colleague who seems to be in a hurry.
Why this matters if you're not a global firm
It would be easy to read the Arup story and think, "That's a big company problem. Nobody's going to build a deepfake of me." And you're probably right that nobody will go to that much trouble for a small business.
But the deepfake was just the expensive version of a very old trick. The everyday version is far cheaper and far more common: an email that looks like it's from your boss, your supplier, your accountant or even you, asking for a payment or saying that bank details have changed.
That everyday version is a real problem here in the UK. Action Fraud figures published by the National Crime Agency show that victims of invoice fraud reported losing £3,908,086 across 83 cases in September 2025 alone. That's one month, and only the cases that were reported.
Where your email comes in
Here's the part that is directly relevant to most small businesses. A great deal of impersonation fraud starts with an email, and one of the most convincing tricks is an email that appears to come from a genuine address, perhaps yours.
Whether that's easy or hard for a criminal depends partly on some settings attached to your domain name, known as SPF, DKIM and DMARC. Together, they tell other email systems which senders are allowed to use your address, and what to do with messages that fail the test. The NCSC recommends these settings for exactly this reason: they make it much harder for someone else to send email that looks like it came from you.
To be clear, these settings would not have stopped a deepfake video call. Nothing on your domain can do that. But they close one of the cheapest and most common doors that impersonators use, and that's the door most likely to be tried on a small business.
The bigger lesson: trust is the target
The Arup case is a reminder that the weakest point in a business is often not a computer. It's the moment when someone feels they've been asked to do something by a person they trust, and doesn't feel able to double-check.
Criminals know this. They create urgency ("this needs to happen today"), secrecy ("this deal is confidential") and authority ("this is coming from the top"). Each one makes it a little harder for a busy person to pause and ask questions.
A business where it's normal and welcome to say, "Let me just check that," is in a much stronger position than one where staff worry about looking awkward. That's not about technology. It's about culture, and it costs nothing.
Where do you stand?
You can't control what criminals try. But you can find out how easy your own business would be to impersonate by email, which is one of the first things a fraudster is likely to try.
Tidy Cyber's free check looks at your domain and tells you, in plain English, whether your email protection is set up, along with your website security, certificate and domain basics. No jargon and no scare stories, just a clear picture of where you stand. If you've ever wondered whether someone could send an email pretending to be you, it's a good place to start.