AI Scams Are Evolving
While researching for our piece about Tax scams during filing season, we found countless stories of AI being used to trick people out of their money or personal information. There's one story in particular we'd like to tell you about.[1]
In January 2024, a finance employee at Arup, a British engineering firm known for landmarks like the Sydney Opera House, received an email from (what appeared to be) the company's chief financial officer.[2][3] The email described a confidential transaction that needed to be handled quickly. The employee suspected it might be a phishing attempt.[4]
In previous years, things may have ended there, but then the scammers did something new. They invited the employee to a video conference call to discuss the transaction. On that call, the employee saw and heard people who looked and sounded exactly like the CFO and several other senior colleagues, discussing the transaction in detail.[4]
Convinced by what appeared to be overwhelming proof, the employee authorized 15 separate wire transfers, sending $25 million to five different Hong Kong bank accounts.[5]
Guess what… every single person on that video call was fake. The scammers used publicly available footage from company conferences to train AI software to create convincing deepfakes of Arup's executives.[4][6]
The fraud was only discovered when the employee followed up with Arup's actual headquarters in the UK. As of now, more than a year later, the money has not been recovered.[6][7]
Rob Greig, Arup's Chief Information Officer, later shared that after the incident, he tried making a deepfake video of himself using freely available software. It took him about 45 minutes.[7]
This is a long way of saying that AI-powered scams can go far beyond the voice cloning "grandparent scams" we discussed last week. Now scammers can create entire video conferences with multiple fake participants. They can generate flawless phishing emails. They can impersonate your boss, your banker, or your business partner with relative ease.
These scams exploit our psychology. When you see your colleague's face on a video call and hear their voice discussing a transaction, it’s natural for your brain to trust what it's experiencing.
There used to be a laundry list of ways to tell if a communication was fake right off the bat. That's not the case anymore. But despite how scary things have become, one fundamental thing hasn't changed: Scammers rely on creating urgency and pressure. If someone is pushing you to act immediately, always try and remember that that's your red flag.
If you get a request for money or sensitive information, hang up and call back using a phone number you already have. Verify through a different channel from the one you were contacted on, ideally the original contact info, not the number or email provided in the suspicious message. If it's an email about a wire transfer, walk down the hall and confirm in person, or call using a number you have on file.
The Arup employee did many things right. They were initially skeptical and sought verification before acting. But the technology has become so convincing that seeing and hearing someone on a screen is no longer sufficient proof for high-stakes decisions (again, we know it's scary). Sometimes slowing down, then taking that extra step of calling back or verifying in person could be what protects you. Taking the time to verify might feel overly cautious, but when it comes to protecting your financial security, caution is exactly what's called for.