The failure was procedural, not merely technical
In early 2024, a finance employee at engineering firm Arup transferred about US$25 million after joining a video call with AI-deepfaked recreations of the company’s CFO and colleagues. CNN Business, citing Arup, reported that the incident involved technology-enhanced social engineering. No systems were compromised and no data was affected. The initial contact was a phishing email before the deepfake call.
The case is often presented as a warning about synthetic video. It is more useful as a control test. A familiar face, a recognisable voice and apparent participation from several colleagues created enough authority for an exceptional payment request to proceed. A public case-study video captures the central lesson: video presence is not the same as verified identity or authorised instruction.
Rob Greig, Arup’s CIO, described the incident as technology-enhanced social engineering. He also said he created a real-time deepfake of himself with open-source software in about 45 minutes. The defensive question is therefore not whether staff can spot every synthetic artefact. It is whether the workflow remains safe when sight and sound are deliberately persuasive.
Four controls a readiness assessment should validate
Callback procedures. Can the employee end the call and contact the requester through a trusted number already held in the directory? Does the procedure prohibit using a number supplied during the call, or replying to the initiating message? A callback that is technically permitted but socially discouraged is not a dependable control.
Dual approval. Does a payment, beneficiary change or urgent treasury instruction require two independent approvals? Can one convincing call influence both approvers, or does the second approver receive the request through a separate channel with sufficient context to challenge it?
Separation of duties. Can the person receiving a phone or video instruction create a beneficiary, amend payment details and release funds? Controls should be tested across the full workflow, including VIP servicing, password resets and changes to call-back details, not only at the final payment screen.
Escalation paths. Do staff know when an unusual request must go to the MLRO, compliance officer, treasury control function or a senior manager? The path needs a clear service level, documented evidence and protection for the employee who pauses an apparently urgent executive request.
FinCEN Alert FIN-2024-Alert004, issued on 13 November 2024, warns that attackers can generate synthetic audio and video responses to live prompts. It endorses live verification while recognising that verification alone is not sufficient. A useful voice-cloning explainer makes the same operational point for a wider audience: the trusted channel itself may need challenge and corroboration.
Test the workflow, not the employee’s confidence
The DeepBlocker Vishing Readiness Assessment is a fixed-scope, authorised engagement delivered over two to three weeks. We place controlled AI voice-fraud calls against agreed staff and workflows, then return a board-ready evidence pack showing who was fooled, which control failed, what evidence was available and where escalation stopped working.
The assessment is priced from around £9,500. It gives regulated firms evidence for the board, insurer or regulator, rather than another policy attestation or awareness score.
Book an assessment to test whether your people and phone workflows would survive a controlled vishing attempt.