A finance employee at global engineering firm Arup transferred nearly $25 million after joining what appeared to be a legitimate video conference with the company's chief financial officer and colleagues, only to discover later that nearly every participant had been generated using AI. The incident succeeded because attackers bypassed technical controls by exploiting human trust through convincing synthetic voices and faces during the video call. According to a new guide published by Resemble AI, this case has become a defining example of how deepfakes have evolved from isolated demonstrations into a mainstream security risk affecting enterprises, financial institutions and government agencies, with research from Gartner, the FBI, and the World Economic Forum mapping the growing threat landscape.
Arup Employee Authorizes $25 Million Transfer During AI-Generated Video Conference
The Arup incident has become the industry's defining case study for AI deepfake fraud. A finance employee initially suspected a phishing email requesting a confidential transaction. Rather than acting immediately, the employee joined what appeared to be a video conference with the company's chief financial officer and several colleagues. Everyone looked authentic and sounded authentic, and the meeting appeared entirely legitimate. Following instructions received during the call, the employee authorized multiple wire transfers totaling roughly $25 million. Only later did investigators determine that nearly every participant on the call had been generated using AI. The attack succeeded because it bypassed technical controls organizations have spent decades improving, with no malware, compromised endpoint or malicious attachment. The employee had correctly identified the suspicious email, but that judgment was overridden by the apparent confirmation provided by familiar faces and voices during the video meeting.
Gartner Reports 62% of Organizations Experienced Deepfake Attacks
According to Gartner research cited in the Resemble AI report, 62% of organizations experienced a deepfake attack during the previous 12 months. Nearly seven in ten attacks targeted video systems, while 67% targeted voice-based communications. The FBI's 2025 Internet Crime Complaint Center report estimated AI-enabled scams generated approximately $893 million in reported losses. Researchers also estimate that around eight million pieces of synthetic media were circulating online during 2025, representing explosive growth from only a few years earlier. While estimates vary depending on methodology, every major study points in the same direction: AI-generated deception is expanding at a pace that existing security controls were never designed to handle. For financial institutions, the implications extend well beyond social media misinformation, as every process that depends on voice recognition, video verification or trust in digital identity becomes a potential attack surface.
Voice Cloning Technology Requires Only Seconds of Audio
The Resemble AI report argues that organizations should stop viewing deepfakes as isolated cybersecurity events and instead treat them as an identity problem. Voice cloning technology now requires only seconds of publicly available audio to produce convincing imitations. Conference presentations, earnings calls, podcasts and interviews effectively become training material for attackers seeking to impersonate executives. Video generation has undergone similar improvements, with what once required expensive visual effects now produced using consumer AI tools capable of generating convincing facial expressions, synchronized speech and realistic video calls. Gartner has previously predicted that by 2026, 30% of enterprises would no longer consider identity verification reliable on its own because of AI-generated deepfakes, a forecast the report highlights as increasingly relevant as attacks become more sophisticated.
Financial Services Face Executive Impersonation and Investment Scams
Although deepfake attacks affect multiple industries, financial services face unique exposure because so many high-value decisions rely on trusted communications. Payment approvals, account recovery, remote onboarding, wealth management consultations and customer support interactions increasingly occur over digital channels where identity has traditionally been established visually or through voice recognition. The guide identifies several recurring attack patterns already affecting organizations. Executive impersonation remains the highest-value category, using cloned executives to authorize fraudulent payments. Investment scams continue to use AI-generated videos of politicians, celebrities and financial personalities promoting fake trading or cryptocurrency platforms. Hiring fraud has emerged as another growing concern, with synthetic identities and AI-generated applicants attempting to gain employment inside organizations to access sensitive systems or information. Consumer fraud continues evolving through AI-generated voices that imitate family members during so-called virtual kidnapping scams or customer-service impersonation attacks.
Traditional Security Tools Fail to Detect Perception-Based Attacks
The report argues that most cybersecurity investments focus on detecting malicious software, suspicious emails or compromised devices, but deepfakes operate differently by attacking perception rather than networks. When a legitimate employee authorizes a payment using a trusted laptop during what appears to be a normal video meeting, conventional security controls often observe nothing unusual. There is no malicious attachment to quarantine and no compromised device, simply a human making what appears to be a legitimate business decision based on fraudulent visual and audio evidence. That distinction explains why enterprises increasingly view deepfake detection as a separate security discipline rather than an extension of existing anti-phishing technologies.
Resemble AI Guide Recommends Four-Layer Defense Strategy
Rather than relying on a single solution, the report recommends a layered approach combining four complementary capabilities. The first focuses on identity verification through liveness detection and continuous authentication. The second establishes provenance using technologies such as Content Credentials and digital watermarking to verify where content originated. The third employs AI detection systems capable of analyzing audio, video and images for artifacts associated with synthetic generation while providing explainable results that security teams can investigate. The final layer extends beyond detection to continuous monitoring, allowing organizations to identify executive impersonation, fraudulent brand usage and other deepfakes circulating publicly before they gain traction. According to the report, no individual layer can eliminate the threat, and organizations should assume attackers will eventually bypass individual controls and design security programs accordingly.
FAQ
What happened in the Arup deepfake incident?
A finance employee at global engineering firm Arup transferred nearly $25 million after joining a video conference that appeared to include the company's chief financial officer and several colleagues. Investigators later determined that nearly every participant on the call had been generated using AI, with attackers using convincing synthetic voices and faces to exploit human trust and bypass technical security controls.
How many organizations experienced deepfake attacks according to Gartner?
According to Gartner research cited in the Resemble AI report, 62% of organizations experienced a deepfake attack during the previous 12 months. Nearly seven in ten attacks targeted video systems, while 67% targeted voice-based communications, with the FBI's 2025 Internet Crime Complaint Center report estimating approximately $893 million in reported losses from AI-enabled scams.
What defense strategy does the Resemble AI guide recommend against deepfakes?
The Resemble AI guide recommends a four-layer defense strategy combining identity verification through liveness detection and continuous authentication, provenance establishment using Content Credentials and digital watermarking, AI detection systems capable of analyzing audio and video for synthetic artifacts, and continuous monitoring to identify executive impersonation and fraudulent brand usage before they gain traction.
