Verify payment authority beyond a familiar face
The reported Arup fraud shows why familiar faces and voices cannot establish payment authority alone. Use independent verification and transaction-bound approval, and test the process against impersonation.
Keep sources linked to the record used for review. The diagram does not represent automatic approval.
Synthetic-media detection is one possible control, but the payment owner should first review how authority is established. A convincing face or voice can support an impersonation attempt without requiring access to the organisation’s systems. The approval process must account for that possibility.
In early 2024 an employee in the Hong Kong office of the engineering firm Arup made fifteen transfers totalling around twenty-five million dollars to accounts controlled by criminals. The instruction began with an email the employee was suspicious of. What removed the suspicion was a video call, on which the chief financial officer and several familiar colleagues appeared and spoke. Every one of them was synthetic, assembled from recordings of real meetings and public appearances. Arup’s own account, reported by CNN, was that no systems were compromised and no data was taken.
Recognition alone cannot establish authority for a consequential transaction. The reported absence of a system compromise does not prove that every control worked, or reveal Arup’s complete internal process. The case supports examining how identity, approval and transaction details are independently verified.
The control that was actually in place
A hypothetical payment process may require confirmation from an authorised approver but accept visual or voice recognition as that confirmation. Those are different requirements. Review the actual policy and evidence trail before concluding which control allowed a particular transfer.
Synthetic media challenges reliance on recognisable appearances and speech. That reliance was never equivalent to strong authentication. Establish what additional evidence the process requires and how an attacker could obtain or imitate it.
Review voice calls, video meetings, signatures and writing style as evidence of identity. These signals can be imitated through several techniques, including synthetic media. Their presence should not bypass controls that bind a verified approver to the specific transaction.
Where the fix belongs
A detector can provide a useful signal but produces uncertain results. Assess false negatives, false positives and its place in the workflow. It should not become the sole evidence that a high-consequence request came from an authorised person.
Separate the instruction channel from the verification route where appropriate. Confirm the approver through a trusted route already held by the organisation, then bind the approval to the amount, payee and transaction. Assess each route for compromise rather than assuming that a second channel is always independent.
An unusual payment instruction arrives. What confirms it?
- The apparent confirmation may share the instruction’s compromised channel. Review whether the verification route supplies independent evidence.
- The channel is now independent of the instruction. Assess the directory, receiving device and verification process as well.
- Confirmation is bound to the transaction, not to a conversation. Test identity, separation of duties and binding to the actual transaction.
A callback to a verified directory number can reduce dependence on the suspicious request, but it is not an absolute defence. Numbers, devices and staff can also be compromised or deceived. Make the required checks part of the approved process and give staff explicit support for performing them regardless of the requester’s seniority.
What to check this quarter
For each process, write down the identity evidence, the approval authority and the transaction details being confirmed. Test an impersonation scenario against those conditions. Record bypass routes and who may approve exceptions. Scope the review to the consequence of an unauthorised action.
What this does not tell you
Detection may contribute to a layered control, especially where manual verification cannot serve every request. Its suitability depends on the tested error rates, available alternatives and consequences. Process separation also has limits, so verify the full route rather than describing either mechanism as deterministic protection.
The reported case concerns fraud using synthetic media, with Arup stating that its systems were not compromised. Finance, security and internal audit should therefore review the payment process together. An inventory limited to the organisation’s deployed AI systems would miss this use of AI by an attacker.
The finance owner should require evidence that unusual payment and payee-change requests receive independent, transaction-specific approval. Rehearse the check and preserve the decision record. That provides a concrete response to impersonation risk without relying on a prediction of which technology will cause the next loss.