AI-powered BEC: How deepfakes defeated the verification step trusted by employees 

Business email compromise, or BEC, is a category of fraud in which an attacker impersonates a trusted person, typically a senior executive, a finance contact, or a known vendor, to trick an employee into transferring money or sharing sensitive information. Traditional BEC relies on text alone. The attacker crafts a convincing email, hopes the recipient doesn’t look too closely at the sender address, and counts on urgency to override skepticism.

AI-powered BEC takes this further. Attackers now use large language models (LLMs) to generate emails that replicate the writing style of a specific person with high accuracy. They use voice-cloning tools to produce audio that’s indistinguishable from the real individual. They use deepfake video technology to construct real-time visual impersonations of executives during live video calls. The result is an attack that operates across multiple channels simultaneously and defeats the verification steps that employees have been trained to rely on.

What separates AI-powered BEC from its predecessor isn’t just quality. It’s accessibility. Tools that previously required specialist technical knowledge and significant computing resources are now available to anyone with access to a few hours of publicly available footage.

From a niche threat to an industrialized one 

For most of the 2010s, deepfake technology was computationally expensive and produced unconvincing results under close scrutiny. It was deemed as a future risk rather than a present one.

That changed rapidly between 2022 and 2024. Accessible voice cloning APIs, real-time face-swap tools, and open-source models brought the barrier to entry down to near zero. Arup’s CIO Rob Greig told the World Economic Forum that after the incident, he replicated a deepfake of himself using free tools in 45 minutes. Sumsub research compiled by Keepnet Labs found that deepfake fraud attempts rose approximately 2,137% over three years. The AI layer doesn’t create a new type of fraud. It removes the skill and time barrier that previously limited who could execute it.

How $25.6 million left Arup in a single day

Arup is the British engineering firm whose projects include the Sydney Opera House and the Beijing National Aquatics Center. In January 2024, a finance employee at Arup received an email at the company’s Hong Kong office. The message appeared to come from Arup’s UK-based CFO. It described a confidential transaction that needed to be handled urgently and discreetly.

The employee was immediately suspicious. The request had the shape of a classic BEC attempt: an executive, a secret transaction, and time pressure. According to CNN, the employee raised the concern and was invited to a video conference call to verify the instruction directly with the people involved.

On that call, the employee saw the CFO. They saw colleagues they recognized. The voices matched. The conversation was coherent and confident. Every instruction was confirmed by people the employee had no reason to distrust. What the employee didn’t know was that every participant on the call was an AI-generated deepfake. It was confirmed that the deepfakes had been constructed entirely from publicly available material: conference recordings, virtual meeting footage, and media appearances of Arup’s senior leadership.

Following the call, the employee authorized 15 wire transfers totaling HK$200 million, which amounted to approximately $25.6 million USD, to five Hong Kong bank accounts. The fraud was only discovered later when the employee contacted Arup’s actual headquarters to discuss the transaction and was told by real executives that no such meeting had taken place.

Bloomberg reported that Arup wasn’t the only organization targeted by this class of attack in 2024. Ferrari narrowly avoided a similar incident when a suspicious executive asked the caller a personal question the AI could not answer. MIT Sloan Management Review noted that the difference between the two outcomes came down to a single moment of doubt and the willingness to act on it.

As of early 2025, no arrests have been made and the funds remain unrecovered from the Arup incident.

Why the attack succeeded

The Arup case is instructive precisely because the employee followed the correct procedure. They were suspicious of the email. They didn’t act on it alone. They requested a face-to-face verification before authorizing any transfer. Every one of those steps reflects good security practices.

The attack succeeded because it was designed to defeat those steps. The phishing email wasn’t intended to close the fraud by itself. Its purpose was to create an opening for the deepfake call, which was the actual mechanism of deception. The employee’s skepticism was anticipated and used against them: The request for verification created the opportunity the attacker needed.

This is the structural problem AI-powered BEC introduces. The verification channel that awareness training has long prescribed as the last line of defense—get off email, pick up the phone, and arrange a video call—is now the attack surface.

What AI-powered BEC looks like

Recognizing AI-powered BEC in real time is difficult, but consistent signals exist. Requests that combine urgency, confidentiality, and a financial action are a recurring pattern across BEC attempts regardless of delivery sophistication. Any instruction to keep a transaction discreet or process it before end of day should prompt independent verification through a channel not initiated by the suspicious message.

On a video call, look for slight delays between speech and lip movement, unnatural blinking, and audio that sounds slightly processed. None of these signals are definitive, but each is worth pausing on. A personal verification question is a practical test, but as the Ferrari near-miss shows, it’s not foolproof. However, nothing beats procedural defense mechanisms. Make it a policy across the board that no financial transfer should be authorized through a single channel of communication, no matter how convincing the participants appear.

What individual employees can do 

Establish a verification habit that cannot be bypassed

Employees handling financial transactions should call the requester back on a number already stored in the company directory, not one provided in the message, before acting on any instruction.

Treat confidentiality and urgency as risk signals 

Legitimate executives rarely need financial transactions kept secret from the organization. Employees should feel comfortable pausing and escalating such requests without fear of appearing obstructive.

Review what’s publicly accessible about senior leadership 

Video, audio, and written material from external events all serve as raw material for deepfake and style-cloning attacks. Limiting unnecessary public exposure of executive communication reduces the quality of material available to attackers.

What organizations can do 

Enforce SPF, DKIM, and DMARC at the email layer  

All three of these authentication mechanisms should be set to enforcement mode, such as reject or quarantine, rather than monitoring mode. A spoofed domain that fails authentication should never reach the inbox. The Arup attack began with exactly that kind of spoofed sender address.

Implement a formal payment verification policy  

Any transfer above a defined threshold should require confirmation through at least two independent channels, with at least one being a voice call to a pre-registered number. This policy should be documented, trained, and applied without exception, including when the requester appears to be a senior executive.

Enforce MFA on all email accounts and financial systems 

Account takeover of a business partner or supplier is a common precursor to BEC attacks, and MFA significantly raises the cost of initial access for an attacker.

Configure stringent rules in email gateways 

Apply policies so that first-contact financial requests from executive-level senders is flagged. This applies particularly where the sending address has no prior communication history with the recipient. It doesn’t require AI-based detection. It requires policy-level rules that most email security platforms support natively.

Evaluate real-time deepfake detection tools for audio and video 

Organizations that conduct regular executive video communications should consider tools that flag synthetic media in live calls. No tool currently offers full accuracy, but partial detection capability meaningfully raises the cost of a successful attack.

The email is still where it starts 

The Arup incident is remembered as a deepfake attack, and it was. But it began with a phishing email that spoofed a CFO’s address, requested a confidential financial transaction, and got through to the inbox. Every subsequent step, including the deepfake call, the wire transfers, and the unrecovered funds, followed from that first delivery. Stopping the email stops the chain. Organizations that treat the inbox as a controlled environment, rather than an open one, give themselves the intervention point that Arup didn’t have.

Wrapping up

October is Cybersecurity Awareness Month 2026, and this year we’re publishing a breakdown of a cyberattack every week. In our next post, we’ll discuss how an attacker slipped into an active payment thread, operated inside it undetected, and nearly got away with it.

eProtect is a cloud-based email security and archiving solution built to defend against the email threats that content filters alone cannot catch, including AI-powered impersonation attacks that are designed to look legitimate at every layer. The solution offers advanced threat detection for on-premise and cloud email accounts, and is the security layer powering Zoho Mail, a platform trusted by millions of users.