1. In January 2024 an Arup employee joined a video call with the CFO and colleagues, then sent about USD 25.6M. Who on that call was real?
Answer: Only the employee. Hong Kong police said every participant except the employee was AI-generated. He made 15 transfers to five accounts.
2. What made the Arup employee suspicious at first?
Answer: The request for a secret transaction. The first email asked for secrecy, and his training flagged it. The deepfake video call is what convinced him to go ahead.
3. In July 2024 a Ferrari executive got WhatsApp messages and a call from “CEO Benedetto Vigna.” How did he stop it?
Answer: He asked which book the CEO had recommended to him. The voice copied Vigna’s accent. The executive asked about a book Vigna had recommended days earlier — and the caller hung up.
4. The fake Ferrari CEO said a lawyer would send an NDA and the regulator was already informed. Why add those details?
Answer: To borrow credibility from third parties. Fake lawyers, NDAs and “the regulator knows” are legitimisation props. We see them in 4 of 18 attack types.
5. Fraudsters set up a Teams meeting with a fake WPP CEO using a voice clone and YouTube footage. What was the target?
Answer: Getting an agency leader to set up a new business and send money. They used a public photo for WhatsApp and a cloned voice in the meeting. The attempt failed because staff were alert (The Guardian, May 2024).
6. A LastPass employee got WhatsApp calls and a voicemail with the CEO’s cloned voice. Why did he ignore them?
Answer: The contact came outside normal work channels. He noticed it was outside the usual channels, with forced urgency — and reported it instead of replying (LastPass, April 2024).
7. The CEO messages from a new number with his photo as the profile picture. The photo proves:
Answer: Nothing — public photos are easy to copy. Borrowed profile photos and logos are a known signal. Ferrari’s scammers used a picture of Vigna in front of the prancing horse.
8. The caller offers a video call “so you can see it’s me.” That offer:
Answer: Is not proof — the requester controls the call. Verification offered by the requester is a red flag. Arup proved a live multi-person call can be faked.
9. In 2025 someone created a Signal account named Marco.Rubio@state.gov and contacted foreign ministers. What was fake?
Answer: The display name, formatted to look like an official address. A display name can say anything. The State Department warned that the account and AI voice messages were not Rubio’s.
10. The habit that beat the fake CEO in most stopped cases:
Answer: A question or call-back only the real person could pass. Ferrari asked a private question; LastPass and WPP staff stepped outside the attacker’s channel. Process beat perception.