Module 1 · Section 1 of 6

In January 2024, a finance worker at Arup — the British engineering firm that designed the Sydney Opera House — joined a video call with the company’s CFO and several senior colleagues. The CFO explained a confidential transaction that required urgent wire transfers. The employee was initially sceptical. Then he looked at the screen and saw the familiar faces of people he knew.

Over the following week, he authorised 15 wire transfers totalling $25.6 million to five Hong Kong bank accounts.

Every person on that call was an AI-generated deepfake. The attackers had scraped publicly available footage from YouTube and LinkedIn and used it to fabricate a multi-person video conference. No nation-state resources were involved. No sophisticated technical infrastructure. Just tools that anyone with an internet connection and modest budget can access today.

That is what changed.