Home / Blog / The $25 Million Phone Call
Field Note 02The $25 Million Phone Call: How to Beat AI Voice Scams and Deepfakes
A finance worker joined a video call with his chief financial officer and several colleagues. Every face on the call was generated by AI.
In early 2024, an employee at the engineering firm Arup sat on a video call in the Hong Kong office. His CFO was there. So were colleagues he recognised. They talked, they sounded right, they instructed him to move money. He made 15 transfers totalling 25 million dollars before anyone realised the entire call, every participant except him, was a deepfake stitched from public footage.
No password was stolen. No system was hacked. The attack worked because we are wired to trust a face and a voice we know, and AI now fakes both for the price of a coffee.
Voice and video used to be proof. Now they are just costumes.
Why your instincts now work against you
For your whole life, hearing your daughter's voice or seeing your boss's face meant it was them. That shortcut was safe for thousands of years. AI broke it in about eighteen months. A scammer needs a few seconds of audio, easily lifted from a voicemail greeting or a social clip, to clone a voice well enough to fool a panicked parent at 2am.
The US Federal Trade Commission logged a record 12.5 billion dollars in reported fraud losses in 2024, a 25 percent jump in a single year. Imposter scams, where someone pretends to be a relative, a boss, the bank, or the government, took 2.95 billion of that. AI is the accelerant: it makes the impersonation sound and look real.
The one rule: verify out of band, every time
You cannot out-listen a clone. You will not spot the fake in the moment, because the whole point is that it is good. So stop trying to detect, and start verifying through a separate channel the scammer does not control.
Two parts, both cheap, both today:
Urgent + money
Any message demanding fast payment or secrecy. Treat urgency itself as the red flag.
Stop
Do not act on the call, voice note, or video in front of you. It can be faked.
Call back
Hang up. Dial the person on a number you already have saved. Or ask the family phrase.
Then decide
Only once a trusted channel confirms it. Real emergencies survive a five-minute callback.
The scammer controls the channel that reached you. A callback to a number you already trust is the one channel they cannot fake.
The family verification phrase is the consumer version of what banks call out-of-band authentication. Pick a short phrase, tell the people you love, never put it in a text or post it anywhere. If a frantic "grandson" calls needing bail money, you ask for the phrase. A clone does not know it.
Two ten-minute jobs tonight. First, agree a verification phrase with your household and your parents, out loud, in person or on a call you initiated. Second, write one rule on the fridge and in the family chat: "Any urgent money request gets a callback on a saved number before we pay. No exceptions." That rule would have saved Arup 25 million dollars.
If you run a team
The Arup loss was a business loss. Put the same rule in your payment process: no transfer above a set threshold moves on the strength of a call or email alone, no matter whose face is on it. Require a callback to a known number and a second approver. Tell staff that "the CFO told me to, urgently, and asked me to keep it quiet" is the exact shape of the attack, not a reason to comply.
The takeaway
- AI clones voices from seconds of audio and now fakes live video. The Arup case cost 25 million dollars.
- US fraud losses hit a record 12.5 billion dollars in 2024, with 2.95 billion from imposter scams.
- You cannot detect a good fake in the moment. Stop trying. Verify through a separate channel.
- Two defenses, free, today: a family verification phrase, and a callback-before-you-pay rule.
Frequently asked questions
How do AI voice cloning scams work?
Scammers grab a few seconds of someone's voice from social media or voicemail, clone it with AI, then call a relative or colleague claiming an emergency and demanding fast money. The same tech now fakes live video calls.
What is a family verification phrase?
A short, private phrase known only to your household and close family, never shared online or by text. If someone calls in distress asking for money, you ask for the phrase. A voice clone will not know it.
How do I protect older relatives?
Set up the phrase and the callback rule with them directly, and warn them that a familiar voice is no longer proof. Tell them scammers create urgency and secrecy on purpose, and that hanging up to call back on a saved number is always the right move.
Think this only happens to big companies?
The 25 million dollar number makes headlines. The 2.95 billion in imposter losses is mostly ordinary people, one wire at a time. Survival Guide for the AI Apocalypse gives you the full set of defenses for your money and your family, in plain language, from an insider who builds these systems. Set them up before the call comes, not after.
Order on Amazon →Adrian Dunkley has spent close to two decades building, deploying, and governing AI systems. He writes the briefing he gives friends and family. More at the book and adriandunkley.net.
Sources
- CNN Business and Fortune (May 2024): Arup confirmed as victim of a deepfake video-call scam; a Hong Kong worker made 15 transfers totalling HK$200M (about US$25.6M).
- US Federal Trade Commission, Consumer Sentinel Network Data Book 2024 (March 2025): $12.5B in reported fraud losses, up 25%; $2.95B lost to imposter scams.