In early 2024, a finance worker at Arup’s Hong Kong office received an email from the company’s UK CFO about a confidential transaction. Something felt off, and he reported it as phishing. Then came the video call. The CFO from the email was on it, plus colleagues he knew – their faces, their voices, talking to each other. That was enough to ease his ill feeling and to make fifteen transfers, roughly $25 million. Everyone on that call except him was a deepfake.

If you haven’t read about it before, the Arup deepfake fraud is one of the most significant real-world examples of AI-enabled social engineering to date.

Easy to write off this heist as a professional gig, requiring a highly skilled crew and a significant amount of money, but as time goes on and the barrier for entry falls in both complexity and required hardware, the focus is not just targets with $25 million lying around. Across 2025 alone, more than 274,000 Australians reported losing money to scams, totalling $2.18 billion.

As time goes on, deepfakes are more frequently reaching phones of ordinary people. It’s quietly invalidating the advice we were all taught.

It starts with “Hi Dad, it’s your favourite kid, dropped my phone down the sink, this is my new number.”

Then benign chit-chat for a day while you get comfortable speaking to the new number. The urgency comes later – a locked account, a deposit due today, urgent medical bills – and then comes the ask.

That’s what it was: a scam that couldn’t talk. They would stack the reasons why you couldn’t hear your child’s voice because the scam fell apart the moment you rang back. Which is why the advice never changed: hang up and call the person on the number you already had for them. Not clever, but it worked. The one thing the scammer couldn’t produce was thirty seconds of a familiar voice.

Now instead of a text, it’s a call – and it’s your kid. Their voice, live, responding to whatever you say. Arup and “Hi Dad” were always the same scam with different budgets, and that gap has largely closed. Voice cloning itself isn’t new. What’s changed is how little it needs. Fifteen seconds of decent audio. A voicemail greeting, an Instagram video, an uploaded podcast- Or simply answering a phone call. According to Scamwatch, scammers are increasingly using artificial intelligence to create convincing voice clones and deepfake videos to manipulate victims.

A quick web search will show you a marketplace full of companies that provide voice cloning and avatar generation. Platforms such as ElevenLabs and HeyGen have made high-quality AI voice and avatar technology widely accessible. Many of these services have safeguards, like requiring the person to be cloned to record a consent statement. Luckily, bad actors wouldn’t lie or fake something.

But in reality, it does not really matter, because none of this needs a hosted service or specialist company. Many models now run locally using free software and a standard home computer. So where does this leave us? An entire generation of people were told that if something feels off, get on the phone. When they do, they hear the voice they expected and end up more convinced than if they’d never checked. That’s exactly what happened at Arup- The email was flagged, the call talked them around.

So where does that leave us?

Awareness is becoming our strongest defence, because verification alone is no longer enough. If something feels off, or you have any doubt at all, remember that real-time imitation, that was once a dream is now trivial and accessible. There is nothing wrong with slipping in a question only that individual would know.

If you believe you’ve encountered a scam or want to better understand how modern scams operate, the National Anti-Scam Centre and Scamwatch provide practical advice, current alerts and reporting resources.