In early 2024, an employee at Arup, the UK engineering firm behind projects like the Sydney Opera House, joined what looked like an entirely normal video call with the company's CFO and several other colleagues. Everyone on the call looked and sounded right. Following the instructions given on that call, the employee authorised a series of transfers totalling 25 million dollars. Every person on that call except the employee was an AI, generated deepfake. Arup's own Chief Information Officer later [described it publicly](https://www.weforum.org/stories/2025/02/deepfake, ai, cybercrime, arup/) as "technology, enhanced social engineering" rather than a hack, since no system was breached and no malware was involved. People were simply convinced, on camera and by voice, that they were dealing with their own leadership.

Business Email Compromise used to mean exactly what its name suggests, a fraudulent email. The Arup case is where that definition needs updating.

At its core, BEC is still impersonation used to move money or data. An attacker either spoofs an executive's email address, compromises the real account, or now, increasingly, fabricates their voice or likeness on a call. There is often no malware and no malicious link, which is exactly why it is so hard for security tooling to catch. The attack is the conversation itself.

The FBI's Internet Crime Complaint Center published its [2025 figures](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) showing business email compromise losses of just over 3.04 billion dollars for the year, up from 2.77 billion in 2024 and 2.94 billion in 2023. That works out to more than 122,000 dollars per complaint on average. In the same report, losses tied to AI, enhanced fraud, the category the Arup case belongs to, were tracked separately at close to 893 million dollars across more than 22,000 complaints, a category that barely existed in the reporting a few years ago.

The FACC case from 2016, an Austrian aerospace firm that lost tens of millions of euros to a fabricated email instruction and fired both its CEO and CFO afterward, is still the example most security awareness content reaches for. It remains a useful illustration of the underlying psychology: authority, urgency, and a request framed as confidential. But treating it as the current state of the threat understates how far the tactic has moved since then.

Khaleej Times has reported a wave of email scams hitting UAE residents and businesses, including fake invoices and remote access tricks aimed at getting hold of bank details, and separately covered how [deepfake CEO calls and fake supplier emails](https://www.khaleejtimes.com/business/tech/the, scams, uae, businesses, need, to, watch, out, for) are now a live concern for companies operating in the UAE. In Saudi Arabia, the central bank, SAMA, has had to renew its public warnings about cyber fraud targeting businesses. The tactics travel fast, and they do not require the attacker to operate in the same country, language, or currency as the target.

If an executive appeared on a video call today and issued a payment instruction, what would actually stop that payment other than trusting what was seen and heard?

Does our approval process for high, value transfers rely on a live conversation at all, or does it require a callback to a number already on file, independent of the request itself?

Have we modelled what an AI, generated voice or video impersonation of our own CFO or CEO would need to succeed against our current controls?

Who inside the organisation has the authority to move money on a single instruction, and could that authority be split across two people?

Arrives by email, video call or voice, either spoofed or fabricated. The goal is a fraudulent payment or data transfer. It often leaves no technical footprint at all, sometimes only AI, generated audio or video. Illustrated by the Arup case: 25 million dollars in 2024.

Arrives by email, text or QR code. The goal is credential theft or malware delivery, and it usually leaves a footprint: a malicious link, an attachment or a fake login page. Seen in standard enterprise phishing campaigns.

Arrives as a phone call or voice message. The goal is credential theft or an urgent payment. There is no footprint to scan, because it relies entirely on the call itself, as in cloned executive voice calls. Read more in [How to Stop Employees from Falling for Vishing and Smishing](/resources/blog/vishing, and, smishing, how, to, stop, employees, from, falling, for, voice, sms, scams)

The FACC playbook, a well, written email and a deadline, still works, and it still shows up in the Gulf and everywhere else. But the 2025 numbers and the Arup case both point in the same direction: the tactic is escalating in production value faster than most internal controls are being updated. A policy written around "does this email look right" is no longer sufficient when the attack might arrive as a face.

This is precisely the scenario SimuPhish's simulations are designed to recreate safely, across email, voice, and increasingly video, based impersonation, so the habit of verifying independently is already in place before a real one lands.