An employee joins a video call. The chief financial officer is on screen, along with several senior colleagues. Everyone looks right and sounds right. Every face except the employee’s own is a deepfake, and the UK engineering firm Arup ended up $25.6 million poorer.
The incident is one of the most widely reported examples of social engineering, in which attackers go after people instead of systems. The cyber insurer Coalition, which described the case, says it worked because it got around a natural defense: seeing the person’s face.
The numbers
Verizon’s 2025 Data Breach Investigations Report found that about 60 percent of breaches involve a human element, such as an employee falling for phishing or pretexting. Smaller organizations carry more of the risk. Their employees face significantly more targeted attempts per person than staff at large enterprises.
Coalition’s 2026 Cyber Claims Report puts a price on it. Social engineering was the main attack vector in 71 percent of funds transfer fraud claims, the cases where an attacker redirects a legitimate payment to a fraudulent account. Separately, 52 percent of those claims began with a business email compromise, where the attacker had email access and used it to set up or time the payment request.
Trust, urgency, curiosity
Coalition points to three buttons attackers press. Trust comes first. Criminals read social media and employee forums, learn how a workplace runs, and open a conversation by seeming to know the target’s role and relationships. An email that uses the recipient’s name feels personal, which is why it works.
Urgency is the second. A message warning that an overdue invoice will lead to account closure pushes people to act before they think. Coalition says urgency “short-circuits rational evaluation.” The third is curiosity: a sensational headline or an exciting offer that lures someone into clicking a malicious link or downloading malware.
Search engine optimization poisoning works the same way. Attackers manipulate rankings so harmful pages show up high in common searches.
What AI changed
Artificial intelligence has made the old tricks harder to spot. Attackers can now produce personalized phishing emails at scale, pulling from LinkedIn, public filings and company websites to name a recipient’s projects and colleagues. Fewer typos and awkward phrases means fewer clues.
Coalition also cites McAfee research that three seconds of audio is enough to build a voice clone that is 85 percent accurate. A voicemail or a social media clip will do. Coalition says human listeners can no longer reliably tell a cloned voice from the real one, and that criminals use clones to pose as executives approving wire transfers or as relatives in trouble.
The advice
The insurer’s main recommendation is a second channel. If the CFO calls to authorize an emergency wire transfer, call back on a number from the company directory, not the one on the caller ID. Coalition says that step alone stops the vast majority of business email compromise, voice phishing and deepfake attacks.
It also suggests hovering over links to catch lookalike addresses such as go0gle.co, calling a bank on the number printed on its website, and pausing for five minutes before acting on anything urgent. Training matters too. Verizon’s 2025 report found that 8 percent of employees account for 80 percent of incidents, so Coalition argues targeted training for repeat clickers pays off.
Sources
- The Psychology of Social Engineering
- Human Cognition Through the Lens of Social Engineering Cyberattacks
