Skip to content
HACKTECH
AI securityReported Published 2 sources

Three charged in alleged $129 million scheme using AI-cloned executive voices

The US Attorney's Office in Manhattan said on 5 November 2026 that an indictment had been unsealed charging three defendants with wire fraud, aggravated identity theft and money laundering over a scheme that allegedly used artificial intelligence to impersonate corporate executives and attorneys and took about $129 million, according to the Associated Press and The Next Web. According to court documents cited by AP, the group emailed staff, often in accounting departments, posing as CEOs who needed help with a confidential financial transaction, then arranged phone or video calls in which AI mimicked the executive's voice and sometimes image. Victims were directed to an impersonated attorney at a major law firm who gave wire instructions, and the funds were converted to cryptocurrency. The charges are allegations and the defendants are presumed innocent.

  • deepfakes
  • voice cloning
  • CEO fraud
  • executive impersonation
  • wire fraud
  • business email compromise
  • AI-enabled fraud

What the sources report

  • According to the indictment cited by AP, the defendants targeted thousands of companies worldwide over more than a year and a half; The Next Web reported the scheme ran from 2024 to 2026.
  • Victims described in court documents include hospital systems in Missouri and California, a Rhode Island bank, a UK financial technology company, a Massachusetts mutual fund company and a Florida pet food company (AP); The Next Web reported the Missouri hospital system lost about $4.8 million and the UK fintech about $11.6 million.
  • Prosecutors said the money went to accounts in countries including Spain, Greece, the UAE, Singapore and China before being converted to cryptocurrency to hide its origin (The Next Web).
  • According to the US Attorney's Office, as reported by AP and The Next Web, one defendant mainly impersonated UK attorneys and used a handwritten script titled 'Lawyer Call'.
  • The three were arrested between June and September (AP); The Next Web reported two arrests by Spanish police and one by UK police, with the US seeking extradition of all three.
  • Each charge carries a maximum of 20 years except aggravated identity theft, which carries two years, according to the US Attorney's Office (AP).

What it means for your organisation

The control at issue is payment authorisation that relies on recognising a voice or face. The alleged sequence of an email from the 'CEO', a call with a cloned voice and then a hand-off to a fake outside lawyer let each step appear to confirm the previous one, so a callback to contact details supplied within the request adds little. Finance teams need verification through independently held contact details, dual approval for confidential or urgent transfers, and awareness training that covers synthetic voice and video.

What we check

  • Walk through urgent and confidential wire approval end to end, confirming dual authorisation and a callback to independently sourced numbers rather than any contact details supplied in the request.
  • Run a consented executive-impersonation exercise against finance and accounts-payable staff that combines email, voice and video pretexts, including a 'confidential deal' and an 'external counsel' hand-off.
  • Assess how much executive voice and video material is publicly available and whether a pre-agreed verification phrase or secondary channel exists for executive payment requests.
  • Check DMARC enforcement, lookalike-domain monitoring and external-sender tagging so spoofed CEO or law-firm emails do not reach finance staff unmarked.
  • Confirm the incident response plan covers fraudulent transfers, including rapid bank recall requests and law enforcement reporting.

Sources

Services that cover these checks

  • Social engineering assessment

    Phishing, vishing and physical pretexting run against your staff, help desk and finance team, only under written authorisation that names the targets, pretexts and limits. Results are reported by channel and pretext, never by name: how far a convincing approach got, how many people reported it and how long the first report took to reach someone who acted.

    Duration: 2 to 4 weeks including campaign preparation

  • Threat modelling

    Facilitated workshops that map how a system or feature could be attacked before it is built or shipped. We draw the data flows with your engineers, walk them with STRIDE, rank the threats by likelihood and impact, and turn the result into backlog items and test cases your team owns.

    Duration: 2 to 5 days per system, remote or on site

  • Red team & purple team

    Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.

    Duration: 3 to 6 weeks

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works