Federal prosecutors in Manhattan say three men used AI to impersonate CEOs and other executives on phone calls, and sometimes on video, and took around $129 million from companies. The U.S. Attorney’s Office for the Southern District of New York unsealed the indictment earlier this month. The three men are charged and presumed innocent, so everything below is an allegation.
The people who sent the money were usually employees in accounting and finance departments, and every step of the scheme ran through a normal business process. That makes this a controls story for anyone who builds controls, builds automation, or touches cash.
How the deepfake CEO wire fraud allegedly worked
The indictment describes a sequence. It starts with an email that appears to come from the CEO, saying the CEO is working on a confidential financial transaction and asking the employee to sign a non-disclosure agreement first. Then a call comes in. An AI mimics the CEO’s voice, and sometimes there is a deepfaked video of the CEO as well. The CEO asks for help with a secret deal and tells the employee to contact an attorney at a law firm.
That attorney is also an impersonation. According to the allegations, one of the group worked from a script as the lawyer and gave the employee the wire instructions. The money went into accounts around the world and then into cryptocurrency, where it was harder to track. The deals were fictitious, often acquisitions, and the alleged scheme ran from July 2024 to February 2026.
Acquisitions are a smart attack surface. In a real deal, NDAs get signed, the circle stays small, executives ask for help from only a few people, and attorneys handle parts of the transaction. The setup pulls an employee a little outside the normal process. A secret deal run directly by the CEO sounds like an exception, and exceptions can skip steps.
Three controls the sequence exposes
Recognition. The employee heard a voice, sometimes saw a face, and treated that as proof of who was asking. Cloned voices and images defeat that check, and the more public an executive is through earnings calls and conferences, the easier the copy.
The referral. When the CEO introduces an attorney, it feels like someone else is joining the deal. In practice the employee is meeting a third party for the first time, and that party is borrowing the CEO’s credibility. A new third party introduced by the CEO deserves a check on its own history.
Secrecy. Real acquisitions are confidential and urgent, so people may assume a secret request can skip a few steps. It cannot. A payment request tied to an unannounced deal should still go through a manager or the CFO.
What AI changes about payment fraud
Spoofed emails from the CEO have been around for a long time, and the standard control was a phone call. Cloned voices started to break that control. A human impersonator on the phone would run into the same procedures, but AI makes the first contact far more believable.
Staff are trained on spam and phishing emails. Voice and face phishing has not been ingrained the same way, and most companies do not test for it.
What to do about it
- Make sure everyone with approval authority understands the risk. Walk them through the scheme: the secret deal and the call from the attorney.
- Check that your process requires authentication beyond a voice, an email or a video call. A process that relies on any one of those is already failing.
- Keep multiple people involved, even for a secret transaction. For acquisitions, build in the CEO, the CFO and one more person.
- Add a step in a system, not only a call. The closest comparison is two-factor authentication. A call to a number you already have is one factor. A recorded approval in your payment system or workflow, not through email, is the other.
With a system step in place, a request that reaches the wire stage goes to the approvers the process names. If the real CEO is one of them, the real CEO sees a request they never made and declines it.
Takeaways
- A voice, a face or an email is no longer enough to prove who is asking. Treat calls the way you treat phishing emails.
- The scheme works by pulling the employee out of the normal process, so the process has to hold when the request comes from a person in authority.
- No payment, secret or not, should need approval from only one person who can also create the wire.
- Review your training and your policy. This is an old attack using new methods.
You would not send a wire on an email from the CEO alone, and a phone call or a video call from the CEO deserves the same treatment.
Want the CPE credit? Take the full lesson on EverydayCPE and earn 0.2 CPE credits: https://everydaycpe.com/courses/technical-management-services/your-ceo-isnt-on-the-call/
Leave a Reply