AI Deepfakes Drive $129M CEO Fraud Scheme

Three men were indicted for allegedly using AI-generated video and voice impersonations of CEOs and law-firm attorneys to steal $129 million. They targeted employees authorized to make wire transfers, framed payments as confidential acquisitions, and pressured staff to keep the transactions secret. The case shows why finance teams must independently verify unusual payment requests, even when a caller appears and sounds like an executive or lawyer.

Key findings

• The alleged scheme ran from at least July 2024 through February and stole $129 million from victim companies.
• Attackers selected accounting employees with authority to initiate large wire transfers.
• The first contact was an email sent through DocuSign or a similar service in the name of the company CEO, claiming a confidential financial transaction was underway.
• In later interactions, the group allegedly used AI to mimic the CEO's voice and image, then impersonated attorneys at major law firms' European offices.
• Victims were told that the payments supported an important business matter, often an acquisition, and that they must keep it secret from colleagues.
• Named victims included mutual fund, hospital, banking, pet-food, and financial-technology organizations.

Who’s being targeted

• Commonly targeted roles: Accounting, Finance, Treasury, Accounts Payable, Payroll, Executive Assistants, Senior Executives, Legal.
• Affected industries: Finance and insurance, Healthcare, Banking, Food manufacturing, Financial technology.
• Attack channels: email, vishing, website.
• Impersonated: Company CEO followed by an attorney at a large international law firm's European office.

Awareness takeaways

• Independently verify any unusual or high-value payment request through a known, pre-established contact method, not through contact details supplied in the request or call.

Red flags to watch for

• An unexpected confidential deal requires bypassing normal payment approval processes.
• The employee is told to keep the transaction secret from other staff.
• A payment request relies on an unverified CEO or attorney identity, even if the person appears authentic on a call.