US prosecutors charged three people accused of using AI-generated voices and images to pose as CEOs and lawyers in a $129 million fraud scheme. The group allegedly pressured accounts-payable employees to handle confidential transactions, then used fake lawyer calls to make large wire transfers appear legitimate and discourage internal discussion.
Prosecutors allege that three individuals ran a layered impersonation scheme that used AI-generated voices and images to pose as corporate executives and attorneys. The scheme began with a call or message in which the attacker claimed to be a CEO who needed help with a confidential financial transaction. These calls primarily targeted accounts payable, finance, and treasury staff, roles with direct access to wire transfer authority.
Once an employee was engaged, the scheme added a second stage. Employees were told to get in touch with supposed lawyers at major international law firms, who were also impersonated using AI-generated voice or image. One of the accused allegedly kept a handwritten script titled Lawyer Call, designed to convince victims not to discuss the communications with coworkers. That second layer gave the fraud an appearance of legal legitimacy and discouraged the kind of internal check that might have caught it.
The scheme combined urgency, authority, and secrecy, three pressure points that work against normal verification habits. An employee hearing what sounded like their CEO, followed by a lawyer confirming the same confidential transaction, had two seemingly independent sources pointing the same direction. The explicit instruction not to discuss the matter with colleagues removed the most natural safeguard: asking someone else in the organization.
The use of AI-generated voices and images made the impersonation more convincing than a text-based lure, since the targeted employees were reportedly hearing or seeing what appeared to be familiar executives and outside counsel.
Organizations can reduce exposure to this pattern by treating any request for a confidential, high-value payment as an automatic trigger for independent verification through a known contact method, not a number or address supplied by the caller. Wire instruction changes should always require out-of-band confirmation before funds move. Staff should be encouraged, and explicitly permitted, to escalate or discuss unusual requests internally even when told not to, since that instruction is itself a red flag. Verifying the identity of both the purported executive and any referenced attorney through independently known contact channels remains one of the most effective defenses against this type of layered impersonation.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers allegedly used AI-generated voices and images to pose first as a CEO requesting help with a confidential transaction, then as an outside lawyer who instructed accounts payable staff to wire large sums while staying silent about the request.
The scheme primarily targeted accounts payable, finance, and treasury staff at organizations including hospital systems, a bank, a fintech company, a mutual fund company, and a pet-food company.
The fraudsters added a second layer of credibility by directing employees to supposed lawyers at international law firms, using a handwritten script to discourage victims from discussing the communications with colleagues.
Treat requests for secret, high-value payments as a trigger for independent verification, confirm wire instructions out of band, and escalate any request to bypass normal approval processes.
“I need your assistance on a confidential financial transaction.” Sounds like your CEO. In an alleged $129 million scam, AI-generated voices and images posed as executives. The “CEO” sent accounts staff to an outside “lawyer” to arrange a large wire. Here’s the tell: that “lawyer” says don’t discuss it with colleagues. A handwritten “Lawyer Call” script allegedly pushed that secrecy, while supplying new wire instructions. A familiar voice isn’t proof. Before any wire, verify the request through your established payment-approval process.
U.S. authorities allege that three men used AI-generated CEO and lawyer impersonations to steal at least $129 million from businesses. The scheme targeted accounting staff with a confidential-transaction storyline, used an e-signature message to obtain an NDA, and then used a fake attorney to make…
Federal prosecutors allege that a fraud ring used AI-generated CEO voices and video, along with stolen lawyer identities, to convince employees to approve fraudulent wire transfers. The attackers used familiar business workflows, confidential acquisitions, NDAs, executive calls, and outside…
U.S. prosecutors charged three people with allegedly using AI-generated CEO and attorney impersonations to steal about $129 million from companies worldwide. The group reportedly emailed accounting teams about confidential transactions, used AI voice and video calls to reinforce the request, and…
Police disrupted an international investment-fraud operation that used deceptive online advertisements to draw victims into fake investment websites. Criminal call-center staff then posed as brokers, showed victims fake account gains, and delayed withdrawal requests until they stopped…
INTERPOL’s Operation Serengeti III led to 1,462 arrests across 21 countries and disrupted fraud, ransomware, business email compromise and other cybercrime operations. One major case involved rotating call centers that used scripted investment pitches, fake trading platforms and fraudulent websites…
Proofpoint described real campaigns where attackers used highly tailored, AI-style messages to make phishing and payment fraud requests appear routine. Examples included property enquiries that led to malicious meeting invitations, device-code phishing pages disguised as business services, and fake…
