Federal prosecutors allege that a fraud ring used AI-generated CEO voices and video, along with stolen lawyer identities, to convince employees to approve fraudulent wire transfers. The attackers used familiar business workflows, confidential acquisitions, NDAs, executive calls, and outside counsel, to make the requests appear legitimate.
Prosecutors allege a fraud ring combined document fraud, AI-generated voice and video, and identity theft to extract large wire transfers from accounting and finance teams. The scheme began with electronic-signature messages, sent through services like DocuSign, that appeared to come from a company's CEO. These messages described a confidential corporate transaction, often framed as an acquisition, and asked employees to sign an NDA before any details were shared.
Once an employee engaged, the conspirators arranged a telephone or video call using AI technology to reproduce the CEO's voice and, in some cases, image. This step was designed to replace normal identity verification with a sense of personal recognition, employees believed they were hearing or seeing their own executive.
After employees accepted the fake executive's identity, the purported CEO directed them to an attorney supposedly managing the transaction. The conspirators generally used the identities of real lawyers working at international firms. This supposed attorney reinforced the need for secrecy, discouraged employees from discussing the matter with colleagues, and ultimately provided the payment instructions that routed funds to accounts controlled by the conspirators.
The scheme layered several trusted business signals on top of each other: a familiar electronic-signature workflow, an urgent and confidential business reason (an acquisition), a recognizable executive voice or face, and a professional-sounding outside lawyer. Each layer made the next request seem more credible, and the secrecy instructions discouraged employees from checking with colleagues who might have recognized the request as unusual. Prosecutors attribute approximately $129 million in losses to the broader scheme, with six identified successful thefts totaling about $32 million.
Organizations can reduce exposure by treating secrecy and urgency as reasons to follow verification procedures, not bypass them. Voice or video alone should never validate a high-value payment; staff should verify identity through an independently sourced contact method and required internal approvals, and confirm any outside counsel's identity before acting on their instructions. Independent back-office review proved effective in this case: an investment bank's intervention stopped a $2.85 million transfer before release, which shows that layered financial controls can catch fraud even after an employee has already authorized a payment.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They sent electronic-signature messages posing as the CEO describing a confidential acquisition, then used AI-generated voice and sometimes video on phone or video calls to reinforce the impersonation.
After employees accepted the fake CEO's identity, attackers impersonated real lawyers at international law firms to stress secrecy and provide fraudulent payment instructions.
A major New York investment bank stopped a $2.85 million transfer before funds were released, showing the value of independent back-office payment controls.
The operation primarily targeted accounting, finance, treasury, and accounts payable employees authorized to approve large wire transfers.
Your CEO calls about an acquisition. You recognize the voice. Is it real? First comes a DocuSign-style NDA: ‘Confidential transaction.’ Then an AI-generated CEO voice, sometimes video, confirms it. A supposed outside lawyer follows with urgent payment instructions. That’s the trap: the voice can be fake, and the lawyer’s real name can be stolen. ‘Don’t tell colleagues’ is a red flag, not an approval. A bank stopped one $2.85 million transfer. Before approving any wire, use your established independent verification and payment-approval process.
Fraudsters impersonated senior leaders at Intesa Sanpaolo using WhatsApp and an AI-cloned voice call to convince Fideuram’s chair to authorize urgent overseas transfers. The finance team then sent multiple payments to foreign accounts (mainly China and Hong Kong), and only part of the money has…
Scammers impersonated Intesa Sanpaolo’s CEO via a fake WhatsApp message and then used an AI-cloned voice posing as a law-firm partner to pressure Fideuram’s chairman into approving an overseas transfer. The bank sent €95 million to foreign accounts (including China and Hong Kong) before detecting…
The FBI warns scammers are impersonating FBI/IC3 staff and re-targeting people who already lost money to fraud. The scammers use emails, phone calls, social media messages, and even AI-generated videos to push victims to spoofed IC3 websites or to hand over more personal and financial information,…
U.S. prosecutors charged three people with allegedly using AI-generated CEO and attorney impersonations to steal about $129 million from companies worldwide. The group reportedly emailed accounting teams about confidential transactions, used AI voice and video calls to reinforce the request, and…
Dutch police arrested two suspects accused of using AI-generated bank fraud calls to steal more than €380,000 from 170 victims. The callers falsely warned of suspicious account activity, then posed as bank employees and persuaded victims to download an app and tap their debit card to their phone,…
U.S. prosecutors say five alleged leaders of Black Axe’s Cape Town group ran long-running online romance and “advance fee” scams that tricked U.S. victims into sending money. The scammers allegedly used fake identities to pose as love interests or trusted contacts, then pushed for payments using…
