Imagine your boss calls you on video. The voice is right, the face is right, and the request is urgent: a confidential deal needs a wire transfer today, and you must not tell anyone. You comply. Later you learn that your boss never made that call.
This is no longer a movie plot. In early November 2026, US prosecutors in New York announced an indictment against three men accused of using AI to impersonate chief executives and lawyers, stealing more than $129 million from companies. The case is a loud warning that deepfake fraud has moved from novelty to organized, large-scale crime.
The good news is that these scams rely on predictable weaknesses in how companies approve payments, and those weaknesses can be fixed. This guide explains how the scheme allegedly worked, why it fooled trained professionals, and exactly what you can do to protect your business and your family.
What Happened in the $129 Million AI Impersonation Case
According to the indictment, the three defendants ran the scheme between July 2024 and February 2026. Prosecutors say they used AI to mimic the voices, and sometimes the images, of corporate executives at many companies. They also allegedly impersonated attorneys at some of the world’s largest law firms.
The targets were employees with the power to move money, often in accounting or finance. Each was told that the CEO needed help with a confidential financial transaction, frequently described as an acquisition. The employee was then pointed to a “lawyer” who supplied the payment instructions. The deal was fictional, and the money went to accounts controlled by the conspirators.
The defendants face charges including conspiracy to commit wire fraud, wire fraud, aggravated identity theft, and money laundering. Extradition requests are reportedly pending. These are allegations, not convictions, and the indictment does not name the victim companies or say how much money was recovered.
One detail is worth remembering: in at least one reported case, a bank’s back office stopped a payment before the funds left. Human checks still work when they exist.
How AI Voice and Video Cloning Scams Work
These attacks are not magic. They follow a repeatable playbook, and understanding it makes it easier to break.
Step 1: Collect Source Material
Attackers need only a short sample of a person’s voice. Earnings calls, conference talks, podcasts, YouTube interviews, and social media clips are all public. Modern voice-cloning tools can build a convincing imitation from a surprisingly small amount of audio.
Step 2: Make the Contact
The scammer calls or video-chats an employee with payment authority. The cloned voice, and sometimes a synthetic face, establishes false trust. The request is wrapped in pressure: it is urgent, it is secret, and it comes from someone senior.
Step 3: Hand Off to a “Third Party”
This is the clever part of the alleged scheme. Instead of asking for the money directly, the fake CEO sends the employee to a fake lawyer. A second voice and a professional-sounding setting make the story feel verified, even though both people are controlled by the same group.
Step 4: Move the Money Fast
Once a wire is sent, funds are quickly split across accounts and converted so they are hard to claw back. Speed is the attacker’s friend, which is why every scam in this category insists on urgency.
Why Smart People Fall for Deepfake Fraud
It is tempting to blame the victims, but the psychology here is strong.
- Authority: Most employees are trained to respond quickly to senior leaders.
- Secrecy: “Don’t tell anyone” removes the natural check of asking a colleague.
- Urgency: Time pressure shuts down careful thinking.
- Familiarity: A known voice lowers suspicion in a way an unknown email address never could.
Traditional phishing training teaches people to inspect links and sender addresses. A convincing voice on a live call bypasses all of that, so defenses must be built into process rather than depending on someone noticing something odd.
How to Protect Your Business From Deepfake CEO Fraud
The most reliable defenses are procedural. They work even if the fake is flawless.
Make Callback Verification Mandatory
For any new payee, changed bank details, or unusual transfer, require the employee to hang up and call the requester back using a number from your internal directory, never the number that called them. A cloned voice cannot answer a call placed to the real person’s real phone.
Example policy line: “No wire above $10,000 to a new beneficiary may be released until the requester has confirmed the instruction by calling a directory-listed number.”
Require Two Approvals
No single employee should be able to send a large payment alone. A second approver who was not on the original call breaks the isolation the scammer depends on. Set thresholds that match your risk, and apply them to executives’ requests too.
Use Code Words for High-Risk Requests
Agree on a verbal passphrase that finance leaders and executives use when requesting urgent or sensitive transfers. Rotate it regularly and never share it by email or chat. Even a simple rule works: if the request is urgent and unusual, it must include the code word.
Treat Secrecy and Urgency as Red Flags
Add a rule to your finance playbook: any request that combines secrecy, urgency, and a large payment is automatically escalated to a second person. Real executives understand and respect this rule. Scammers cannot afford it.
Run Realistic Drills
Periodically test your team with simulated voice-call scams, just as you would with phishing emails. Reward employees who pause and verify, even when it turns out to be a false alarm. The goal is to make “let me call you back” feel normal and safe.
Reduce Easy Source Material
You cannot hide your executives, but you can be thoughtful. Review how much high-quality audio and video of leadership is public, and avoid publishing unnecessary long recordings when a transcript would do.
How to Protect Yourself and Your Family
The same technology is used against individuals, often in “family emergency” scams where a cloned voice claims a relative is in trouble.
- Set a family code word. Pick a word that is never posted online and use it to confirm emergencies.
- Hang up and call back. Use the number saved in your contacts, not the one that called you.
- Be wary of payment methods. Gift cards, crypto, and wire transfers are favorites because they are hard to reverse.
- Limit public voice clips. Consider making social accounts private if they contain a lot of personal video and audio.
- Talk to older relatives. Explain that voices can now be faked, so a familiar voice alone is not proof.
Can You Spot a Deepfake?
Sometimes, but do not rely on it. Possible clues include unnatural pauses, odd lip movement, flat emotion, lighting that does not match the room, or audio that sounds slightly compressed. Video calls may glitch when someone turns their head quickly or covers their face with a hand.
However, the technology improves constantly, and attackers can use poor connection quality as a convenient excuse for imperfections. Treat visual and audio clues as a bonus signal, never as your main defense. Verification through a separate channel is far more dependable than trusting your eyes and ears.
What to Do If You Think You Have Been Targeted
Speed matters if money has already moved.
- Contact your bank immediately and ask them to recall or freeze the transfer.
- Notify your internal security or IT team and preserve call logs, emails, and recordings.
- Report the incident to law enforcement. In the US, that means the FBI’s Internet Crime Complaint Center (IC3). Other countries have their own cybercrime reporting portals.
- Alert partners and colleagues who might be targeted next using the same story.
- Review the process failure afterward, without blaming the individual, and close the gap.
Frequently Asked Questions
How much audio does a scammer need to clone a voice?
It varies by tool, but modern systems can produce a recognizable imitation from a short clip. Public interviews, webinars, and social videos can all provide enough material, which is why process-based defenses matter more than hiding your voice.
Are deepfake scams only a problem for large companies?
No. Small businesses are often easier targets because they have fewer approval layers and less security training. Individuals are also targeted through fake emergency calls and impersonation of relatives or officials.
Can antivirus software detect a deepfake call?
Generally not. Traditional security software looks for malicious files and links, not convincing voices. Some vendors sell deepfake-detection tools, but they should supplement, not replace, verification procedures.
Is a video call proof that someone is real?
No longer. Real-time face and voice synthesis can be used on live calls. For high-value requests, confirm identity through a second, independent channel, such as a call to a known number.
What is the single best defense against CEO fraud?
Callback verification combined with dual approval. Together, they ensure no payment depends on one person trusting one voice.
Conclusion
The $129 million case shows that AI impersonation is now an industrial-scale business tool for criminals, but the defense is refreshingly low-tech. Verify through a separate channel, require a second approver, and treat urgency and secrecy as warning signs. Put these rules in writing this week, practice them, and make it easy for employees to say, “Let me call you back.” That one sentence can stop a seven-figure loss.
