---
title: "Alleged AI Fake-CEO Ring Charged in More Than $129 Million Wire Fraud"
published: 2026-11-09T15:49:03.259Z
updated: 2026-11-09T15:49:03.318Z
author: "Trust Onion Editorial Team"
canonical: https://trustonion.io/case-studies/ai-cloned-ceo-voices-wire-fraud-129-million
---

# Alleged AI Fake-CEO Ring Charged in More Than $129 Million Wire Fraud

**Cite as:** Alleged AI Fake-CEO Ring Charged in More Than $129 Million Wire Fraud, Trust Onion, 2026-11-09. https://trustonion.io/case-studies/ai-cloned-ceo-voices-wire-fraud-129-million

An accountant at a Missouri hospital system took a call from what sounded like the organization's chief executive, then a follow-up from a lawyer, and $4.8 million vanished. Both voices were generated by AI, federal prosecutors say. The same script played out several times over about 18 months beginning in July 2024, costing companies in the United States and Europe more than $129 million, according to the U.S. Attorney's Office for the Southern District of New York.

## Incident facts
- **Incident date:** Beginning July 2024
- **Victim type:** Organization
- **Attack type:** Voice cloning
- **Outcome:** Ongoing
- **Financial impact:** more than $129 million

## Timeline

- **The Setup:** Prosecutors say the scheme began with emails to accountants and finance managers, using the names of real people at large law firms and a scripted pretext of regulatory jargon and insider trading risks to demand secrecy.
- **The Attack:** Finance employees received calls from AI-generated voices of their own chief executive and of a lawyer. Attempts were also made to engage employees in video calls using deepfakes of the chief executive.
- **The Impact:** Victims wired money to accounts around the world, which was then converted into cryptocurrency. A Missouri hospital system lost $4.8 million; the total across companies in the United States and Europe was more than $129 million, prosecutors said.
- **The Charges:** An indictment was unsealed after authorities in Britain and Spain arrested three men over several months starting in June. They are awaiting extradition to face charges of wire fraud, aggravated identity theft and money laundering.

## How the attack worked

An accountant at a Missouri hospital system got a call from a voice that sounded like the organization's chief executive, asking for an urgent, confidential wire transfer. A lawyer called next to finish the deal. By the time the real executives found out, $4.8 million was gone. Both voices were made with AI, according to the U.S. Attorney's Office for the Southern District of New York, as [The New York Times reported](https://www.nytimes.com/2026/11/08/business/ai-ceo-impersonation-theft.html).

Prosecutors said the same script ran several times over about 18 months beginning in July 2024. It usually opened with an email to an accountant or finance manager and borrowed the names of real people at large law firms. A handwritten "Lawyer Call" script leaned on regulatory jargon and insider trading risks to demand secrecy, so staff would not talk to colleagues. There were also attempts to pull employees into video calls with deepfakes of the chief executive. Other victims, which were not named, included a British financial technology company ($11.6 million), a Florida pet food company ($5 million), a California hospital system ($3 million), a Massachusetts mutual fund company ($4.7 million) and a Rhode Island bank ($2.7 million). The money went to accounts in many countries and was turned into cryptocurrency, prosecutors said.

Sources: [The New York Times](https://www.nytimes.com/2026/11/08/business/ai-ceo-impersonation-theft.html) (Adeel Hassan, Nov. 8, 2026); [U.S. Attorney's Office, Southern District of New York](https://www.justice.gov/usao-sdny/pr/three-foreign-nationals-arrested-and-charged-scheme-use-super-intelligence-defraud); [PBS News](https://www.pbs.org/newshour/nation/3-charged-in-129-million-ai-scheme-targeting-thousands-of-companies); [NBC News](https://www.nbcnews.com/news/us-news/3-foreign-nationals-allegedly-used-ai-mimic-ceos-129m-scheme-doj-says-rcna607818).

## Damage assessment

Prosecutors say the scheme cost companies in the United States and Europe more than $129 million. Three men were arrested in Britain and Spain over several months starting in June and are awaiting extradition to the United States, where they face charges of wire fraud, aggravated identity theft and money laundering. The charges are allegations and have not been proven in court.

Hany Farid, a Dartmouth College computer science professor and chief science officer at GetReal Security, told The Times: "I would comfortably say with less than a minute, you can clone somebody." On spotting a fake by ear, he said: "People are just slightly above chance performance." One chief executive, he said, told him: "That's it, we're doing everything in person."

## How verification helps

Every one of these transfers started with a staff member hearing a familiar voice and having no other check to run. A codeword would have stopped it. With a rotating codeword set shared inside the company, the person asking for money gives the current words first. The real chief executive can read them from the app; a cloned voice cannot know words that rotate every 60 seconds. The finance employee checks them privately and never reads them out to the caller.

The "Lawyer Call" script was built to keep employees from checking with anyone, and that isolation is what made it work. A codeword check takes seconds, needs no approval chain and gives the employee a concrete reason to pause before money moves. Callers from outside the company, such as a law firm, a bank or a vendor, are not verified with codewords: hang up and call back on a number already on file, never one the caller provides.

## Key lessons

- A familiar voice is no longer proof of identity: Dartmouth's Hany Farid says less than a minute of audio is enough to clone somebody, so finance teams need a check a cloned voice cannot pass.
- Secrecy is part of the attack. Any caller who tells an employee not to talk to colleagues before wiring money should trigger more verification, not less.
- Rotating codewords cover colleagues inside the company. Outside parties such as banks, law firms and vendors are verified by calling back on a number already on file.

## Key takeaways

- Prosecutors say AI-cloned CEO and lawyer voices led companies in the U.S. and Europe to wire more than $129 million over about 18 months beginning in July 2024.
- The scheme paired an email naming real law-firm lawyers with cloned-voice calls and, in some attempts, deepfake video of the chief executive.
- A codeword check before any wire approval gives staff a step a cloned voice cannot pass: the real executive gives the current words first.

## Frequently asked questions

### How did the AI fake-CEO scheme work?

Prosecutors say an accountant or finance manager first received an email, then calls from AI-generated voices of the company's chief executive and a lawyer. A script built on secrecy and insider trading pretexts pushed the employee to wire money quickly to accounts abroad, where it was converted into cryptocurrency.

### How much money was taken?

More than $129 million from companies in the United States and Europe over about 18 months beginning in July 2024, according to the U.S. Attorney's Office for the Southern District of New York. A Missouri hospital system lost $4.8 million.

### Which companies were targeted?

The victims were not named. They included a Missouri hospital system ($4.8 million), a British financial technology company ($11.6 million), a pet food company in Florida ($5 million), a hospital system in California ($3 million), a mutual fund company in Massachusetts ($4.7 million) and a bank based in Rhode Island ($2.7 million).

### Has the case gone to trial?

Not yet. Three men were arrested in Britain and Spain and are awaiting extradition to the United States, where they face charges of wire fraud, aggravated identity theft and money laundering. The charges are allegations.

### How can a finance team check that a call really comes from the CEO?

Use a rotating codeword set shared inside the company. The person asking for the payment gives the current words first, and the employee checks them privately. The words rotate every 60 seconds. For outside callers such as banks or law firms, call back on a number already on file.

**Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger.