When the Boss on the Phone Isn’t Real

Federal prosecutors have charged three men in a sophisticated fraud scheme that utilized generative AI to impersonate company executives and lawyers, resulting in the theft of more than $129 million from organizations across the United States and Europe. The operation, which spanned approximately 18 months beginning in July 2024, relied on the precise replication of voices to manipulate employees into authorizing unauthorized wire transfers.

What happened

The attackers employed a consistent social engineering script that prioritized urgency and confidentiality to bypass standard verification procedures. In one instance, an accountant at a Missouri hospital system received a call from someone they believed to be their chief executive. The caller insisted on an immediate, confidential wire transfer, which was then facilitated by a second caller posing as a lawyer. By the time the actual executives were alerted, $4.8 million had been stolen.

According to the U.S. Attorney’s Office for the Southern District of New York, the perpetrators expanded their tactics beyond voice cloning to include the use of deepfake video calls, where they impersonated chief executives to further deceive staff. The scheme successfully targeted a variety of industries, including a British financial technology firm that lost $11.6 million, a Florida pet food company that lost $5 million, a California hospital system that lost $3 million, a Massachusetts mutual fund company that lost $4.7 million, and a Rhode Island bank that lost $2.7 million. The indictment highlights the growing threat of AI-driven impersonation in corporate environments, where the combination of high-fidelity synthesis and psychological pressure can lead to significant financial losses before internal controls can intervene.