Three men have been charged over an alleged $129 million fraud scheme in which criminals used artificial intelligence (AI) to impersonate CEOs and lawyers, convincing employees at companies across the US and overseas to transfer millions of dollars into fraudulent bank accounts.
According to the US Department of Justice, the alleged scheme operated between 2024 and 2026, targeting hospital systems, financial institutions and other businesses. By combining AI-generated impersonations with convincing legal and financial scenarios, the group allegedly persuaded employees to authorize payments worth more than $129 million.
The case highlights a challenge for finance teams: when criminals can convincingly imitate senior executives and trusted advisers, recognizing the person requesting a payment is no longer enough to establish that the transaction is legitimate.
How the alleged $129 million fraud unfolded
On November 5, 2026, federal prosecutors in New York announced charges against three men accused of orchestrating the international fraud operation. The defendants were arrested in Spain and the United Kingdom between June and September 2026 and face seven criminal counts, including wire fraud, aggravated identity theft and money laundering.
According to prosecutors, the group typically began by contacting an employee while impersonating their company's CEO. Using AI-generated voices or images, the caller would explain that the business was involved in a confidential financial transaction and needed the employee's assistance to complete it.
The employee would then be directed to communicate with lawyers supposedly representing a major international law firm. Those lawyers were also impostors, creating the impression that an independent legal adviser had confirmed the transaction's legitimacy. Eventually, one of the fake lawyers would instruct the employee to wire a substantial payment to a bank account controlled by the group.
Investigators also uncovered a handwritten script titled "Lawyer Call," allegedly used by one defendant when impersonating UK attorneys. The script included language designed to discourage employees from discussing the transaction with colleagues, reducing the likelihood that someone else would question the request before the money was transferred.
Hospitals, banks and financial firms among the victims
The alleged scheme affected businesses across multiple industries and countries. Prosecutors identified several significant losses, including:
- $11.58 million from a UK financial technology company
- $5.24 million from a Florida pet food company
- $4.83 million from a Missouri hospital system
- $4.64 million from a Massachusetts mutual fund company
- $2.97 million from a California hospital system
- $2.68 million from a Rhode Island bank
According to the indictment, the group directed payments through accounts in nine countries, including the US, Spain, Singapore, the United Arab Emirates and China. Prosecutors allege that the funds were subsequently converted into cryptocurrency to conceal their origin, ownership and movement.
The charges remain allegations, and the defendants are presumed innocent unless proven guilty in court.
Why AI impersonation makes payment fraud harder to detect
The alleged scheme relied on more than convincing AI-generated voices or images. It combined executive authority, seemingly independent legal advice and strict confidentiality to make fraudulent payment instructions appear legitimate.
An unexpected request from a CEO might ordinarily prompt an employee to seek clarification. But when the caller sounds or looks like the executive, and a supposed external lawyer reinforces the instructions, the employee may believe the transaction has already been authorized by multiple trusted parties.
This tactic reflects a broader shift in financial fraud. In a 2024 alert on deepfake-related financial crime, the Financial Crimes Enforcement Network (FinCEN) warned that criminals were using generative AI to impersonate trusted individuals and support fraud schemes, including attempts to redirect corporate payments.
Confidentiality adds another layer of risk. Legitimate corporate transactions can involve sensitive information, but fraudsters can exploit that expectation to discourage employees from seeking independent confirmation. FinCEN has previously identified instructions marked as urgent, secret or confidential as potential warning signs of business email compromise and fraudulent payment activity.
In the scheme described by prosecutors, the criminals allegedly controlled the entire chain of communication, from the initial executive request to the legal instructions and receiving bank account. What appeared to be separate sources of authority was actually a coordinated attempt to redirect company funds.
How finance teams can prevent AI-enabled payment fraud
The case reinforces why payment security cannot depend solely on recognizing a familiar voice, face or name. Finance leaders need processes that independently verify payment instructions and account ownership, particularly when transactions involve unusual requests or unfamiliar recipients.
Verify payment instructions through trusted channels
Employees should independently confirm unusual or high-value payment requests, even when they appear to come directly from senior leadership. That means contacting the executive through an established internal directory or reaching an external adviser through independently verified contact details, rather than relying on information supplied during the request.
The FBI recommends verifying payment requests directly with the person involved, particularly when bank account details or payment procedures change. This creates a separate confirmation step that criminals cannot satisfy simply by controlling the original conversation.
Treat secrecy and urgency as reasons for additional scrutiny
Confidential transactions should still follow established approval procedures. When an employee is told not to discuss a payment with colleagues or is pressured to act quickly, the request should trigger additional review rather than bypass existing controls.
Organizations can reduce this risk by requiring independent approval for unusual or high-value transactions and giving employees clear escalation procedures. These safeguards help ensure that employees aren't left to challenge a seemingly legitimate instruction from senior leadership without organizational support.
Independently verify bank account ownership
Confirming that a payment has been requested by an authorized person is only part of the process. Finance teams also need to establish that the receiving account belongs to the intended recipient before releasing funds, especially when making first-time payments or processing changes to existing banking details.
The FBI's guidance on business email compromise emphasizes independently verifying changes to payment instructions and account numbers. Using trusted account verification processes alongside internal approvals can help prevent a convincing impersonation from becoming an unauthorized transfer.
AI can imitate an executive. It can't replace independent payment verification.
The alleged $129 million scheme demonstrates how criminals can use AI to make familiar payment fraud tactics more convincing. By impersonating both executives and external advisers, the group allegedly created a chain of false authority that persuaded employees to transfer substantial sums.
For CFOs and finance teams, the central lesson is that a convincing identity doesn't establish a legitimate payment. Strong approval procedures, independent confirmation and verified bank account ownership remain essential, regardless of how authentic a caller sounds or appears.
As impersonation technology improves, businesses need payment controls that verify the transaction independently, rather than relying on the apparent identity of the person requesting it.
Want to learn more? Download our guide to preventing deepfake-enabled fraud.
