Three men have been charged in the US over an alleged US$129 million fraud scheme involving the use of artificial intelligence (AI) to impersonate CEOs and lawyers. Prosecutors allege the group convinced employees at companies in the US and overseas to transfer millions of dollars into fraudulent bank accounts.
According to the US Department of Justice, the alleged scheme operated between 2024 and 2026, targeting hospital systems, financial institutions and other businesses. By combining AI-generated impersonations with convincing legal and financial scenarios, the group allegedly persuaded employees to authorise payments worth more than US$129 million.
The case highlights a challenge for finance teams worldwide: when criminals can convincingly imitate senior executives and trusted advisers, recognising the person requesting a payment is no longer enough to establish that the transaction is legitimate.
How the alleged US$129 million fraud unfolded
On 5 November 2026, US federal prosecutors in New York announced charges against three men accused of orchestrating the international fraud operation. The defendants were arrested in Spain and the UK between June and September 2026 and face seven criminal counts, including wire fraud, aggravated identity theft and money laundering.
According to prosecutors, the group typically began by contacting an employee while impersonating their company's CEO. Using AI-generated voices or images, the caller would explain that the business was involved in a confidential financial transaction and needed the employee's assistance to complete it.
The employee would then be directed to communicate with lawyers supposedly representing a major international law firm. Those lawyers were also impostors, creating the impression that an independent legal adviser had confirmed the transaction's legitimacy. Eventually, one of the fake lawyers would instruct the employee to transfer a substantial payment to a bank account controlled by the group.
Investigators also uncovered a handwritten script titled "Lawyer Call," allegedly used by one defendant when impersonating UK attorneys. The script included language designed to discourage employees from discussing the transaction with colleagues, reducing the likelihood that someone else would question the request before the money was transferred.
Hospitals, banks and financial firms among the victims
The alleged scheme affected businesses across multiple industries and countries. US prosecutors identified several significant losses, including:
- US$11.58 million from a UK financial technology company
- US$5.24 million from a US pet food company based in Florida
- US$4.83 million from a US hospital system in Missouri
- US$4.64 million from a US mutual fund company in Massachusetts
- US$2.97 million from a US hospital system in California
- US$2.68 million from a US bank in Rhode Island
According to the indictment, the group directed payments through accounts in nine countries, including the US, Spain, Singapore, the United Arab Emirates and China. Prosecutors allege that the funds were subsequently converted into cryptocurrency to conceal their origin, ownership and movement.
The charges remain allegations, and the defendants are presumed innocent unless proven guilty in court.
Why AI impersonation makes payment fraud harder to detect
The alleged scheme relied on more than convincing AI-generated voices or images. It combined executive authority, seemingly independent legal advice and strict confidentiality to make fraudulent payment instructions appear legitimate.
An unexpected request from a CEO might ordinarily prompt an employee to seek clarification. But when the caller sounds or looks like the executive, and a supposed external lawyer reinforces the instructions, the employee may believe the transaction has already been authorised by multiple trusted parties.
This tactic reflects a broader shift in financial fraud. In a 2024 alert on deepfake-related financial crime, the US Financial Crimes Enforcement Network (FinCEN) warned that criminals were using generative AI to impersonate trusted individuals and support fraud schemes, including attempts to redirect corporate payments.
Confidentiality adds another layer of risk. Legitimate corporate transactions can involve sensitive information, but fraudsters can exploit that expectation to discourage employees from seeking independent confirmation. FinCEN has previously identified instructions marked as urgent, secret or confidential as potential warning signs of business email compromise and fraudulent payment activity.
In the scheme described by US prosecutors, the criminals allegedly controlled the entire chain of communication, from the initial executive request to the legal instructions and receiving bank account. What appeared to be separate sources of authority was actually a coordinated attempt to redirect company funds.
How finance teams can prevent AI-enabled payment fraud
The case reinforces why payment security cannot depend solely on recognising a familiar voice, face or name. Finance leaders need processes that independently verify payment instructions and account ownership, particularly when transactions involve unusual requests or unfamiliar recipients.
Verify payment instructions through trusted channels
Employees should independently confirm unusual or high-value payment requests, even when they appear to come directly from senior leadership. That means contacting the executive through an established internal directory or reaching an external adviser through independently verified contact details, rather than relying on information supplied during the request.
The US Federal Bureau of Investigation (FBI) recommends verifying payment requests directly with the person involved, particularly when bank account details or payment procedures change. This creates a separate confirmation step that criminals cannot satisfy simply by controlling the original conversation.
Treat secrecy and urgency as reasons for additional scrutiny
Confidential transactions should still follow established approval procedures. When an employee is told not to discuss a payment with colleagues or is pressured to act quickly, the request should trigger additional review rather than bypass existing controls.
Organisations can reduce this risk by requiring independent approval for unusual or high-value transactions and giving employees clear escalation procedures. These safeguards help ensure that employees aren't left to challenge a seemingly legitimate instruction from senior leadership without organisational support.
Independently verify bank account ownership
Confirming that a payment has been requested by an authorised person is only part of the process. Finance teams also need to establish that the receiving account belongs to the intended recipient before releasing funds, especially when making first-time payments or processing changes to existing banking details.
The FBI's guidance on business email compromise emphasises independently verifying changes to payment instructions and account numbers. Using trusted account verification processes alongside internal approvals can help prevent a convincing impersonation from becoming an unauthorised transfer.
AI can imitate an executive. It can't replace independent payment verification.
The alleged US$129 million scheme demonstrates how criminals can use AI to make familiar payment fraud tactics more convincing. By impersonating both executives and external advisers, the group allegedly created a chain of false authority that persuaded employees to transfer substantial sums.
For CFOs and finance teams worldwide, the central lesson is that a convincing identity doesn't establish a legitimate payment. Strong approval procedures, independent confirmation and verified bank account ownership remain essential, regardless of how authentic a caller sounds or appears.
As impersonation technology improves, businesses need payment controls that verify the transaction independently, rather than relying on the apparent identity of the person requesting it.
Want to learn more? Download our guide to preventing deepfake-enabled fraud.
