Three charged in alleged impersonation of CEOs and lawyers using AI; AP says prosecutors put the take at about $129 million

A call-back to the CEO would likely have broken the fraud chain alleged in a new federal case, but only if the employee made the call, so wire rules must also cover the lawyer. Prosecutors announced charges on Nov. 5 against three people, AP reported, in an alleged scheme using a fake CEO, then a fake lawyer, to get employees, often in accounting, to wire money. All three are presumed innocent.

How the alleged scheme worked

Court documents allege, AP reported, that the defendants emailed employees posing as the CEO and asking for help with a confidential financial transaction. Citing the indictment, AP said they arranged a phone or video call where they used AI to mimic the CEO's voice and sometimes image. They allegedly then told the employee to contact an attorney at a major law firm, whom the group was ready to impersonate; the fake attorney told the employee to wire large payments to accounts across the world, and the money was converted to cryptocurrency, AP reported. NBC, citing the Justice Department's release, dated the scheme July 2024 to February 2026.

ITPro reported that a script allegedly kept to play the lawyers was designed to convince victims not to discuss the communications with fellow employees.

Step by step, AP and NBC tie AI only to the CEO. The Record reported that it also made the defendants look and sound like the lawyers, and summaries by AP, NBC and ITPro cover attorneys. None of these reports says whether the calls were live or recorded, or what share of the losses involved AI.

The Record quoted a prosecutor putting the money sent at approximately $129 million. Six alleged losses ITPro listed add up to about $32 million, and coverage does not break down the rest.

AP, as carried by CBS, said extradition requests for all three are pending.

Who is affected

NBC and ITPro reported the targets as employees, usually in accounting. Alleged victims, AP said, include hospital systems, a bank, a financial technology company, a mutual fund company and a pet food company; NBC added an investment bank. AP, citing the indictment, said thousands of companies were targeted. The Record reported an FBI appeal for other possible victims to come forward.

What to do now

A call-back on a directory number, made before the handoff, would likely have broken this chain, because the real CEO would know of no such deal. But secrecy discourages the call, and the alleged wire instruction comes from a third party.

1. Controller and treasury lead, this week: a "confidential" deal gets no exemption from dual approval. A first payment to a new account waits for a second approver who was not on the call, enforced in the bank portal (limits, payee allowlist). A request marked confidential triggers the call-back. The general counsel names in advance who an employee told to keep a deal quiet escalates to, and executives tell finance staff.
2. General counsel with the controller, this month: any payment instruction attributed to outside counsel is confirmed through the general counsel's office against an existing engagement, using the contact on file. A number or link given in the conversation does not count. If no engagement matches, the payment stops.
3. CISO, this month: state that voice or video on a call is never verification. Verify on a directory number, as in our call-back guide.
4. If a wire already went, treasury, the same day: the FBI's guidance is to contact your bank at once and request a recall of the funds along with any necessary indemnification documents, then file an IC3 complaint with the full transaction details. Include every onward transfer you know of.