Your CEO's Voice Just Called the Accounting Department. It Wasn't Your CEO.

Last week, the Department of Justice unsealed an indictment that should land on the desk of every CFO, controller, and business owner in America.

Three men ran a sophisticated fraud scheme for 18 months. They used artificial intelligence to clone the voices of chief executive officers. They generated deepfake video calls using those same executives' faces. And then they called accounting departments, impersonated corporate attorneys at major law firms, and walked employees through wiring millions of dollars into accounts they controlled.

The scheme stole at least $129 million from victims across multiple industries: a UK financial technology firm lost $11.6 million, a Missouri hospital system lost $4.8 million, a Massachusetts mutual fund company lost $4.6 million, a California hospital system lost nearly $3 million, and a Rhode Island bank transferred $2.7 million - all because someone who sounded and looked exactly like the CEO asked them to.

The DOJ indicted three defendants who were arrested in Spain and the UK. That's the good news. The bad news is that this scheme ran for a year and a half, hit thousands of targets, and succeeded enough times to generate $129 million in losses before anyone stopped it.

How the Attack Actually Worked

This wasn't a simple phishing email. The scheme had three distinct phases designed to defeat the most common fraud prevention instincts.

Phase one: the setup. Victims received an email that appeared to come from their CEO - through an e-signature platform - explaining they were working on a confidential financial transaction and needed the employee's help. The employee was asked to sign an NDA before proceeding, which added a veneer of legitimacy and prevented them from discussing it with colleagues.

Phase two: the voice call. The attackers used AI voice cloning to impersonate the CEO on a phone call. With less than a minute of audio - available from earnings calls, conference presentations, media interviews, or social media - modern AI tools can generate a convincing vocal replica. The impersonated CEO confirmed the transaction and directed the employee to contact a specific attorney.

Phase three: the attorney. The attorney was also an impersonator, using a prepared script that referenced regulatory terminology, insider trading risks, and confidentiality requirements to prevent the employee from seeking outside verification. The attorney then instructed the wire transfer.

One defendant even had his script titled "Lawyer Call" - a document designed to make an impersonator sound like a credible legal professional at a moment's notice.

A Dartmouth professor who studies deepfakes told reporters: with a single modern laptop, anyone can clone someone's voice using less than a minute of audio and create a convincing avatar deepfake from a single photograph.

The barrier to running this attack is low. The barrier to stopping it is higher than most organizations think.

Why This Works on Smart People

I've spent 25 years in cybersecurity, and the uncomfortable truth is this: this scheme is effective because it weaponizes good professional instincts.

Employees who get a call from the CEO want to be helpful. They don't want to seem insubordinate by questioning their boss. When a request comes with an NDA, a legal framework, and a credible-sounding attorney, it has the structural appearance of a legitimate high-stakes business transaction. And the specific instruction not to discuss it with colleagues eliminates the most effective informal fraud check most organizations have.

This isn't about employees being careless. It's about attackers engineering a scenario that defeats caution.

The victims include a hospital system, a mutual fund manager, an investment bank, and a fintech company. These are organizations with professional finance and compliance staff, internal controls, and risk management programs. And they still lost millions.

The Verification Gap Is the Actual Problem

In every one of these cases, there was a moment where a simple independent verification could have stopped the transfer. A callback to the CEO's known direct line - not the number provided by the caller. A quick message to the CFO's personal cell. A brief in-person confirmation.

But the scheme was designed to prevent exactly that. The NDA. The urgency. The attorney emphasizing confidentiality. The instruction to stay off internal channels.

Most organizations don't have a formal out-of-band verification protocol for large wire transfers. They rely on employees using good judgment in high-pressure moments. That's not a security program - it's a gap.

Three Actions Every Business Leader Should Take This Week

First: Implement a wire transfer verification protocol right now. Any wire transfer above a threshold your business defines - whether that's $25,000 or $500,000 - requires a callback to a known, pre-registered number before execution. Not a number provided during the request. A number already on file. This one process change eliminates the most common path of attack.

Second: Create a social engineering exception policy. Train your finance and accounting teams that any request involving an NDA, instructions not to discuss with colleagues, or unusual urgency is an automatic flag - not a reason to move faster. The legitimate version of a large wire transfer doesn't come with instructions to bypass your normal approval chain. If it does, that's your signal to slow down, not speed up.

Third: Audit what public audio and video exists of your senior leaders. Earnings calls, conference presentations, podcast appearances, media interviews - every piece of audio is potential training data for a voice clone. Know what's out there. Consider whether your leaders' communication habits create material for attackers. This won't eliminate the risk, but it informs your threat model.

The Broader Shift This Represents

This case is a landmark moment in AI-enabled fraud. For years, business email compromise - impersonation via email - was the dominant social engineering threat. It has cost businesses billions annually. Now that same playbook has voice and video attached to it.

The FBI noted that as criminals continue to weaponize emerging technologies, detection and investigation has to rapidly adapt. That's their challenge. Your challenge is different: you need to be harder to fool before the FBI gets involved.

The companies that lost money in this scheme weren't careless. They were caught by a threat that was newer than their controls. The indictment is a wake-up call. The question is what your organization does with it.

TrustPoint Cyber works with organizations to build security programs that account for human-layer threats - not just technical ones. Social engineering prevention, verification protocols, and security awareness programs are part of a complete security posture. If you want to understand where your organization's gaps are, that's the conversation to have.