The CEO called about a secret deal. Then a lawyer from a top firm asked for the wire.

Audience / at-risk group

Finance, accounting and treasury staff who can approve wires, executives whose voice and face are public, law firms, and the banks that process large outgoing transfers

What you can notice

• According to the indictment as described by Gizmodo and CyberScoop, contact often began with an email through an electronic signature service such as DocuSign, apparently from the employee's own chief executive, saying a confidential transaction (often an acquisition) was under way and asking them to sign an NDA.
• The employee was then told to contact a lawyer for a 'compliance call'; the fake lawyer often borrowed the identity of a real lawyer in the European office of one of the world's 50 largest law firms. Help Net Security reports that one defendant, who mostly played UK attorneys, used a handwritten script titled 'Lawyer Call'.
• On later calls, prosecutors allege, the conspirators used AI to imitate the executive's voice and sometimes appearance; the US Attorney's announcement talks of 'super intelligence', while Gizmodo reports that the indictment itself says 'artificial intelligence'.
• Losses described in the charges include about $11.58 million at a UK fintech, $5.24 million at a Florida pet food company, $4.83 million at a Missouri hospital system, $4.64 million at a Massachusetts mutual fund, $2.97 million at a California hospital system and $2.68 million at a Rhode Island bank. The victims are not named.
• The money went to accounts in the US, Spain, Portugal, Greece, the UAE, Singapore, Austria, Slovakia and China, and was converted to cryptocurrency and split among the conspirators, according to prosecutors. Two of the men were arrested in Spain and one in the UK; extradition requests are pending (Gizmodo).

What the source reports

The US Attorney's Office for the Southern District of New York announced in early November 2026 the unsealing of an indictment charging three men, one living in Spain and two in Israel and the UAE, with seven counts each, including conspiracy to commit wire fraud, wire fraud, aggravated identity theft and money laundering (CyberScoop, Gizmodo, Help Net Security). Prosecutors allege the scheme ran from about July 2024 to February 2026, targeted thousands of companies and obtained about $129 million by having impersonated CEOs steer accounting staff to impersonated lawyers, who gave the wire instructions. According to CyberScoop and Gizmodo, two were arrested in Spain and one in the UK. CyberScoop reports that one defendant's lawyers said he 'has no connection to this matter' and 'maintains his complete innocence'. US Attorney Jamie McDonald said the public should recognise that some 'seek to use this emerging technology to pursue criminal goals'; FBI Assistant Director in Charge James C. Barnacle Jr. said the case shows how advanced technology can be exploited to commit large-scale fraud. Gizmodo describes an October 2024 attempt to have a major New York investment bank wire about $2.85 million that the bank's back office stopped; CyberScoop lists a New York investment company as having lost $2.8 million.

What this evidence cannot tell us

This is an indictment: the charges are accusations, the three men are presumed innocent, no court has ruled, and one of them, through his lawyers, denies any involvement. The facts come from press reporting of the prosecutors' announcement and the indictment; we could not read the indictment text ourselves. The use of AI is alleged by prosecutors; the sources do not publish recordings or describe which tools were used, and 'deepfake' is the press's word, not a quoted official one. Sources disagree on whether the New York attempt of about $2.8 million was stopped (Gizmodo) or lost (CyberScoop). The impersonated executives, law firms and lawyers were victims of the impersonation, not participants, and the victim companies are not named.