# The CEO called about a secret deal. Then a lawyer from a top firm asked for the wire. ID: SA-168 Type: Documented incident Audience / at-risk group: Finance, accounting and treasury staff who can approve wires, executives whose voice and face are public, law firms, and the banks that process large outgoing transfers Subject: US indictment over an alleged $129 million AI impersonation scheme, November 2026 Sources checked: 2026-11-14 ## Lesson Secrecy plus urgency plus a new bank account is the signature of CEO fraud, whatever the voice on the line sounds like. A familiar voice or face on a call is no longer proof of who is speaking. Before any wire for a 'confidential deal', call the executive back on a number you already had, confirm the law firm and the lawyer through the firm's own switchboard, and require a second person to approve any first payment to a new beneficiary. In this case, one bank's back office stopped a $2.85 million attempt before it went out. ## Source findings The US Attorney's Office for the Southern District of New York announced in early November 2026 the unsealing of an indictment charging three men, one living in Spain and two in Israel and the UAE, with seven counts each, including conspiracy to commit wire fraud, wire fraud, aggravated identity theft and money laundering (CyberScoop, Gizmodo, Help Net Security). Prosecutors allege the scheme ran from about July 2024 to February 2026, targeted thousands of companies and obtained about $129 million by having impersonated CEOs steer accounting staff to impersonated lawyers, who gave the wire instructions. According to CyberScoop and Gizmodo, two were arrested in Spain and one in the UK. CyberScoop reports that one defendant's lawyers said he 'has no connection to this matter' and 'maintains his complete innocence'. US Attorney Jamie McDonald said the public should recognise that some 'seek to use this emerging technology to pursue criminal goals'; FBI Assistant Director in Charge James C. Barnacle Jr. said the case shows how advanced technology can be exploited to commit large-scale fraud. Gizmodo describes an October 2024 attempt to have a major New York investment bank wire about $2.85 million that the bank's back office stopped; CyberScoop lists a New York investment company as having lost $2.8 million. ## Limits This is an indictment: the charges are accusations, the three men are presumed innocent, no court has ruled, and one of them, through his lawyers, denies any involvement. The facts come from press reporting of the prosecutors' announcement and the indictment; we could not read the indictment text ourselves. The use of AI is alleged by prosecutors; the sources do not publish recordings or describe which tools were used, and 'deepfake' is the press's word, not a quoted official one. Sources disagree on whether the New York attempt of about $2.8 million was stopped (Gizmodo) or lost (CyberScoop). The impersonated executives, law firms and lawyers were victims of the impersonation, not participants, and the victim companies are not named. ## Sources - [CyberScoop](https://cyberscoop.com/ai-deepfakes-impersonate-ceo-lawyer-defraud-companies/) — Charges, the e-signature and NDA opening, victim losses, arrests, one defendant's denial, quotes from the US Attorney and the FBI · 6 November 2026 - [Gizmodo](https://gizmodo.com/doj-says-deepfaked-ceos-and-lawyers-helped-steal-129-million-from-hospitals-banks-and-others-2000836456) — Step-by-step mechanism from the indictment (DocuSign email, 'compliance call', real lawyers' identities), dated losses, the stopped New York wire, pending extradition · 7 November 2026 - [Help Net Security](https://www.helpnetsecurity.com/2026/11/09/deepfake-ceo-fraud-129-million-indictment/) — The 'Lawyer Call' script, combined hospital losses, the countries where money landed and the conversion to crypto · 9 November 2026 Original editorial text: CC BY 4.0. Third-party captures, source texts, names and logos retain their own rights.