Deepfake CEO Wire Fraud: Inside the Alleged $129 Million Transfer Scheme

The call sounds like it came from your CEO. There’s a confidential deal in progress, and you’re asked to help move it along.

Then someone who introduces themselves as outside counsel follows up. Two people seem to be telling you the same story. Is that enough to act?

Overview

The second caller is what makes this case stand out

Deepfake CEO wire fraud is a payment scam. A caller impersonates an executive and tries to get an employee with access to company funds to send money.

The fake CEO isn’t always the person who provides the bank details. In a case announced by federal prosecutors in New York, the executive supposedly delegated that part to lawyers.

The Justice Department’s announcement describes alleged use of AI to imitate voices, images, or both. It doesn’t say every employee saw a live synthetic video.

Three people were charged. Prosecutors put the alleged losses at more than $129 million. These are allegations, not convictions, and the defendants are presumed innocent.

What two conversations can and cannot confirm

It feels natural to treat a second person as a second source. That only works if the second person was reached independently of the first.

A lawyer introduced by the caller belongs to the same chain of trust. A professional title and a credible explanation don’t establish who controls the destination account.

Before a wire goes out, the questions that matter are separate:

• Did the executive authorize this specific transaction?
• Does your own legal team recognize the matter and the outside counsel?
• Has someone verified the actual beneficiary and account through a trusted channel?
• Has an independent approver seen the final payment details?

Getting the first answer right doesn’t settle the other three. A real deal can still have an incorrect payment instruction attached to it.

The risk is the payment, not the quality of the video

A clear picture and a natural voice don’t turn a call into an authorization record. Neither does a familiar number on the screen.

The FBI’s warning about AI-enabled fraud recommends calling back through an independently obtained number when you’re unsure who contacted you. Apply that rule even if nothing looks unusual.

There’s no need to decide whether a clip is synthetic before stopping a wire. An unverified request is enough reason to hold it.

How the Deepfake CEO Wire Fraud Scam Works

Step 1: An executive appears to ask for help

In the case described by prosecutors, employees were approached by people posing as their own chief executives. The request concerned a confidential financial transaction.

That framing matters because a private deal is plausible. In many workplaces, an employee can be asked to handle one piece of work without seeing the whole agreement.

The dangerous leap is from recognizing the kind of task to accepting this particular instruction. A familiar process can start with a person who has no authority over it.

Someone who knows your role or gets a project name right may sound like an insider. Treat those details as context, not proof of identity.

Step 2: The call seems to settle who is asking

A voice or face associated with the real executive can make the request feel settled. The alleged use of AI in this case was meant to support the impersonation.

On a short work call, people rarely pause to study an executive’s face. Audio compression, a poor connection, or an awkward pause can happen in an ordinary meeting.

Trying to spot glitches puts the decision on the wrong footing. A rough connection doesn’t prove fraud. A smooth one doesn’t entitle a caller to company funds.

If the conversation is unexpected, close it and reach the executive through a contact already established inside the company. Don’t accept a replacement number offered during the call.

Step 3: Outside counsel seems to corroborate the deal

Prosecutors say the purported executives pointed staff to people posing as attorneys from major firms. Those follow-ups supplied a second appearance of authority.

A real firm can be impersonated without its systems being compromised. Finding a lawyer with the right name on a firm’s site doesn’t tell you who contacted you.

Ask your own legal department whether the firm was retained for the matter. It can make contact through records established before the new request arrived.

A matter number or an engagement letter forwarded by the supposed attorney still came from that conversation. It can be a lead for legal to check, not a substitute.

Step 4: The instruction becomes a transfer

The federal announcement alleges that an impersonator eventually directed employees to wire money to an account controlled by people involved in the scheme.

This is the moment when an unfamiliar request becomes a financial loss. A genuine bank can process the instruction correctly while the money goes to the wrong recipient.

Look at the beneficiary and account on the payment screen itself. Checking a PDF earlier in the day doesn’t verify that the details in the bank portal still match.

Put the payment on hold if anyone changes the destination after approval. Have the revised details checked again, including when the change is described as a clerical correction.

Step 5: The transfer is harder to retrieve than to delay

Prosecutors allege that proceeds in the case were converted into cryptocurrency after bank transfers. That doesn’t mean employees were asked to buy or send cryptocurrency themselves.

Start with the bank that sent your payment. Give it the original transaction reference rather than speculating about where the funds went.

The FBI’s business email compromise guidance recommends contacting the originating financial institution immediately to request a recall or reversal. A request is not a guarantee of recovery.

How to Verify a Confidential Wire Without Breaking Confidentiality

Confidential work can still have controls. The difference is who gets access to the information, not whether anyone checks the payment.

If a deal is genuinely sensitive, a designated lawyer or treasury approver can often confirm the essential facts without giving the entire team the deal documents.

Start by putting the transfer in a reversible state. Leave it unsubmitted if you can. If it’s queued, ask the person authorized to suspend it to do so.

Use an internal directory, existing finance workflow, or established contact list. Keep the original conversation separate so the caller can’t supply the person who supposedly confirms it.

Ask about the specific transaction rather than the general idea of a deal. A yes to “Are we working with this firm?” isn’t a yes to a wire.

Confirm what the company is paying for, how much it approved, and who should receive the money. Those questions can be answered without sharing every detail of the underlying deal.

When a beneficiary is new or its account has changed, send the request through the process your organization uses to validate new payees. Don’t enter it as a one-off exception.

Ask a second person to check the amount and destination in the bank portal. Share the approval record, not just a message saying it was approved.

That check has to be independent. If both approvers got their instructions from the same unverified thread, the second signature hasn’t solved the problem.

If an authorized person can’t be reached before a deadline, document the delay and escalate through the normal chain. Don’t turn an unavailable approver into permission to proceed.

It helps to have a short answer ready: “I can hold the payment while legal and treasury verify it.” You don’t need to accuse anyone on the call.

What a Finance Team Can Fix Before the Next Call

Make the safe choice easy to take while the phone is ringing. A contact sheet buried in a private folder won’t help the employee expected to release the payment.

Give staff a known route to reach treasury and legal when a payment is urgent. Include an alternate approver for evenings, travel days, and vacations.

Decide who has the authority to stop a queued payment. The person who notices the issue may be a coordinator who can prepare a wire but can’t cancel it.

Review how account changes reach your finance system. A correction sent to an individual shouldn’t bypass the people who maintain verified supplier or counterparty records.

Separate creating a beneficiary from releasing a payment where your banking setup supports it. Have the person releasing the wire see which beneficiary will actually receive it.

Plan for exceptions before an exception comes up. Specify who can approve them and where approval is recorded. Don’t leave that decision to the person receiving the unexpected call.

Have management say plainly that staff can delay a transfer for verification. Employees shouldn’t have to guess whether following the policy will get them in trouble.

Practice with a fictional transfer and a tabletop exercise, not a real wire. Ask whether the team can pause it, contact the right person, and locate the bank’s fraud number.

The exercise is useful even if nobody uses synthetic audio. Its purpose is to make sure the payment process works when a caller sounds credible.

After an exercise or a real near miss, check whether the staff member who raised the concern heard what happened next. Silence makes reporting feel pointless.

Give them a clear answer without exposing sensitive details: the payment was stopped, the request was cleared, or the matter went to the incident team.

If an employee worked around the approval system because it was too slow, ask what slowed it down. Fixing that bottleneck can make the control easier to follow.

What to Do If You Received a Suspicious Wire Request

1. Stop the payment if it hasn’t gone out. Tell treasury or the bank portal administrator which instruction is affected. Don’t try to test the account with a small transfer.

   If the wire was prepared but not approved, tell the approvers directly. Don’t assume they’ll see a comment you left in the payment queue.

2. If money moved, call the sending bank immediately. Use the fraud or treasury number from your established bank relationship, not a number attached to the transfer request.

   Have the amount, currency, timestamp, beneficiary, and wire reference ready. Ask what the bank needs for a recall and whether another payment is still pending.

   Record the case number and the next contact time. Keep the bank’s process moving while your company checks the facts internally.

3. Get legal, finance, and security into the same conversation. They need to know what was requested, what was shared, and what actually left the company.

   Don’t keep responding to the suspicious caller to gather evidence. Have the appropriate internal team decide how to handle further contact.

4. Preserve what you already have. Keep original messages, meeting invitations, invoices, bank records, and the times of calls. Store them in the company’s approved incident channel.

   Tell investigators which details came from a message and which you observed yourself. Keep unverified notes separate from the originals.

5. Tell security if you entered credentials or opened a download. A payment scam and an account compromise can overlap, but they call for different responses.

   On a managed computer, follow your IT team’s instructions rather than deleting files, resetting the device, or installing a cleanup tool on your own.

6. File the appropriate fraud report. In the U.S., use the FBI’s IC3 portal. The Justice Department’s announcement also directs people with information about this case to the FBI tips page.

   Outside the U.S., follow local reporting procedures and your bank’s instructions. A police report doesn’t replace the urgent request to stop or recall the payment.

Frequently Asked Questions

Was the $129 million figure a single transfer?

No. The Justice Department described alleged losses across multiple victim companies. It did not present the total as one payment, and the charges aren’t findings of guilt.

Does the case prove the defendants used live deepfake video on every call?

No. The announcement describes alleged impersonation involving voices, images, or both. It doesn’t establish what appeared on every call or what each employee heard.

What if I know the executive’s voice well?

Familiarity is helpful in ordinary conversation, but it isn’t a payment control. Confirm the instruction through a separate channel you already trust.

Is a message from a real law firm’s domain enough?

No. Confirm that the firm is acting on the actual matter and verify the bank details independently. A genuine account can also be misused.

Should I run antivirus after receiving the call?

A call by itself doesn’t show that anything was installed. If you followed a download or shared access, report that separately to your security team.

Should I wait for proof of a deepfake before calling the bank?

No. If an unverified payment already went out, contact the sending bank immediately. Identifying how the caller impersonated someone can wait.

The Bottom Line

Don’t send a wire because a caller sounds like your CEO or because the lawyer they introduced repeats the story. Neither can independently verify the other.

Put the payment on hold until your own legal and finance contacts confirm the matter, beneficiary, and final bank details through established channels.

If the transfer already left, call the sending bank now and ask about a recall. Preserve the records and bring in your company’s incident team.