AI Voice-Cloning Scam Steals $129 Million From Firms Worldwide

Three men are now facing US federal charges for allegedly cloning the voices and faces of real company executives with AI, then using those fakes to talk finance teams into wiring out more than $129 million. No ransomware, no hacked servers — just a convincing fake video call and someone on the other end who believed it.

How the scheme allegedly worked

Federal prosecutors in the Southern District of New York say the group ran this operation from around mid-2024 into early 2026, targeting companies across multiple countries, including hospitals and banks. The playbook, as described in court filings and reported by outlets including the Associated Press and SecurityWeek, was consistent: call or video-call a company's accounting or finance staff, pose as the CEO or the company's outside lawyer using an AI-generated clone of their voice and sometimes their face, and create urgency around a "confidential" deal that needed money moved immediately.

That urgency is the real weapon here. Finance employees who'd normally double-check an unusual transfer request were, prosecutors allege, pressured into skipping those checks because the request appeared to come from someone they couldn't say no to — their own boss, on what looked and sounded like a real call.

The defendants face charges including wire fraud (using phone or internet communications to carry out a scam) and aggravated identity theft (illegally using someone else's identity — in this case, their voice and likeness — to commit a crime). All three were reportedly arrested abroad earlier this year, and extradition proceedings are ongoing.

A fake video call from "the boss" is no longer a red flag that's easy to catch by ear. It sounds exactly like them, because in a very real sense, it is.

Why this isn't just a Silicon Valley problem

This kind of attack — commonly called business email compromise or "CEO fraud" when it doesn't involve AI, and increasingly a voice-cloning or deepfake scam when it does — has already been showing up in India. Security researchers and India's own cyber-crime units have flagged a rise in WhatsApp and phone calls using cloned voices of employers, relatives, or officials to pressure victims into paying up fast, a close cousin of the "digital arrest" scams that have cost Indian victims hundreds of crores, and the kind of social engineering behind SIM swap fraud as well.

What makes the US case notable is the scale and the fact that it targeted businesses specifically, not individuals. Indian companies — especially mid-size exporters, IT services firms, and NBFCs that routinely move large sums internationally — are exactly the kind of target this playbook was built for. A finance manager getting a video call from someone who looks and sounds exactly like the managing director, asking for an urgent fund transfer tied to an "acquisition" or "regulatory payment," is not a hard scenario to imagine in any Indian boardroom.

India's Reserve Bank and CERT-In have both pushed banks to tighten callback-verification rules for large transfers, and the Digital Personal Data Protection (DPDP) Act adds pressure on companies to secure the voice and video data — recorded calls, onboarding videos, investor presentations — that scammers mine to train these clones in the first place. None of that fully closes the gap this case exposes: process discipline, not just technology, is what stops this kind of fraud.

What actually slows this down

Security teams who've looked at cases like this point to a short list of fixes that don't require new software budgets:

• A callback policy: any unusual transfer request, however it arrives, gets confirmed through a separate, pre-agreed channel — not by calling back the number that just called you.
• A shared "safe word" or code phrase between executives and finance staff for high-value approvals, changed periodically.
• Treating urgency itself as the warning sign — genuine confidential deals rarely require skipping standard sign-off within minutes.
• Limiting how much executive voice and video sits in public-facing content, since that's the raw material these clones are built from.

None of these are exotic. They're the same discipline banks have pushed for years against simpler phone scams, just applied to a harder-to-spot version of the same trick.

The uncomfortable part

Voice and video cloning tools keep getting cheaper and more convincing, which means the economics of this kind of fraud only get better for the people running it. The case working its way through a New York court won't be the last of its kind — it's more likely a preview of what finance departments everywhere, including in India, are going to need to build defenses around as a matter of routine, not exception.