An employee gets a call from the chief executive. It's the right voice, and sometimes the right face. There's a confidential acquisition, the lawyers will be in touch, and nobody else can know. Then a partner from a well-known international law firm calls with the wire details. According to US prosecutors, that script took more than $129 million from companies around the world between 2024 and 2026. Every voice in it was faked. If your payment controls rely on recognising the person asking, they no longer work.
What happened
On 5 November the US Attorney's Office for the Southern District of New York announced charges against three people over the scheme, after arrests in Spain and the UK with help from the National Crime Agency. The charges include wire fraud, aggravated identity theft and money laundering.
According to the Department of Justice, the group impersonated "the voices and/or images of corporate executives" to tell an employee that they "needed an employee's assistance on a confidential financial transaction". The employee was then put in touch with fake lawyers from real international firms, who gave instructions for a large transfer. One defendant's "Lawyer Call" script included lines meant to stop employees discussing the calls with colleagues. The money went to accounts in nine countries and was then converted into cryptocurrency.
The six victims named in the indictment include two hospital systems, a bank, a mutual fund company, a pet food company and a UK fintech that lost $11.6 million. AP's report adds that the approach often began with an email that appeared to come from the CEO.
Why this beats the controls most firms have
Most finance teams already know about CEO fraud. Policies say "verify unusual requests", and training shows the badly spelled email from the "CEO" on holiday. This scheme was built to get past exactly those defences:
- The verification was the attack. A careful employee who wants to hear the CEO's voice before acting gets a call from that voice.
- A second, independent-looking party. The fake law firm made the request look like a normal deal, with outside counsel handling the details, as happens in real transactions.
- Secrecy as part of the script. "Confidential" is a believable reason for not going through the usual approvers. It is also the exact reason the usual approvers exist.
- Targets outside the usual list. Hospitals, a bank and a pet food company had little in common except staff who could move money.
Voice cloning and real-time face swapping are cheap now. Recognising someone on a call or video tells you very little, and that won't change.
Move the control into the process
If you can't verify the person, verify the request through a route the requester doesn't control. Four controls do most of the work:
- Call back on a number you already hold. Use the directory, the contract or the supplier master file, never the number in the email or the one that just rang. Apply it to every new payee and every change of bank details, whatever the seniority of the person asking.
- Two people approve, in the system. Above a threshold, one person can never complete a payment alone, and the second approval happens in the banking or ERP platform, not by chat. "The CEO said so" is not an approval.
- No exceptions for confidentiality. Write it into the policy: a confidential transaction still goes through the normal approval route. Real deals already have that route. Tell staff in advance that anyone asking them to skip it is the warning sign.
- A cooling-off period for new beneficiaries. Holding first payments to new accounts for 24 hours costs a legitimate deal very little. It gives a fraud enough time to fall apart.
None of these depends on spotting a deepfake. That matters, because detection tools will always lag behind the tools that create the fakes.
Where the security team fits
This looks like a finance problem, but the warning signs usually appear in Microsoft 365 first. The activity around the call is often easier to spot than the call itself:
- A lookalike domain registered shortly before the first contact, sending mail to finance staff.
- An executive mailbox showing new inbox rules, or a sign-in from somewhere unusual, in the days beforehand. Real access to the CEO's email makes the follow-up call far more convincing. Our guide to business email compromise covers these signs.
- Calls or meetings from external accounts that are new to the organisation, followed by email to the same people about payments.
- Activity outside normal hours on the payments platform or the vendor master file.
A SOC watching identity and email can raise these as alerts and link them, so that the call-back happens with context. Our explainers on vishing and social engineering cover how these approaches are built.
Questions to ask on Monday
- Could one person in finance send £1 million today if they believed the CEO had asked?
- Does our payment policy say anything about confidential transactions?
- Where do staff get the number they use for a call-back?
- Would we see a lookalike domain or a new inbox rule on an executive's mailbox before the money left?
If any answer is uncertain, that is where to start. Our vCISO service can help you work through the policy side. Our managed SOC watches identity and email signals 24/7.
Want to test your payment process against a scenario like this? Talk to our team.