An email from your CEO. A quick video call where the face and voice look and sound exactly right. Then a “lawyer” asks your finance team to wire money for a confidential deal. That is deepfake CEO fraud, and on November 5, 2026 US prosecutors said one group used it to take about $129 million from companies. If your business moves money by email, phone or video call, this story is about you.
What happened: the $129 million deepfake CEO fraud case
On Thursday, November 5, 2026, federal prosecutors in the Southern District of New York announced charges against three men. According to the Associated Press and CyberScoop, they are accused of targeting thousands of companies around the world between July 2024 and February 2026.
The reported charges include conspiracy to commit wire fraud, wire fraud, aggravated identity theft and money laundering. The three were arrested between June and September 2026, in Spain and the United Kingdom. Reports describe them as coming from Spain, the UK, Israel and the United Arab Emirates. These are allegations; the defendants have not been convicted.
How the scam worked, step by step
Based on the court records described in the coverage, the playbook looked like this:
- Pick the right target. Staff in accounting with enough authority to approve large wire transfers.
- Send a “CEO” email. A message, often styled as an e-signature request, asks for help with a confidential financial transaction and an NDA.
- Add an AI voice or video call. The callers used AI to copy the CEO’s voice and, in some cases, the CEO’s image.
- Hand over to a fake lawyer. The employee is told to speak to an attorney at a major law firm. The “attorney” is also an impersonator.
- Move the money fast. Wires go to accounts in several countries, including the US and the UAE, and are then converted to cryptocurrency.
Reported victims include hospital systems in Missouri and California, a Rhode Island bank, a Massachusetts mutual fund company, a Florida pet food company and a UK fintech firm. CyberScoop reported individual losses ranging from about $2.7 million to almost $11.6 million.
Why AI voice cloning scams matter for businesses in the USA and UAE
Business email compromise is not new. What has changed is the second step. For years, the standard advice was “call to confirm.” Now the call itself can be faked. A cloned voice or a deepfake face on a video call removes the doubt that used to stop many payments.
- USA: The victims in this case were ordinary US organizations, from healthcare to banking to consumer goods. Size did not protect them.
- UAE and Dubai: Dubai is a hub for cross-border trade, real estate and holding companies, where large international transfers are routine. Prosecutors say UAE bank accounts were among those used to receive funds.
- SMEs: Smaller teams often let one person approve payments. That is exactly the kind of employee this group looked for.
Executives who post videos, podcasts and interviews online also give criminals plenty of voice and face samples to work with.
Red flags your finance team should know
- A senior leader asks for secrecy and tells you not to involve colleagues.
- The request is urgent, unusual and tied to a “confidential deal” or acquisition.
- You are passed to an outside lawyer or adviser you have never dealt with.
- Payment must go to a new account, often in another country.
- The call quality is “bad,” the camera keeps dropping, or the person avoids live questions.
How to prevent deepfake fraud: practical next steps
You cannot stop criminals from cloning a voice. You can make sure a cloned voice is not enough to move money.
1. Change your payment approval rules
- Require two people to approve any new payee or any transfer above a set amount, for example $10,000.
- Never accept new bank details, or a change of bank details, by email, chat or call alone.
- Add a short waiting period for urgent, first-time international transfers.
2. Verify through a channel you control
- Call back on a number already saved in your system, never the one in the email.
- Agree on a private code word or question for senior leaders, used only for money requests.
- If a “lawyer” contacts you, look up the law firm yourself and call its main switchboard.
3. Treat secrecy as a warning sign
The requests in this case leaned on confidentiality and NDAs to stop staff from asking colleagues. Make it a written rule: no one is ever punished for double-checking a request from a senior leader.
4. Train the people who move money
Run short, realistic drills for finance and admin teams, including examples of AI voice cloning scams. People spot what they have seen before.
5. Harden email and accounts
- Set up SPF, DKIM and DMARC so spoofed emails using your domain are blocked.
- Turn on multi-factor authentication for email, banking and e-signature tools.
- Flag external emails clearly and alert on look-alike domains.
6. Prepare a response plan
If money has gone out, speed matters. Call your bank immediately to request a recall, keep all emails and call logs, and report it to the police. In the US you can file with the FBI’s Internet Crime Complaint Center (IC3). In the UAE, contact the police or use the eCrime platform.
Need help putting these controls in place? Our cybersecurity team can review your email security, payment workflows and staff training, and our AI & automation specialists can build approval workflows that make fake requests easy to catch. For a quick self-check, start with our cybersecurity checklist for small businesses in the UAE.
Frequently asked questions
What is deepfake CEO fraud?
It is a scam where criminals pose as a company’s CEO or another senior leader, using AI-generated voice or video, to trick employees into sending money or sharing sensitive data. It usually starts with an email and is “confirmed” with a fake call.
How can I tell if a video call is a deepfake?
Do not rely on spotting glitches; good fakes can look real. Instead, verify any money request through a separate, known channel, such as a callback to a saved number or an agreed code word.
Can small businesses be targeted by AI voice cloning scams?
Yes. In the case announced in November 2026, prosecutors said thousands of companies were targeted, and smaller firms where one person approves payments are especially exposed.
Protect your business today
A few simple rules can stop a multi-million-dollar mistake. Talk to TASCO IT Solutions about a fast security review for your team in the USA or the UAE. Message us on WhatsApp at +971 58 661 3940 or email info@tascoit.com.