According to the indictment, the ring targeted thousands of companies worldwide between July 2024 and February 2026. Its members identified finance employees with authority to approve large transfers and sent them a message posing as the CEO, sometimes through e-signature services such as DocuSign, about a secret deal such as an acquisition. The indictment says they used AI to imitate the CEO's voice and in some cases produced video deepfakes for calls. The employees were then referred to "lawyers" using the identities of real attorneys from the European offices of large firms.
Alleged victims include a UK fintech company that lost about $11.58 million, a Missouri hospital system (about $4.83 million), a Florida pet food maker (about $5.24 million) and a Rhode Island bank (about $2.68 million). One attempt, against an employee of a New York investment bank in October 2024, was stopped when the operations department blocked a transfer of about $2.85 million. Per the indictment, the money moved through accounts in the US, Spain, Portugal, Greece, the UAE, Singapore, China and other countries, and was converted into cryptocurrency.
All three defendants were arrested in recent months in Spain and the UK, and the US has requested their extradition. Each faces seven counts, including wire fraud, aggravated identity theft and money laundering. These are allegations only; the defendants have not been convicted. For organizations, the method described is a reminder to verify urgent payment requests through a separate, known channel, even when the voice or face seems familiar.