Fraud is among the top searches in Saudi Arabia today, Tuesday, November 10, 2026. Five days ago, US federal prosecutors in New York announced charges against a ring that used AI to clone the voices and images of chief executives and lawyers, and talked employees into wiring more than $129 million, about SAR 483 million, between 2024 and 2026. The lesson for any business: never send money because the voice sounds like the boss. Every transfer request outside the normal process gets confirmed by a call you place to a number already on file, plus a second person's approval, with no exception for confidential deals. (We covered the broader picture in our article on deepfakes and AI fraud, and fake emails in our article on phishing emails.)
What happened, by the numbers
On Thursday, November 5, 2026, the US Attorney's Office for the Southern District of New York unsealed an indictment against 3 people arrested in Spain and the United Kingdom, whose extradition requests are pending. Everything in the indictment is an allegation not yet proven in court. The release named 6 victim companies among others:
- A hospital system in Missouri: $4,829,580.
- A bank in Rhode Island: $2,684,580.
- A hospital system in California: $2,968,497.
- A financial technology company in the United Kingdom: $11,578,474.
- A mutual fund company in Massachusetts: $4,639,918.
- A pet food company in Florida: $5,242,747.
Those six alone add up to roughly $31.9 million. Notice that the victims were not careless small shops: they include a bank, a fintech and a fund manager, organizations with finance teams and controls.
How the call plays out, step by step
According to the prosecutors' release, the script repeated in the same order:
- The CEO calls: the fraudster poses as the chief executive, uses AI to mimic their voice or image on the call, and asks the employee for help with a confidential financial transaction.
- The lawyer steps in: the fake CEO tells the employee to contact lawyers at major international law firms working on the deal, and the fraudsters impersonate those lawyers too.
- The transfer: the fake lawyer directs a large wire to a bank account controlled by the ring, in countries including the US, Spain, Portugal, Greece, the UAE, Singapore, Austria, Slovakia and China.
- The cover-up: once the money lands, it is converted into cryptocurrency to hide its source.
The most telling detail: one defendant kept a handwritten script titled Lawyer Call, with language designed to convince employees not to discuss the calls with colleagues. Secrecy is not a side detail of this fraud. It is the tool that switches off every internal control.
Why recognizing the voice is not enough
The advice to listen carefully no longer works. The FBI Internet Crime Complaint Center's 2025 Annual Report says AI-made synthetic content is getting harder to detect and easier to produce, and that voice cloning is used to request wire payments. In 2025 alone:
- The center received 22,364 complaints that mentioned AI, with losses of $893,346,472.
- Businesses reported more than $30 million lost to business email compromise schemes involving AI.
- Business email compromise overall cost $3,046,598,558 across 24,768 complaints.
These are US figures, but the method has no borders, and the ring's own accounts included the UAE. In Saudi Arabia, the Saudi Central Bank notes that fraud methods vary but the goal is the same, stealing your money or using your bank account for illegal transactions, and it advises taking information from official sources only. Inside a company, the official source is a number you already have on file, not the number that called you.
5 rules that protect your company's transfers
- Call-back is mandatory. Any transfer request by phone, video or WhatsApp, even in the CEO's voice, is confirmed by a call the employee places to the CEO's number in company records, never by calling back the same number or joining a meeting link the requester sent.
- No exception for secrecy. Write it into company policy: no confidential deal is exempt from the approval process. Tell your team the real CEO will never ask them to hide a transfer from the finance manager. Any request not to tell colleagues means stop immediately.
- Two approvals above a threshold. Set an amount above which a transfer needs a second approver who was not on the call, ideally enforced in your finance system and your bank account permissions, not just written in a manual.
- An internal verification word. Agree with everyone who can request transfers on a question or word used only for payment requests and never written in email or chat. A fraudster can clone a voice, but cannot know what they never heard.
- Report within hours, not days. If money has gone, call your bank at once and ask them to stop it. In 2025 the FBI's Recovery Asset Team worked with banks on 3,900 incidents and froze $679,013,183, a 58% success rate, and the main factor was how quickly victims reported.
The Origami view
We read this case as a process problem more than a technology problem. The ring did not hack any victim's systems. It exploited one thing: an employee who could move money alone and who obeyed a voice they knew. Once faking a voice and face becomes cheap, the only rule that holds is one that does not depend on the employee judging what they hear.
That is why, when we build custom accounting, procurement or payment systems for Saudi businesses, we put the approval path inside the system itself: amount limits, a second approval, and a log of every request and who approved it, so no convincing call can bypass it. If you want a review of your payment approval workflow, contact us or see our services.
Bottom line: what to do this week
- Gather everyone who can send or approve payments and walk them through this case in 10 minutes.
- Put the call-back rule and the no-exception-for-secrecy rule into a written policy the team signs.
- Check your bank account permissions: can one person send any amount without a second approval?
- Save your bank's fraud line with the finance team before you need it.
Sources
- US Department of Justice, US Attorney's Office for the Southern District of New York — release of November 5, 2026: the charges, the CEO and lawyer impersonation method, the six companies' losses and the countries where accounts were opened.
- FBI Internet Crime Complaint Center — 2025 IC3 Annual Report: AI-related complaints and losses, business email compromise losses, and fund freeze results.
- Saudi Central Bank — warning on suspicious messages and calls: impersonation methods and their aim, and the advice to rely on official sources.
Frequently asked questions
How can I tell if a call in my CEO's voice is fake?
Often you cannot tell from the voice, because AI now imitates it closely. Judge the request instead: an urgent transfer, a confidential deal, a request not to tell colleagues, or a payment outside the normal process. Any one of these means ending the call and phoning the CEO on the number on file.
Can the fraudster use a video call, not just a voice call?
Yes. The US Justice Department release says the ring mimicked executives' voices or images on calls. So do not treat video as enough proof, and apply the call-back rule to every transfer request whatever the channel.
What should I do if my employee has already sent the money?
Call your bank immediately and ask them to stop and recall the transfer, then document everything: the caller's number, the call time and the messages. Speed matters: in 2025 the FBI team and banks froze more than $679 million across 3,900 incidents because reports came in early.
Does this fraud only target large companies?
No. The six companies in the release range from hospitals and a bank to a pet food maker, and the same method works on any business where one employee can send money alone. A small business can be more exposed, because staff know the owner's voice well and there is no second approval.
