The request comes from senior management, concerns a confidential transaction and must be carried out within hours. Then a video call begins: the face looks right, the voice is familiar and a supposed lawyer confirms the instructions. For someone working in finance, the question is whether that conversation is enough to authorise the payment. The answer needs to be established before the call arrives.
On 5 November 2026, the US Attorney’s Office for the Southern District of New York announced charges against three people over a scheme that allegedly defrauded companies in several countries of approximately $129 million. According to the announcement, between 2024 and 2026 the defendants allegedly imitated executives’ voices and images and assumed lawyers’ identities, presenting confidential financial transactions and providing accounts for transfers. The arrests took place between June and September: the news is the announcement of the charges, rather than the start of the alleged conduct. The defendants are presumed innocent. [1]
Associated Press reported the case, describing the sequence involving contact from the fake executive, a call and the involvement of the fake lawyer. This is journalistic reporting of the allegations, rather than independent verification of each transaction. [2]
When confidentiality prevents verification
An acquisition or negotiation may require discretion. The word “confidential” alone therefore does not indicate fraud. It becomes a point to clarify when it is used to exclude every internal confirmation: do not call the finance director, do not involve your colleague, do not use the normal approval process.
The company should establish who can confirm a sensitive transaction even when few people know its details. The check can cover only the authenticity of the instruction and the authority to approve payment, without disclosing the substance of the negotiation. If every person who could verify it is excluded at the caller’s request, the employee carrying it out is left alone at the most sensitive stage.
A clear rule can require an already designated second authoriser for exceptional transactions and documentation of any exception through an agreed corporate channel. Its effectiveness also depends on management’s behaviour: a procedure that the owner routinely asks staff to bypass will be difficult to enforce when someone impersonates them.
A second person may be part of the same deception
The presence of a lawyer, adviser or another executive appears to provide additional confirmation. But it is necessary to ask how that person was reached. If the name, address and appointment all come from the first interlocutor, the second contact remains within the same chain of information.
A useful check starts with contact details already verified or obtained independently from the organisation concerned. For an external professional, the firm can be asked through its official switchboard to confirm the person’s identity and involvement in the assignment. The professional’s existence does not establish that they are participating in that particular transaction.
In its guidance on business payment fraud, the FBI recommends verifying transactions and changes to payment instructions in person or through a known telephone number. In the context of a call that may involve impersonation, this principle should form part of a process that also includes documented confirmations and a second authoriser. [3]
The transfer needs a verifiable explanation
Before execution, the person checking should be able to connect the amount, beneficiary, payment purpose and authorisation. If the recipient is a different company from the one expected, its role needs a documented explanation. A foreign account does not establish wrongdoing; the absence of a comprehensible reason for paying it leaves a check unresolved.
Record who requested the payment, when, through which channel and who confirmed it. If doubt arises, the request can be paused for the time needed to obtain confirmation, using the pre-established internal contacts. Commercial urgency should be managed by those responsible for the decision, without turning into pressure on an individual employee.
If the money has already been sent and a suspicion emerges, contact the bank immediately to report the potentially fraudulent transfer and ask what action remains possible: IC3 guidance calls for a prompt request to recall funds. Original messages, instructions and transaction details should also be preserved, coordinating subsequent steps with company management and the competent authorities; recovery is not guaranteed. [3]
GRISK can support the verification of external interlocutors and the documentary reconstruction of suspicious payment requests, gathering information useful for further investigative work.
Sources and editorial note
The federal announcement of 5 November 2026 was read directly; the AP article was read in its KSAT republication. The announcement uses “super intelligence”, while AP uses “artificial intelligence”: insufficient technical information is available to independently characterise the tools used. The attached indictment was not examined; the alleged conduct concerns 2024–2026 and has not been conclusively established. The organisational guidance reflects the article’s assessments. The IC3 reference dates from 2020 and does not concern this case.
- U.S. Attorney’s Office, Southern District of New York, “Three Foreign Nationals Arrested And Charged With Scheme To Use Super Intelligence To Defraud Companies Of $129 Million”, 5 November 2026. Primary source; announcement of allegations.
US Attorney’s Office announcement - Associated Press, “3 charged in scheme to use AI to impersonate CEOs and attorneys to steal $129 million”, republished by KSAT; page dated 5 November 2026, 20:33, with no time zone specified in the text consulted. Consulted on 6 November 2026.
Associated Press report on KSAT - FBI/IC3, “Cyber Criminals Conduct Business Email Compromise through Exploitation of Cloud-Based Email Services, Costing US Businesses More Than $2 Billion”, 6 April 2020. Primary methodological source, consulted on 6 November 2026.
FBI/IC3 guidance