How to Stop a Fake CEO or Lawyer From Getting Your Company to Wire Money (the $129 Million Lesson)
The boss's voice on the call was perfect. The boss was not on the call.
At a glance
First step Make the call-back rule official. Any new payment, changed bank details or 'confidential' transfer gets confirmed by phone, on a number from your own records. Never one from the email, the invite or the caller.
Saves: Your company's money, and possibly your job · Tools: A phone you dial yourself; ChatGPT, Claude or Gemini to help write the rule
Example result A useful answer is a short, plain payment rule your team can follow: who can approve a wire, how a request is confirmed by call-back, and what to say to a 'CEO' who pushes back.
What to do
- Make the call-back rule official. Any new payment, changed bank details or 'confidential' transfer gets confirmed by phone, on a number from your own records. Never one from the email, the invite or the caller.
- Treat secrecy and hurry as the warning. 'Keep this between us' and 'it has to go today' are the two lines this scheme runs on. They're the cue to slow down, not speed up.
- Look up the lawyer yourself. If a 'law firm' is involved, find the firm's main number on its own website and ask for the person by name.
- Use two people for big wires. One person requests, a second approves. A crook then has to fool two people instead of one.
- Let AI write the rule, in plain words. Use the prompt below to draft a one-page payment policy, then read it with whoever signs the checks.
The prompt
A prompt is the instructions you give the AI. Anything in [square brackets] is a blank for you to fill in. First time? Start here
I run [type and size of business]. [Number] people can send payments or wires. Write a one-page payment-safety rule in plain English that everyone can follow. Include: 1) which payments need a call-back on a number from our own records, 2) who must approve large or unusual payments (we have [names of roles, not people]), 3) the warning signs of a fake CEO, lawyer or vendor request (secrecy, urgency, new bank details, a new contact), 4) a polite script for telling a 'boss' you need to call them back first, and 5) what to do in the first hour if money was sent by mistake.
- Press Copy prompt.
- Open ChatGPT, Claude or Gemini.
- Paste it into the message box and fill in the [blanks].
Keep it private. Before you paste: leave out passwords, codes, and account, card, ID and policy numbers. Swap real names for "my mother" or "the company."
Use roles ("owner," "office manager"), not names, account numbers or bank details. The AI doesn't need them to write the rule.
What to check yourself
- A voice or face on a call is no longer proof of who you're talking to. Only the call-back on a number you already had counts.
- If money has gone out, call your bank at once and ask it to try to recall the wire, then report it at ic3.gov. Speed matters.
- An AI-written policy is a draft. Have your bank or accountant check it fits how your payments actually work.
What happenedThe story behind it
On November 5, the Associated Press reported that three men had been charged in federal court in New York over a scheme prosecutors say took about $129 million from companies around the world. According to the court papers, the group emailed accounting departments pretending to be the company's chief executive, asking for help with a confidential deal. Then came a phone or video call in which, prosecutors say, AI was used to copy the CEO's voice and sometimes his image.
The fake CEO then told the employee to contact an attorney at a major law firm. That "attorney" was also the group, and he instructed the employee to wire large payments to accounts around the world. Prosecutors say the money was turned into cryptocurrency to hide where it came from. Victims named in court papers include hospital systems in Missouri and California, a Rhode Island bank, a Massachusetts mutual fund company and a Florida pet food company. All three were arrested in Spain or the UK this year and the US is seeking to extradite them, American Banker reported. They are charged, not convicted.
Not every target paid. According to the indictment, as reported by American Banker, a major New York investment bank's back office stopped a $2.85 million wire in October 2024 after an employee had already authorized it. The AI made the voice convincing. It didn't change the weak spot: a payment approved because of who seemed to be asking. A second check, and a rule that every new or unusual payment is confirmed by calling back on a number you already had, takes the voice out of the decision, whoever it sounds like.
The verdict
If the CEO wants it secret and urgent, the CEO can wait five minutes for a call back.
Sources
How sure we are: Based on published reports and official advice. We haven't tested this one ourselves. What this means