Three individuals stand accused of orchestrating a $129 million theft by using artificial intelligence to impersonate corporate executives and legal counsel. The case, disclosed on 09 November 2026, highlights a shift in how criminals target businesses. Instead of simple phishing emails, they are now using deepfakes (realistic AI-generated audio and video) to bypass traditional security layers and human intuition. For a UK SME, this represents a significant escalation in risk because it targets the one thing most businesses rely on for high-level decisions: the voice of the boss.
The mechanics of a $129 million AI heist
The scam reported this week was not a single event but a sophisticated programme of impersonation. The attackers used AI to clone the voices and appearances of CEOs and lawyers, creating a digital facade that was indistinguishable from the real people. They then contacted finance departments, claiming an urgent and confidential legal matter required immediate fund transfers. Because the 'CEO' was on the phone and the 'lawyer' followed up with a video call, the staff involved felt they were following legitimate, high-priority instructions.
This is a leap beyond traditional Business Email Compromise (BEC). In a BEC attack, a criminal might gain access to an email account and send a fake invoice. In a deepfake scam, they create a multi-sensory experience that exploits the psychological pressure of an 'urgent' request from a superior. If your finance manager hears your voice on the phone giving a direct instruction, they are conditioned to act. The technology required to do this is no longer the stuff of Hollywood; it is widely available, often for a small monthly subscription fee.
The price of misplaced trust in a UK firm
While $129 million is a figure associated with global corporations, the logic of the attack applies to any business with a bank account. Consider a 45-person engineering firm in the Midlands. If a criminal clones the Managing Director's voice using audio from a recent YouTube interview or LinkedIn video, they can target the FD with a request to move £45,000 for a 'time-sensitive equipment purchase'.
In this scenario, the financial damage is only the starting point. You have the immediate loss of the £45,000, which may not be covered by standard professional indemnity insurance if the transfer was 'authorised' by a staff member. Then comes the cost of the forensic investigation, which can easily reach £10,000 to £15,000 to determine how the breach occurred. Finally, there is the reputational damage and the inevitable spike in your cyber insurance premiums. For many small firms, a £70,000 total loss is not just a bad quarter; it is a threat to the survival of the business.
Who is exposed and how to check your process
A pattern we see on most tenants we take on is that while the technical gates like Multi-Factor Authentication (MFA) are often in place, the internal process for changing bank details still relies on a single point of failure: trust in a voice or an email address. If your organisation does not have a written, enforced protocol for out-of-band verification, you are exposed.
To check your exposure, ask your finance team how they would handle a phone call from you asking for an urgent payment to a new vendor. If their answer is 'I would just do it because it is you', your business is vulnerable to AI cloning. You should also check your public footprint. Any video or audio of senior staff online, whether from a webinar, a podcast, or a local news interview, provides the 'training data' a criminal needs to clone a voice in under 30 seconds.
Five steps to defend against AI fraud
Protecting your firm requires a combination of technical controls and rigid human processes. These actions should be prioritised immediately:
- Establish out-of-band verification. Any request for a payment or a change in bank details must be confirmed via a second, independent channel. If the request comes via phone, confirm it via a known-good email or a pre-agreed internal messaging app. Never use contact details provided in the suspicious request itself.
- Implement a 'Code Word' system. For high-value or urgent transfers, use a non-digital verification method. A simple, unwritten code word known only to key executives and the finance team can instantly invalidate a deepfake attempt.
- Turn on advanced email security. Use systems that scan for the hallmarks of impersonation, such as domains that look similar to yours (e.g., blackshcep.co.uk instead of blacksheep.co.uk) or headers that indicate the mail originated from an unexpected location.
- Update your cyber security training. Staff need to know that 'seeing is no longer believing'. Show them examples of AI voice cloning so they recognise how convincing it is. The goal is to move from a culture of 'helpfulness' to one of 'professional scepticism'.
- Review your Domain Security (SPF, DKIM, DMARC). While deepfakes are the headline, they often start with a simple spoofed email to set the stage. Ensuring your domain records are set to 'reject' unauthorised mail makes it harder for criminals to build their narrative.
The regulatory and insurance dimension
The Information Commissioner's Office (ICO) and the National Cyber Security Centre (NCSC) are increasingly clear that businesses must take 'appropriate technical and organisational measures' to protect data and funds. If a deepfake scam succeeds because you had no verification process in place, you may find yourself in breach of GDPR principles regarding integrity and confidentiality. Furthermore, insurance providers are beginning to exclude losses caused by 'social engineering' unless specific controls, such as two-person authorisation for payments, are documented and followed.
Passing Cyber Essentials is a good start, as it forces you to look at access control and malware protection, but it does not specifically cover the human process of bank transfer verification. You must go beyond the basic checklist to account for the reality of AI-driven fraud.
A shift in the standard of verification
It is remarkably difficult to argue with your boss when they sound exactly like themselves and are asking you to help them close a deal. This is the psychological lever the $129 million scam exploited. As a business owner, you have to give your staff permission to be 'difficult'. You have to tell them that you will never be angry if they hang up and call you back on your mobile to verify a request. In the era of AI, the only way to prove you are you is to have a process that exists outside of the digital world.
How Black Sheep Support helps
We help UK SMEs build the technical and procedural defences needed to stop AI fraud before it reaches a staff member's ears. We don't just 'do IT'; we look at the way your business actually moves money and data to find the gaps that criminals exploit. If you are concerned that your current setup would not stand up to a deepfake attempt
and we will help you map out a more secure process. Not ready to talk yet? Run our free IT Health Check to assess your business risk and security posture: 30 to 60 minutes with one of our engineers on a Teams call, or 15 to 20 minutes on your own, no commitment. We also handle hardware, broadband, mobile and networking, ensuring your entire infrastructure is as resilient as your security protocols.
Want this handled for you? See Cyber security services.
Based in Brighton or Hove? We are too: see IT support in Brighton.
Free, no sales call needed
Two free checks. Know where you stand.
Domain email check
Can someone send email pretending to be you? Is your real email landing in junk? Type your domain and find out in under a minute.
IT Health Check
A short set of questions that scores your security and business risk, and tells you what to fix first. 15 to 20 minutes on your own.
