{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2020-cloned-company-director-s-voice-used-in-us-35m-bank-transfer-fraud"},"incident":{"title":"Cloned company director's voice used in US$35M bank transfer fraud","date":"2020","date_precision":"year","victim_org":"Unnamed company and its bank; investigated by UAE authorities","sector":"Financial Services","country":"United Arab Emirates","primary_vector":"Voice Clone / Audio Deepfake","secondary_vectors":["Business Email Compromise","Vishing (Voice Phishing)"],"ai_involvement":"Suspected AI-enabled","ai_notes":"UAE investigators stated in court filings that the fraudsters used 'deep voice' technology to clone a company director's speech for the phone call. The specific tooling was not established publicly.","outcomes":["Wire Fraud / Financial Loss"],"loss_usd":35000000,"loss_note":"Up to US$35 million per UAE court documents; US$400,000 traced to two US accounts at Centennial Bank","records_affected":null,"threat_actor":null,"summary":"In early 2020 a branch manager of a Japanese company in Hong Kong received a call from a voice he recognised as a director of the parent business, who said the company was about to make an acquisition and needed transfers authorised. Emails purportedly from the director and from a lawyer named Martin Zelner appeared to corroborate the story. UAE prosecutors, who investigated the case, said in a US legal assistance request that up to US$35 million was moved and that at least 17 people were involved. Forbes obtained the court filing in 2021.","how_it_worked":"The pretext was a confidential corporate acquisition that required the branch to release large sums quickly. The channel was a phone call from a person whose voice the manager had heard before, reinforced by a parallel email thread from the same director and from an outside lawyer retained to coordinate the deal, which is a familiar and legitimising pattern in M&A work. Secrecy was built into the story, so the manager had a reason not to ask colleagues. The layered corroboration between a recognised voice and matching documentation removed his doubt, and the transfers were executed before anyone verified through an independent channel.","lessons":"Any acquisition-related payment instruction should require verification through a pre-established channel with a named counterparty, not the contact details supplied inside the request itself.","confidence":"Reported","sources":[{"title":"Fraudsters Cloned Company Director's Voice In $35 Million Bank Heist, Police Find","url":"https://www.forbes.com/sites/thomasbrewster/2021/10/14/huge-bank-fraud-uses-deep-fake-voice-tech-to-steal-millions/","publisher":"Forbes"},{"title":"Reported AI-Cloned Voice Used to Deceive Hong Kong Bank Manager in Purported $35 Million Fraud Scheme","url":"https://incidentdatabase.ai/cite/147/","publisher":"AI Incident Database"}],"entry_type":"incident","slug":"2020-cloned-company-director-s-voice-used-in-us-35m-bank-transfer-fraud","year":2020,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2020-cloned-company-director-s-voice-used-in-us-35m-bank-transfer-fraud"}}