What Happened
A client that approves one fake payment request can lose millions, and the MSP is the one who gets the call after the money is gone. The fix is to verify every payment request through a separate channel before it moves. This EnterProtect AI impersonation fraud alert covers a scheme in which three people used AI to impersonate CEOs and attorneys and stole $129 million.
SecurityWeek reports that the trio, whose nicknames include 'Rocky Balboa,' 'Superman Cash' and 'Fat Boy,' often targeted companies' accounting departments. The Record reports that the U.S. is working on extraditing three suspects from Europe in a case involving more than $100 million in fraud from CEO impersonations. The sources do not describe the exact AI method, so do not focus on the tool. Focus on the target, the accounting department, and the trick, a believable fake of a senior person.
Why EnterProtect AI Impersonation Fraud Matters for MSPs
MSPs lose money when a client is hit. The loss can be a client, a reputation, or a legal bill. This scheme went after the people who control payments, which means a single successful call can move real money in minutes.
In general, this class of fraud works because the request is urgent, secret and from a senior person. The defense is not another security tool. The defense is a process that makes it hard for one employee to move money on a phone call alone.
Timeline
No timeline has been published yet. As of November 6, 2026, the sources report charges and extradition efforts, but they do not give dates for when the alleged fraud started or when individual transfers took place.
Who Is Affected
The scheme often targeted companies' accounting departments, according to SecurityWeek. That means the people who approve and process payments were the ones being deceived.
In general, any business that transfers money is a potential target. The sources do not name the victim companies or say how many were hit.
How This Type of Fraud Works
In general, AI impersonation fraud follows a simple pattern. An attacker collects enough information about a company to know who signs off on payments. Then the attacker uses AI to make a phone call, a voicemail or a video message that sounds and looks like the CEO, the CFO or a trusted attorney. The request is urgent, confidential and time sensitive, so the employee feels pressure to act before verifying.
The same pattern has worked for years with plain email. AI makes it more convincing and harder to question. The financial controls that stop it, verification and approval, do not change.
For MSPs, the important point is that this is a control problem, not a technology problem. A client can have the best security stack on the market and still lose money if the person on the phone sounds like the CEO.
Technical Details
No CVE, product name or software version is named in the sources. This is a social engineering attack, not a vulnerability in a specific product.
The attack vector, as the sources describe it, is the use of AI to impersonate CEOs and attorneys. The impersonation was used to deceive companies' accounting departments into transferring money. The sources do not state which AI tools or communication channels were used.
What MSPs Should Do
Treat every payment request as unverified until it is confirmed through a separate channel. Then apply these steps to every client.
- Require out-of-band verification for any payment request that comes by phone, email or chat. Call the requester back on a number you already have on file, or confirm in person.
- Set up a two-person approval rule for large or unusual transfers. No single employee should be able to move money on an urgent request.
- Train client staff to recognize urgent, secret requests from executives, especially requests that involve wire transfers, gift cards or changes to payment details.
- Create a simple callback process that executives and finance staff agree to use for sensitive requests.
- Review financial controls with clients, including who can initiate transfers and who can approve them.
- If a client suspects fraud, act fast. Contact the receiving bank, preserve call recordings and messages, and report the incident to law enforcement.
How EnterProtect Helps
EnterProtect backup keeps clean, restorable copies of client data. If a fraud incident leads to data loss, or if an investigation locks down systems, an MSP can restore from a known good copy.
EnterProtect recovery gets a client running again after an incident. That matters when finance systems are offline and the business still needs to operate.
EnterProtect vulnerability scanning finds exposed versions of software across client environments, so MSPs can close the technical gaps that make social engineering easier to pull off. It does not stop an employee from approving a fraudulent transfer. The process controls above are the real defense.
Frequently Asked Questions
What Is CEO Fraud?
CEO fraud is a social engineering attack where a criminal impersonates an executive to trick an employee into transferring money or sharing sensitive data. In this case, the impersonation was powered by AI, which makes the request harder to question. The targets are often accounting or finance staff.
How Do Attackers Use AI to Impersonate Executives?
Attackers can use AI to create realistic audio or video of a person, then use it in a phone call, voicemail or video call to make a payment request seem real. The sources in this case do not name the specific AI tools used. The effect is the same as a written request, but harder to dismiss.
Why Do These Schemes Target Accounting Departments?
Accounting departments control payments, invoices and payroll. An urgent call from the CEO asking for a wire transfer can bypass normal review if staff are not trained to verify it. The scheme reported here often targeted companies' accounting departments.
What Should an Employee Do When They Get a Payment Request From an Executive?
Stop and verify through a separate channel. Hang up and call the executive back on a known number, or confirm with a second person who has authority. No legitimate executive should mind a short delay on a large payment.
Can Antivirus or Email Filtering Stop This Attack?
No. This is social engineering, not malware. Security tools cannot tell whether a voice on the phone is really the CEO. The controls that stop it are procedural, such as out-of-band verification and dual approval for transfers.
What Should an MSP Do If a Client Falls for This Fraud?
Act quickly. Help the client contact the receiving bank to attempt a recall, preserve the call recording, messages and any other evidence, and report the incident to law enforcement. Then review the payment process so the same request cannot happen again.
Sources
- 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million (Securityweek)
- CEO-spoofing scammers indicted for using AI to help steal more than $100 million (Record)
- CEO-spoofing scammers used AI to help steal more than $100 million, feds say (Record)