Your chief executive called. It was not him.
$129 million, three defendants and two arrests in Spain: who pays when the transfer is ordered by your own employee
May it please the Court.
New York, Thursday 5 November. The federal prosecutor's office for the Southern District unseals an indictment against three men it accuses of defrauding companies in several countries of some $129 million [10][1]. The method it describes does not require breaking into any computer system. A telephone is enough, together with the voice of a chief executive cloned with artificial intelligence and an employee willing to carry out an order. Two of the three defendants were arrested in Spain; one of them lives in Marbella [1][3].
The script, according to the indictment, was always the same. The person who orders payments receives an email from an electronic-signature service: the chief executive asks them to sign a non-disclosure agreement because a confidential transaction is under way. Shortly afterwards the telephone rings, and it is his voice. He says that the lawyer handling the transaction will give the instructions. The lawyer, from a large international firm, calls, insists that nobody else in the company must know yet and dictates the destination account [2][3].
Neither of them was who he claimed to be.
What we know and what we do not
The three defendants were arrested outside the United States, which has requested their extradition. There is no judgment and all of them are presumed innocent [2][3]. The published accounts describe a group that picked accounting staff with the authority to approve large transfers and worked from a written script designed to stop the victim from consulting anyone [2][3]. Those harmed include a British financial technology company, which lost close to $11.6 million, two hospital groups, a fund manager and a bank [1][3]. The money travelled to accounts in different countries, Spain among them, and was converted into crypto-assets [1][2].
I offer no opinion on that case, which is a matter for the courts. I am interested in another question: if the call reaches your company tomorrow, who pays?
The line that decides everything
Almost everyone believes that, if they are defrauded, the bank returns the money. That is half true, and the missing half is the one that affects companies.
Spanish payment services law requires the bank to refund an unauthorised transaction immediately, and at the latest by the end of the following business day (art. 45 of Royal Decree-law 19/2018) [5]. The Supreme Court has been demanding with banks on that ground: in judgment 571/2025 of 9 April, it upheld an order requiring a bank to repay what had been taken from a customer after a SIM card was fraudulently duplicated, and recalled that the bank is liable for unauthorised transactions unless it proves fraud or gross negligence on the user's part [8].
CEO fraud falls on the other side of the line. Nobody impersonates the company before the bank. It is the company, through its employee, with its credentials and its signature, that gives the order. A transaction is authorised when the payer has given consent (art. 36) [5], and here consent was given. Under deception, but given. In the eyes of the law, the company paid because it chose to.
Who bears the loss?
The perpetrators and whoever lent their account
- What to expect
- They are criminally liable (fraud and money laundering) and must return what was taken. In practice, by the time judgment arrives the money is gone and whoever lent the account is usually insolvent.
Your bank
- What to expect
- It is not obliged to refund an authorised payment. The discussion changes if it failed to verify the payee or if the person who gave the order was not an authorised signatory on the account.
The bank that received the money
- What to expect
- It can freeze the funds if warned in time. Claiming the loss from it requires proof that its own controls over the receiving account failed.
The insurer
- What to expect
- Only if the policy expressly covers impersonation fraud, and often with a limit far below that of the other covers.
The employee
- What to expect
- A victim of the offence, not its author. What can be demanded of them is measured against the written instructions they had.
The directors
- What to expect
- They are not liable for the fraud itself. They answer to the shareholders if there was no control at all over payments.
Frequently asked questions
What offence is it in Spain?
Fraud (estafa): deceiving another person, for gain, sufficiently to make them hand over money to their own detriment (art. 248 of the Spanish Criminal Code). The basic penalty is six months to three years in prison; one to six years and a fine if the amount defrauded exceeds €50,000, and four to eight years and a fine if it exceeds €250,000 (art. 250) [4]. That the voice was manufactured with artificial intelligence does not change the offence. It changes how believable the deception is.
And someone who merely lent their account to receive the money?
They commit money laundering: six months to six years in prison if they knew the money came from an offence, and six months to two years if they acted with gross negligence (art. 301 of the Criminal Code) [4]. They are also liable with their own assets for what passed through their account, although they rarely have any.
Doesn't the bank already check who the transfer is going to?
It does, and it is worth knowing how far that goes. Since 9 October 2025, banks in the euro area must check, before executing a transfer in euros, that the payee's name matches the holder of the destination account, and warn the payer if it does not (Regulation (EU) 2024/886) [7]. If the bank fails to run that check, it is liable. If it warns that the details do not match and the company goes ahead, the risk lies with the company. But in this fraud the fake lawyer dictates both the name and the account, and the two match: the check comes back clean because the account exists and is held in the name he gives.
Is it covered by insurance?
That depends on three clauses worth reading today. First, whether the cyber or crime policy includes impersonation fraud, which is often an optional cover. Second, the limit, which tends to be far lower than the general one. Third, the conditions: many policies require the company to have verified the order through a second channel, and without that verification they do not pay. Directors' and officers' liability insurance protects the directors against claims, but it does not replace the money transferred.
What happens to the employee who made the transfer?
They were deceived. What the company can hold against them depends on whether a written verification procedure existed and was not followed, or whether nobody had ever told them what to do when faced with an urgent, confidential order. In the second case, the blame moves one floor up.
And to those who run the company?
Shareholders, the insurer and, where applicable, the judge will ask them the same question: what control was there over payments? Spanish law requires directors to act with the diligence of an orderly businessperson and to take the measures needed for the control of the company (art. 225 of the Spanish Companies Act) [9].
The first 24 hours
The money is recovered, when it is recovered, through speed. The order matters.
- Call the bank, on its fraud line, and confirm it in writing: ask it to request the return of the transfer and to ask the receiving bank to freeze the funds.
- Report it to the police the same day, with the transfer receipt, the destination account, the emails and the call log, and ask in the complaint itself for the receiving account to be frozen as a first measure (art. 13 of the Spanish Criminal Procedure Act) [6].
- Preserve the evidence: do not delete emails or messages, keep the originals and note down times and numbers.
- Notify the insurer within the period set in the policy. Late notice is the first ground for disputing payment.
- Protect the employee. They are the main witness and the person best placed to reconstruct what happened. If they fear the consequences, they will take longer to speak up, and here every hour counts.
The protocol: seven rules that fit on one page
- Two people for every significant payment. Whoever prepares it does not approve it.
- Always call back on a number the company already had on file. Never on the one supplied in the email or in the call itself.
- New account, deferred payment. Any new or changed bank account is verified through a different channel and waits a fixed period before the first payment.
- Urgency and secrecy do not excuse checking. Not even when the order comes from the chief executive. And in writing: nobody will be penalised for hanging up and checking.
- Limits agreed with the bank. A cap per transaction and per day, joint signatures above a set amount and an alert for every new payee. And do not opt out of payee verification, not even for batch payments.
- A voice no longer identifies anyone. A control question agreed in advance for any payment order given by telephone or video call.
- One drill a year and, on the same day, a fresh read of the policy.
On the same page, the numbers to call if anyone suspects it has already happened: bank, lawyer and insurer.
My view
This fraud is not aimed at whoever gives the orders, but at whoever obeys them. It works because it asks for two things that sound reasonable in a company: urgency and discretion. And the law, today, leaves the loss where the order was given. The European payment services reform now going through the legislative process provides for the bank to refund consumers when the fraudster poses as the bank itself. Not companies, and not when he poses as your chief executive.
That is why protection lies not in claiming afterwards, but in what was written down beforehand. The protocol costs no money. It costs a decision by whoever is in charge: accepting that their own orders are checked too.
If the telephone in your accounts department rings tomorrow and the voice is yours, who has to say no?
Judgment reserved.
Sources
- CyberScoop, «Authorities accuse trio of using AI deepfakes to defraud $129M from businesses», 06/11/2026. Link
- Infobae, «Tres hombres imitaron con IA la voz de directores ejecutivos y robaron USD 129 millones a empresas», 07/11/2026 (in Spanish). Link
- Biometric Update, «Deepfake CEOs, stolen lawyer identities fuel alleged $129M fraud», 08/11/2026. Link
- Spanish Criminal Code (Organic Law 10/1995), consolidated text, arts. 248, 250 and 301. BOE. Link
- Royal Decree-law 19/2018 of 23 November on payment services, arts. 36 and 45. BOE. Link
- Spanish Criminal Procedure Act, art. 13. BOE. Link
- Regulation (EU) 2024/886 of the European Parliament and of the Council of 13 March 2024 (verification of payee, art. 5c of Regulation (EU) No 260/2012).
- Spanish Supreme Court, Civil Chamber, judgment 571/2025 of 9 April (appeal no. 1151/2023), ECLI:ES:TS:2025:1671.
- Spanish Companies Act (Royal Legislative Decree 1/2010), art. 225.
- U.S. Attorney's Office, Southern District of New York, press release no. 26-317, 05/11/2026. Link
