This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
In March 2019, fraudsters used AI-based voice synthesis software to impersonate the CEO of a German parent company, successfully deceiving a UK-based subsidiary executive into transferring €220,000 to a fraudulent account. The attackers attempted a second transfer later that day, but the victim became suspicious due to the caller's use of an Austrian phone number. This incident is cited as one of the first documented cases of cybercrime involving AI-driven voice spoofing.
Fraudsters allegedly used AI voice technology to impersonate the boss of a UK-based firm's CEO, demanding a transfer of €220,000 over the phone.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
The incident involved fraudsters using AI voice-cloning technology to impersonate a CEO and execute a targeted financial scam against a specific company executive.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The financial fraud was executed by human actors who intentionally utilized a deployed voice-generation AI tool to deceive the victim.
Added categories peak at 2: Minor (Psychological Harm, Inferred)
In March 2019, fraudsters executed a pioneering AI-enabled voice-spoofing attack to impersonate a German CEO, defrauding a UK energy subsidiary of 220,000 Euros. While representing a significant evolution in synthetic media cybercrime and corporate social engineering, the incident had negligible direct impact on national security, critical infrastructure, or state sovereignty.
The report describes the AI as 'voice-generating software' used by hackers to mimic a specific voice. The software performed a specific, well-defined function of synthesizing audio based on inputs, operating as a tool under human control.
Risk Level 3: Limited Risk. The system is an AI-generated content tool (audio deepfake/voice generator). The report describes 'AI-based software to successfully mimic the German executive's voice' which falls under 'AI-generated content such as deepfakes'.
The AI system's primary function was to synthesize and generate a realistic human voice to impersonate the German executive.
The report clearly outlines the facts of the incident, including the amount stolen, the method of deception (AI voice spoofing), and the parties involved. There is minimal ambiguity regarding the role of the AI as a tool for fraud.
None. The incident is a straightforward case of AI-enabled financial fraud.
Technology
Commercial Voice-Generating Software
Attackers used commercial software to easily mimic the executive's voice.
Inadequate Cybersecurity Tools
Traditional security tools cannot detect or block spoofed voices.
Data Inputs
Publicly Available Voice Recordings
Attackers can use public audio of executives to train voice-cloning software.
Human Factors
Trust in Voice Familiarity
The CEO trusted the caller because of the familiar German accent and melody.
Response to Urgency
The caller demanded payment within an hour, creating pressure to act quickly.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
