AI Voice Cloning Enabled $129M Global BEC Operation, Three Indicted in SDNY

The indictment details a repeatable workflow: spoofed executive emails triggered urgent confidential transactions, followed by AI-cloned voice or video calls that referred victims to a second-layer attorney impersonator holding a handwritten script. Victims ranged from U.S. hospital systems and a Rhode Island bank to a UK fintech and Massachusetts mutual fund; funds were then laundered through multiple crypto exchanges. Court records show Hazan’s 2008 bank-fraud conviction and the defendants’ use of nicknames tied to prior money-mule networks, indicating operational continuity rather than a novel threat actor.

Primary evidence consists of the sealed SDNY docket, victim wire records, and blockchain tracing that mapped proceeds to wallets controlled by the trio. Official statements emphasize “weaponized AI” yet provide no model attribution, no exploit chain, and no confirmation of independent technical verification of the voice clones—leaving open whether commercial tools or custom fine-tuned models were employed.

This case sits inside the documented expansion of AI-enhanced BEC documented in 2023-2024 incident reports; the missing element in coverage is the absence of any procurement or dark-web sourcing data that would show how the actors acquired or trained the synthesis systems. Expect rapid iteration: once one group demonstrates reliable ROI, copycat operations using the same call-script-plus-crypto pattern will proliferate within months.

Defensive response will center on mandatory out-of-band verification for any wire request above threshold values and expanded crypto tracing mandates; firms that still rely solely on voice-match or video presence will face repeated losses.