The $35 Million Phone Call: How a Cloned Voice Became the UAE's Favorite Scam

The $35 Million Phone Call: How a Cloned Voice Became the UAE's Favorite Scam

In early 2020, a bank manager in the UAE took a call he had no reason to doubt. The voice on the line belonged to a company director he had spoken with many times before — same cadence, same accent, same turns of phrase. The director explained that his company was about to close an acquisition and needed $35 million moved, urgently. To back up the call, the manager also received emails from the director and from a lawyer representing the deal, laying out exactly where the money should go.

He authorised the transfer. The voice was fake.

According to US court documents later uncovered by Forbes, investigators in Dubai believe fraudsters used "deep voice" technology to clone the director's speech patterns well enough to fool someone who knew him personally. The $35 million moved through accounts in multiple countries, with roughly $400,000 of it traced to two accounts in the United States. Dubai's Public Prosecution Office asked American authorities for help tracking the money. As of the latest reporting, no one has been identified or charged.

Six years later, the case reads less like a one-off heist and more like an early warning. The tools that made it possible — AI voice synthesis that once required a well-resourced criminal operation — are now available to almost anyone, and the UAE is seeing the consequences play out across its banks, businesses, and government services.

From a Rare Heist to a Routine Tactic

The 2020 case needed real engineering: the fraudsters had to obtain recordings of the director's voice and build a convincing clone, likely with real-time or near-real-time synthesis, which was still a frontier technique at the time. Today, consumer-grade voice-cloning tools can produce a usable fake from a few seconds of audio pulled off a LinkedIn video or a voicemail greeting, and generate it in seconds rather than requiring specialist skills.

That shift shows up in the data. Khaleej Times, citing a 2026 study by insurer QBE, reported that 21% of UAE organisations experienced an AI-linked cyber incident in the past 12 months — slightly below the 29% global average, but still a sign the problem has moved well past isolated incidents. The same reporting flagged deepfake audio and video as among the fastest-growing tactics behind business email compromise and executive impersonation scams, alongside a separate industry survey finding more than half of finance professionals globally say they've been targeted by a deepfake attempt, with a significant share admitting they were fooled.

Khaleej Times has also cited Deloitte data showing deepfake content across social platforms grew by roughly 550% between 2019 and 2023 — a reminder that the raw material for convincing fakes (your face, your voice, your mannerisms) is now sitting in public view for almost everyone with a social media presence.

When the Government Becomes the Impersonation Target

The UAE's deepfake problem isn't confined to corporate wire fraud. In September 2026, the Ministry of Human Resources and Emiratisation (MOHRE) issued a public warning — reported by Khaleej Times and Gulf News under the campaign line "Don't be fooled. What you see may not be real" — after scammers began circulating fabricated videos, voice notes, and images designed to look like they came from ministry officials. Some messages falsely claimed a recipient's employment contract had been terminated, pressuring them into handing over personal or banking details. MOHRE's advice was blunt: don't trust a video or voice clip just because it looks and sounds authentic, and verify any request through the ministry's official call centre, app, or website rather than responding directly to the message.

That followed earlier Khaleej Times coverage of scammers impersonating UAE officials more broadly, and sits alongside the Ministry of Interior's "Safe UAE Through Your Digital Awareness" campaign, run with Dubai Police and the Dubai Electronic Security Centre, which has been pushing public education on exactly this kind of manipulated media.

The scale of the broader threat environment gives context for why: UAE cybersecurity officials have said the country faces more than 200,000 cyberattacks a day, with Dubai, Abu Dhabi, and Sharjah absorbing nearly 60% of that volume and government entities the single most targeted sector, according to figures presented at GITEX Global 2025 by Dr Mohammed Al Kuwaiti, head of UAE government cybersecurity. Deepfakes are increasingly one tool in that much larger volume of attempts, not a separate phenomenon.

Why Voice Is the Weak Link

Humans are built to trust voices. We recognise people we know almost instantly by tone and rhythm, and that recognition happens below the level of conscious scrutiny — which is exactly why a cloned voice is so much more dangerous than a phishing email. A suspicious email can be reread, its links hovered over, its sender address checked. A phone call demanding urgency rarely gets that treatment, especially when the voice sounds right and corroborating emails have already arrived, as they did in the 2020 case.

Security researchers increasingly recommend that organisations treat "I heard a familiar voice ask for this" as insufficient verification on its own, particularly for anything involving money movement or credential sharing. The practical defences being pushed by UAE banks, regulators, and awareness campaigns boil down to a few habits: never act on a financial request from a call or voice note alone, always verify through a separate, known channel (calling back a saved number, not one provided in the suspicious message); treat urgency and secrecy as red flags rather than reasons to move faster; and assume that any voice, video, or image can now be fabricated convincingly enough to fool someone who knows the real person well.

The Takeaway

The 2020 Dubai case was striking because it was rare — a sophisticated, resource-intensive attack on a single high-value target. What's changed by 2026 is that the same underlying technique no longer requires rarity to work. It's cheap enough to run against job seekers, residents, and employees, not just banks closing eight-figure deals. The UAE's response — public ministry warnings, awareness campaigns, and regulator-tracked incident data — suggests the country is treating this as infrastructure-level risk rather than a one-off crime story. For residents and businesses, the lesson from that $35 million phone call hasn't expired; if anything, it's more relevant now than it was the day it happened.