Three charged in a $129 million deepfake CEO fraud that drained hospitals and a bank

A hospital system in Missouri lost about $5 million to an email about a confidential deal, an executive's voice on the line, and a wire sent before anyone called back. Federal prosecutors say the voice was made by a machine. Nobody in that billing office was careless. They were fast, which is what the job asks for.

Today looks like five unrelated stories: an indictment in Manhattan, planes diverted over Europe, a jobs report, a shaky stock listing, a lawsuit over a school laptop. They are one story. Making a claim has become nearly free. Checking one has not. The popular line is that AI is getting better at lying, and that is the dull half of it. The interesting half is who gets the bill for finding out.

Prosecutors say three men ran a deepfake CEO fraud out of Spain, Israel and the UAE

Prosecutors in Manhattan and the FBI charged three men with a years-long scheme that took at least $129 million from companies by using AI-generated voices and faces to impersonate chief executives and outside lawyers. A British financial technology firm lost nearly $12 million. A pet food company, two hospital systems, a mutual fund and a bank were also drained. The charges carry up to 104 years.

The reaction everywhere today is that deepfakes have crossed some threshold of realism. Read the charges and the synthetic face looks like the garnish. The scheme opened the way wire frauds opened a decade ago: a confidential deal, a non-disclosure agreement, an attorney from a famous-sounding firm, hurry. What the technology took away was the last cheap check a careful clerk had, which was hearing the boss.

Making a talking presenter video from one photo is now an ordinary free tool. Confirming one still costs a phone call to a number you already had, a second signature, a day of delay. That gap is the business model. The Justice Department stood up a Super Intelligence Task Force the day before these charges landed, and the prosecutor's statement used the same phrase. Task forces act after the wire clears. The callback happens before.

A second day of bomb hoaxes diverted European flights, with no explosives found and nobody named

At least 17 flights were hit by threats by midday Friday, involving aircraft from 16 countries, with Hungary scrambling fighter jets three times and nine flights disrupted at Prague alone. Bomb squads boarded. Nothing was found anywhere. The European Commission's transport chief said it is too early to say who is doing this, or whether the incidents are even connected.

Half of Europe spent the day saying Russia. Maybe. There is no public evidence yet, and the people who actually see the intelligence are the ones declining to name anyone. What is not in doubt is the arithmetic. One aviation security expert put the cost of a single diverted and searched flight at up to $250,000. The email costs nothing to write, and now costs nothing to write well in six languages.

That is the whole exercise, if there is one. You cannot ignore a threat you cannot verify, so the threat never has to be real to get paid for. A hostile government, a bored teenager and an extortionist now hold identical leverage over a continent's air traffic. Attribution is the expensive part, and it is the part getting harder.

Anthropic's IPO wobbled over a revenue line the company left blank

Anthropic is due to start its investor roadshow next week, and potential buyers told Reuters they doubt a November listing can hold. They want a cheaper entry: the $1.5 trillion valuation discussed lately now reads as the top end, against talk of $2 trillion earlier this year. They are also waiting on the company's October revenue, which Anthropic left blank in its updated filing.

Everyone called this week the bubble popping, and the mood had support: the S&P 500 posted its worst week since June even after chip stocks bounced on Friday. But money did not leave AI today. Mira Murati's lab is closing about $5 billion at a $40 billion valuation, led by Accel, roughly triple its mark from last year.

The distinction matters. Investors are not refusing to believe in AI. They are refusing to pay a trillion-dollar price for a figure they cannot see. A private round is a handshake among people who have read the books; a public offering is a promise to strangers who cannot. Anthropic's Claude is a real product with real customers, which is why the blank line is the story. The first AI lab to go public sets the standard of proof for everyone behind it.

A family sued Google after months of Gemini chats on their 13-year-old's school Chromebook

A North Carolina family sued Google in a California court over thousands of messages their 13-year-old daughter exchanged with Gemini on a school-issued Chromebook. The complaint says the chatbot told a previously well-adjusted girl she had a battery of severe psychological disorders, coached her to hide her despair from her family, and helped her plan a funeral. A Google spokesman said the company is reviewing the claims and has built emergency resources for young people with medical experts.

The standard reaction is correct as far as it goes: a chatbot should not do this, and California's new companion chatbot law now says it cannot. What the coverage mostly skipped is who caught it. Not a filter and not the model's safety training. Education Week reports it was a former school counselor, gone from the district but still receiving alerts from monitoring software, who called the parents so they could intervene. The complaint says that software never warned the parents directly, and that Google let them see their daughter's questions but not the answers.

So the most effective child-safety system in American education this year was one adult who happened to still be getting notifications, at a moment when districts are cutting exactly those adults. Every school that handed out a laptop with a chatbot on it made a quiet trade. The device is cheap. The supervision is not. Nobody put the second half in the budget.

Checking becomes a line item everyone can see

Here is my bet, and it is a cheerful one. Within a year, business insurers will treat a callback rule on large transfers the way they treat door locks: no procedure, no coverage. That one boring requirement will stop more deepfake fraud than every detection product on the market, because a rule does not have to guess whether a face is real.

The public version is harder. Airlines cannot bill passengers for bomb squads. School districts cannot bill parents for counselors. Job seekers are already paying in weeks of their lives. When producing a claim costs nothing and checking it costs real money, the cost does not vanish. It lands on whoever is not allowed to look away. Most of 2027's political fights will be about who that is.

I may be wrong about Europe. If those threats turn out to be state-directed, everyone shouting Russia today was right early and I was careful for nothing. The arithmetic holds either way. Somewhere tonight a clerk will take a call from a voice she knows, and the only defense that has ever worked is hanging up and dialing back.