The UAE's US$35 Million Deepfake Voice Fraud and What Followed

The short version

The best-documented deepfake case connected to the UAE is the January 2020 fraud first reported by Forbes in October 2021. A branch manager received a call from what sounded like a company director he knew. Emails from the "director" and from a lawyer named "Martin Zelner" backed up the call.[1] The manager was persuaded to transfer about US$35 million for a supposed acquisition.[2][3] UAE investigators told US authorities that "deep voice" technology was used and that at least 17 people were involved.[2][3][4] Much remains unconfirmed, including who the victim was and where the manager was based. I found no confirmed later UAE case in which deepfakes were used specifically against lawyers, law firms or bankers. UAE authorities have since issued repeated deepfake warnings and tightened banking authentication rules.

What the court filing says

The case became public through a US court document. Dubai's Public Prosecution Office had asked American authorities, through a mutual legal assistance request, for help tracing part of the money.[3][5] The application was filed in the US District Court for the District of Columbia.[4] Forbes journalist Thomas Brewster found it and reported on it on 14 October 2021.[2][3][6]

The filing, as quoted in reporting by Forbes and CommsRisk, states:

On 15 January 2020, the "Victim Company's branch manager received a phone call that claimed to be from the company headquarters. The caller sounded like the Director of the company, so the branch manager believed the call was legitimate."[3]
The manager also received emails he believed came from the director. The caller said the company was about to acquire another company and that "a lawyer named Martin Zelner (Zelner) had been authorized to coordinate procedures for the acquisition."[3]
Emails from "Zelner" followed, including "a letter of authorization from the Director to Zelner." When Zelner asked the manager "to transfer USD 35 million to several accounts as part of the acquisition, the branch manager followed his instructions."[3]
"The Emirati investigation revealed that the defendants had used 'deep voice' technology to simulate the voice of the Director."[3][4]

UAE investigators described "a complex scheme involving at least 17 known and unknown defendants." The money went to accounts in several countries.[4] The specific US request concerned about US$400,000 that had gone to accounts at Centennial Bank in the United States.[2][5][7]

What is established

A UAE prosecuting authority formally told a US court that a cloned voice was used to authorise transfers of about US$35 million. This is the investigators' own finding, made in a legal filing, not a security vendor's claim.
The fraud combined a cloned voice with business email compromise: forged emails from the "director" and a lawyer persona, and a forged letter of authorisation.[8]
The investigation was international. Funds were spread across multiple jurisdictions, and the UAE sought US help with the US$400,000 traced there.[4][7]
When reported, it was only the second publicly known case of fraudsters using voice cloning to steal money,[4][9] after the 2019 UK energy-firm case.[2]

What remains unconfirmed or unclear

The victim's identity and location. The filing names neither the company nor the bank. Forbes' original story described a UAE bank manager speaking with a company director. After publication, the UAE Ministry of Foreign Affairs and International Cooperation told Forbes that the affected company was an unnamed Japanese business, though Dubai investigators led the probe. In May 2023 Forbes updated its story to describe "a branch manager of a Japanese company in Hong Kong."[2] The court text quoted in coverage refers to the "Victim Company's branch manager" rather than to a bank. So it is unclear whether the manager was a banker approving a client's transfer or an employee of the victim company, and whether he sat in the UAE or Hong Kong. Much secondary coverage still says "UAE bank manager."

The amount actually lost. Forbes describes the theft as "as much as $35 million."[2] How much was recovered has not been disclosed.

The role of "Martin Zelner." A US-based lawyer by that name exists. Forbes contacted him and received no response.[2] Nothing in the public record suggests he took part; the most likely reading is that his name was used as a cover identity. That inference is not confirmed.

The technology. "Deep voice" is the investigators' term. The filing does not say whether the voice was generated live or pre-recorded, or what tools were used.

The outcome. I found no public record of arrests, charges, convictions or recoveries. The Dubai Public Prosecution Office did not respond to Forbes.[2][10]

The case is often confused with the 2024 Arup fraud, partly because Forbes' updated version places the manager in Hong Kong. They are separate. Arup involved a multi-person deepfake video conference and HK$200 million (about US$25.6 million) in January 2024. The UAE case involved a cloned voice, emails and a fake lawyer, for about US$35 million, in January 2020.

Official UAE comment on the case

In the statement given to Forbes, Hamid Al Zaabi, director general of the UAE Executive Office of Anti-Money Laundering and Counter Terrorism Financing, said: "Even with incidents happening outside the U.A.E., we will work closely with law enforcement partners around the world to identify and detect those individuals who knowingly engage in deceptive practices such as imposter fraud."[2]

Other UAE cases involving lawyers or bankers

I found no publicly confirmed later case in Dubai, Abu Dhabi or elsewhere in the UAE in which deepfake video or a cloned voice was used against a law firm, a lawyer or a bank officer. Commercial websites, including UAE law-firm marketing pages, describe AI voice scams in general terms but cite no specific case. The "fake lawyer" approach does appear in US data. In August 2025 the FBI warned that fictitious law firms were targeting cryptocurrency-scam victims with offers to recover funds. Legal services also made up 18% of non-critical-sector ransomware complaints in the FBI's 2025 report.[11] Neither finding is about the UAE. For the UAE, the 2020 Zelner case remains the clearest example that fits the description of a deepfake scam involving a lawyer and a banker.

How the UAE has responded

Public warnings. In November 2025 the UAE Cybersecurity Council warned, through the state news agency WAM, that "deepfake technology is advancing rapidly with the advancement of AI tools, enabling the replication of real people's voices and appearances with high accuracy." It urged people to check content attributed to public figures or national institutions against official sources. It also restated the UAE Media Council's position that using AI to depict national symbols or public figures without prior approval breaches media content standards.[12] The Council issued further deepfake warnings in 2026, including one on 6 April that Dubai Police amplified on X.[13] In March 2026 the UAE said it faced 500,000 to 700,000 cyberattack attempts a day, some attributed to Iran-linked actors using AI tools and deepfakes. It reported a 32% rise in phishing in the first quarter of 2026.[14] In September 2026 the head of UAE government cyber security, Dr Mohamed Al Kuwaiti, said a hacker had demanded more than US$5 million after breaching a private company, and warned about deepfakes and manipulated content.[15]

Policing. At the launch of Cyber Security Awareness Month in October 2026, Dubai Police announced a dedicated AI crimes unit and a deepfake detection tool. Officials urged residents to report breaches and extortion attempts.[16] Victims can report through Dubai Police's eCrime platform.[17]

Banking rules. The Central Bank of the UAE (CBUAE) issued Notice 2025/3057 in May 2025. It requires licensed banks and financial institutions to phase out SMS and email one-time passwords and static passwords for customer authentication, with a deadline of 31 March 2026.[18] From July 2025, banks became liable for 3-D Secure card fraud where they still relied on SMS one-time passwords.[19] The notice also requires real-time transaction monitoring that can block or challenge suspicious payments.[18] Federal Decree-Law No. 6 of 2025, the new Central Bank law issued on 8 September 2025, makes strong fraud prevention and detection systems a legal duty for financial institutions.[20] Federal Decree-Law No. 10 of 2025 updates the anti-money-laundering framework.[19] The Central Bank has also set up a central Anti-Fraud Operations Centre.[21] None of these measures targets deepfakes by name. They do remove two weak points that voice cloning exploits: confidence in a recognised voice and reliance on a single verification channel.

Law. The UAE has no standalone deepfake statute as of late 2026.[22] Deepfake fraud is prosecuted under Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes, the Penal Code's fraud provisions, and the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). That law treats a person's image and biometric data as protected personal data.[23] Media Council rules cover unauthorised AI depictions of public figures.

What the case shows for banks and law firms

Each part of the 2020 fraud was something a bank or company is trained to trust: a voice the manager knew, an email trail, a lawyer coordinating a deal, and a signed authorisation. The controls that would have stopped it are the same ones recommended after Arup:

call back on an independently verified number;
require two people to approve large transfers;
confirm any lawyer's identity through the firm's published contact details, not the email thread;
treat requests for secrecy around an "acquisition" as a warning sign rather than a reason to skip checks.

Banks in the UAE are now being pushed in that direction by regulation. Law firms, which often relay payment instructions for transactions, have no equivalent sector-specific rule.