FBI warns of AI-generated voice messages impersonating senior US officials

On 15 May 2025 the FBI issued a public service announcement warning that malicious actors were impersonating senior US officials using text messages and AI-generated voice messages. The bureau said the campaign had been running since April 2025 and was aimed largely at current and former senior federal and state officials and the people in their contact lists.

What happened

According to the announcement, the messages claimed to come from a senior official and were meant to build rapport before the sender tried to get into the recipient's personal accounts. One method was to send a malicious link presented as a move to a different messaging platform.

A follow-up FBI alert dated 19 December 2025 said related activity reached back to 2023 and had impersonated state, White House and Cabinet-level officials as well as members of Congress. It added that first contact usually came by SMS, followed by a request to continue on Signal, Telegram or WhatsApp.

Impact

The FBI warned that a compromised account belonging to an official could be used to reach other officials and their associates through trusted contact details. The number of people who received messages was not disclosed; Reuters reported that the FBI did not immediately answer its question on that point.

Response

The bureau told recipients to find a phone number for the supposed sender independently and call to confirm, never to hand over a two-factor code, and to agree a secret word or phrase with family members.

Lessons for security leaders

• Voice is no longer proof of identity. Any request arriving by voice note or unexpected call from an executive needs a callback on a number already on file.
• Brief board members, executives and their assistants specifically, since their personal phones and messaging apps sit outside corporate controls.
• Treat a request to switch to a new messaging app as a warning sign in its own right, and say so in awareness training.
• Make sure the incident process covers reports that arrive through personal devices, not only corporate mail.