A judge called it an AI-driven fraud, but police couldn't confirm voice cloning. How the Saskatchewan grandparent scam worked and how a lawyer's call cracked it.
Social Engineering Examples·8 sources
Was it really an AI grandparent scam? A Saskatchewan judge thought so. Between late November and early December 2025, seniors in Saskatoon, Regina and the White Butte area got calls from a crying "grandchild" who needed bail money, then from a fake police officer and a fake lawyer. Cash went to a courier at the door or by Purolator. Two Quebec residents who did the pickups, Ciprian Teodor and Alexandra Condurache, were arrested on 2 December 2025 and later sentenced. At Teodor's sentencing in July 2026, the judge called him "the human face of an otherwise faceless, AI-driven fraud." Status: Convicted and sentenced.
| Stage | What victims heard |
|---|---|
| The grandchild | A crying voice saying they'd been arrested for drugs, or caused a crash with a pregnant woman, and needed bail |
| The officer | A fake police officer took over |
| The lawyer | A fake lawyer, in one case using the surname of a real Regina defence lawyer, gave instructions |
| The cover story | Tell the bank teller the cash is for a renovation contractor. Tell nobody else, there's a gag order |
| The handover | Cash in a box on the doorstep, handed to a courier, or sent by Purolator |
One senior said the voice matched her granddaughter "to perfection". That impression is the strongest evidence anywhere in the case for a synthetic voice.
Tip: a call from a grandchild in trouble? Hang up and ring them, or their parents, on a number you already have. Then decide.
One Regina woman noticed the courier had left no receipt. She called the real lawyer whose name had been used. He told her, within moments, that no lawyer asks for cash in a box on a doorstep. Separately, a Regina couple in their seventies took out cash, grew suspicious and called police before handing anything over.
Saskatoon police had already tipped off Regina about a similar spree the week before. Regina officers watched a matching vehicle, saw it collect cash from another victim's home, and arrested the pair on 2 December 2025, finding cash and other evidence inside.
| Date | Event |
|---|---|
| 24 to 27 November 2025 | Five Saskatoon reports, losses over $45,000 |
| 1 to 2 December 2025 | Five Regina victims and one in White Butte, losses over $40,000. About $20,000 later recovered |
| 2 December 2025 | Teodor (50) and Condurache (40) arrested |
| December 2025 | Condurache, mainly the driver, gets a two-year conditional sentence served in the community, plus three years' probation |
| 9 July 2026 | Teodor, who did the pickups and whom the Crown called the scam's leader, gets 18 months' jail plus three years' probation. Six of those months relate to a separate Quebec bank-card fraud where he drove for five pickups |
Restitution of $46,350 was ordered for the Saskatchewan victims: $28,100 from Teodor alone and $18,250 from both. The Crown said that was the money never recovered. Teodor's convictions covered eleven victims, each defrauded of more than $5,000. One couple lost over $25,000 in several payments. The people who made the calls were never identified.
Ten days after the arrests, Regina police Sgt. Dave Krieger said investigators were "not certain" whether the suspects cloned voices or "had just harvested key details off social media." Seven months later, Judge James Rybchuk concluded AI had been used. But he didn't say it was voice cloning, no technical basis was reported, and the facts were agreed in a joint submission rather than argued in court. Only one reporter's account of his remarks has been published.
So the lesson cuts two ways. AI voice scams are real. And "AI was used" can end up on the court record without anyone testing it. See voice cloning and vishing examples.
Unproven. The judge said AI was used but didn't mention voice cloning, and police said they couldn't confirm it.
Ciprian Teodor got 18 months' jail plus probation in July 2026. Alexandra Condurache got a two-year conditional sentence plus probation in December 2025.
Police reported over $45,000 in Saskatoon and over $40,000 in Regina and White Butte. Restitution of $46,350 was ordered for money not recovered.
A suspicious target called the real lawyer, police shared a tip, and officers caught the pair during a pickup.
Social Engineering Examples. “The Saskatchewan "AI grandparent scam": what a judge said and what police could prove (2025 to 2026)”. Accessed 3 November 2026. https://socialengineeringexamples.com/quebec-ai-grandparent-vishing-teodor-condurache-saskatchewan-2025
the callers had enough detail about elderly targets and their grandchildren to be believed, and targets described the voice as identical to their grandchild's, including mannerisms. How that was achieved is not established by any source: investigators said they were not certain whether the suspects used AI to clone family members' voices or had just harvested key details from social media, and no source describes a voice sample, a collection method, or a tool.
family-facing exposure through social media and public records is very hard to eliminate at the individual level, and the defense does not depend on knowing how the voice was produced. Partial mitigation includes limiting public posting of family voice and video and, where practical, agreeing on a family safe word in advance, but the reliable control assumes attackers already sound convincing and hardens the verification step instead, at Stage 3.
the ring built a multi-person, escalating script (panicked grandchild, then a fake police officer, then a fake lawyer) and assigned scripted roles, in at least one case borrowing the surname of a real local defense lawyer to add false legitimacy.
police public-safety releases (RCMP, Saskatoon Police, Regina Police) specifically publicized the multi-persona escalation pattern (grandchild, then police officer, then lawyer) as a recognizable fraud signature, so awareness of this exact structure is itself a documented counter-measure.
callers used the impersonated voice to describe a fabricated emergency (arrest, car accident involving injury) and induce fear and urgency before requesting bail or legal-fee money.
RCMP and municipal police publicized the core defense of hanging up and independently calling the family member back on a number already known to be theirs before taking any action or sending money, rather than trusting the incoming call.
the call was transferred mid-conversation to a fake police officer and then a fake lawyer, adding perceived legitimacy and pressure to comply.
police guidance urged treating any mid-call transfer to a supposed police officer or lawyer as a red flag rather than added legitimacy, and independently looking up and calling that person's or agency's official number, exactly as the Regina woman did when she tracked down and called the real lawyer whose name had been borrowed.
victims were instructed to keep the request secret (citing a supposed gag order), told what cover story to give a bank teller, and given specific cash-withdrawal amounts and secrecy conditions.
publicized guidance told victims to be automatically suspicious of any request for secrecy or a "gag order" and to tell a bank teller or another family member regardless of the caller's instructions; bank staff trained to probe the stated purpose of large, unusual cash withdrawals add a further check at this stage.
victims were told not to deliver money in person at a courthouse but instead to leave cash in a box on their doorstep for a courier, or to ship follow-up payments via a parcel courier service (Purolator).
police warnings specifically flagged requests to leave cash in a box for pickup or to ship it via parcel courier as a fraud indicator, since no legitimate legal or law-enforcement process works this way.
Teodor physically collected cash directly from victims' homes while Condurache drove, or the money was received via parcel service, completing the fraud; this collection step is also where police surveillance intercepted and arrested the pair mid-pickup.
the physical cash-pickup step is the fraud's most exposed and prosecutable point; in this case it was disrupted by coordinated police surveillance (acting on a cross-jurisdiction tip and a targeted senior's report) that intercepted and arrested the pair mid-pickup.
Browse by what this case has in common with others in the library.
Colombian police say 'Los Cyber' posed as bank fraud staff, got victims to share their phone screens and took COP…
JLR's 2025 cyber attack halted production for five weeks. Early reports blamed help-desk vishing; JLR's CISO later denied it. What's…
A caller posing as Standard Bank got an 18-year-old to move her R438,900 education fund to a 'safe' account in…
Fake QR stickers on UK council parking machines sent drivers to cloned payment sites. 123 of 373 councils were hit…
Texts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025.…
A spoofed-email scheme impersonating MacEwan University's trusted general contractor, Clark Builders, tricked staff into redirecting $11.8 million CAD in construction…
Prosecutors say a grandparent scam run from call centers in the Dominican Republic hit hundreds of elderly Americans and took…
P&G-hired competitive-intelligence contractors obtained confidential Unilever hair-care information from discarded garbage before P&G self-disclosed the operation, fired three employees, and…
Imperva hid prompt injections behind whitespace in contact names, vCards and WhatsApp pins, making an OpenClaw agent run a script.…
Texts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025.…
Dubai Police raided nine pig butchering centres and arrested 275, and San Diego charged six alleged scam-compound managers and recruiters.…
DOJ/FTC alleged that Citizens Disability and subsidiary CD Media made 109 million-plus illegal telemarketing calls, including 25.7 million-plus to Do-Not-Call…
A long-running, India-based network of call centres impersonated the Canada Revenue Agency and RCMP in mass vishing calls that threatened…
A spoofed-email scheme impersonating MacEwan University's trusted general contractor, Clark Builders, tricked staff into redirecting $11.8 million CAD in construction…
Toronto firm CoHost spent two months interviewing a candidate it now believes was a fabricated persona with fake references. The…
In June 2025 the DOJ filed to forfeit $225.3M in USDT tied to pig butchering scams, after Tether and OKX…
A retired bank manager in Johor Baru lost RM936,000 after callers posing as an insurer, police and a prosecutor had…
Prosecutors say a grandparent scam run from call centers in the Dominican Republic hit hundreds of elderly Americans and took…
Dubai Police raided nine pig butchering centres and arrested 275, and San Diego charged six alleged scam-compound managers and recruiters.…
Censys traced a USPS 'package awaiting action' smishing kit to 682 lookalike sites that streamed card numbers as victims typed.…
A 12-person ring watched hacked inboxes for big payments, then redirected them with fake emails. Trial evidence put losses above…
Social Engineering Examples