Susie Wiles AI Voice Impersonation via Hacked Contact List (2025)

What Happened

In May 2025, an unidentified individual gained access to the contacts stored on White House Chief of Staff Susie Wiles's personal cellphone and used that access to impersonate her, sending text messages and placing phone calls to senators, governors, top U.S. business executives, and other prominent Republicans and well-known figures. Some of the calls used a voice that recipients said sounded like Wiles, which government officials believed was generated using AI voice-cloning technology. The messages and calls did not originate from Wiles's actual phone number. Content included a request to one lawmaker to compile a list of people who could be pardoned by President Trump, and at least one request for a cash transfer. Some recipients were asked to move the conversation to Telegram. The scheme was first reported by the Wall Street Journal on May 29, 2025, and confirmed as under investigation by the FBI and the White House the same week; it followed a May 15, 2025 FBI public service announcement warning of a broader campaign, active since roughly April 2025, in which malicious actors used smishing and vishing (including AI-generated voice messages) to impersonate senior U.S. officials and their contacts. President Trump publicly confirmed on May 30, 2025 that Wiles's phone had been "breached."

How the Attack Worked

Reporting (primarily the Wall Street Journal, corroborated by Reuters, AP, CNN, CBS, ABC, Washington Post, The Guardian, Fox News, The Hill) indicates an unidentified individual gained access to the personal cellphone contacts of Susie Wiles (her private phone, not her government-issued device) and used that contact list to reach senators, governors, top U.S. business executives, members of Congress, and other prominent Republicans and well-known figures. The impersonator sent text messages and placed phone calls that appeared, at least initially, to be from Wiles; some calls used a synthesized/AI-generated voice that recipients described as sounding like her. The messages and calls did not originate from Wiles's actual phone number. Content included requests recipients initially believed were legitimate, including one lawmaker being asked to assemble a list of individuals who could be pardoned by the president, and at least one instance where the impersonator asked for a cash transfer. Some recipients were also reportedly asked to continue the conversation on Telegram, a common social-engineering tactic to move victims off a monitored/traceable channel. The White House, FBI, and U.S. intelligence agencies were notified and began investigating; FBI officials reportedly told the White House they did not believe a foreign nation was behind the effort, though this remained unconfirmed in public reporting. It was not the first cybersecurity incident tied to Wiles: WSJ noted that during the 2024 campaign, Iranian operatives had hacked into her email account and accessed a research dossier on then-vice-presidential candidate JD Vance, though no link between that earlier intrusion and the 2025 impersonation was established.

The Lure & the Tell

The lure: messages and calls appeared to come from a trusted, high-authority contact, Trump's own White House Chief of Staff, reaching out personally via a channel (personal cellphone contacts) that implied legitimacy and urgency, with an AI-cloned voice reinforcing the illusion on calls. The tell: broken grammar and phrasing more formal than Wiles's actual communication style; the impersonator asking Trump-related questions Wiles herself would already have known the answers to; the number not matching Wiles's known phone number; and, in some cases, an odd pivot request to continue on Telegram.

Outcome

As of the most recent public reporting reviewed, the matter remained an open FBI investigation with no arrest, indictment, or public attribution announced. The White House confirmed the investigation and stated it "takes the cybersecurity of all staff very seriously" and that "this matter continues to be investigated." FBI Director Kash Patel stated the FBI "takes all threats against the president, his staff, and our cybersecurity with the utmost seriousness" and called safeguarding administration officials' secure communications "a top priority." President Trump publicly confirmed Wiles's phone had been "breached" and that an impersonator had tried to pose as her, while downplaying concern, saying Wiles "can handle it." Some of the people contacted engaged with the impersonator before realizing the deception; others contacted Wiles directly to verify before responding. No public reporting confirms actual financial loss, and the identity, nationality, or motive of the impersonator had not been publicly disclosed in the sources reviewed.

Why It Matters

This incident is one of the most prominent documented cases of AI voice-cloning used to impersonate a sitting senior U.S. government official for social engineering targeting other high-value figures (sitting senators, governors, and business executives), rather than the more commonly reported deepfake-CEO-fraud pattern against corporate finance staff. It illustrates how compromising a single high-value individual's personal device and contact list can cascade into a multi-target social-engineering campaign leveraging that person's implicit trust network, and how AI voice synthesis is now sophisticated enough to fool recipients who personally know the person being impersonated, at least initially. It also demonstrates that non-technical tells (grammar, tone, knowledge gaps, unfamiliar numbers) remain a critical last line of defense even against advanced synthetic-voice attacks, and that securing officials' personal devices, not just government-issued ones, is now a national security concern.

Defenses

Multiple recipients caught the fraud through classic social-engineering tells rather than technical controls: broken grammar and unusually formal phrasing inconsistent with Wiles's normal communication style; the impersonator asking questions about Trump that the real Wiles would already have known the answer to; and the calls/texts originating from a phone number not associated with Wiles. Wiles herself proactively warned her contacts to disregard messages/calls not coming from her known number and apologized for the inconvenience, functioning as an informal out-of-band verification signal. The FBI's May 15, 2025 public service announcement (PSA) had already warned senior officials and their contacts about the broader smishing/vishing/AI-voice campaign, providing some advance awareness. The episode underscores standard recommended defenses that were largely absent beforehand: callback verification via an independently known number, a pre-agreed verbal/code-word challenge for high-value requests (pardon lists, fund transfers), skepticism toward any request to move a conversation to an unofficial channel like Telegram, and treating personal (non-government) devices of senior officials as high-value targets requiring the same hardening as official devices.