An unidentified impersonator used a voice that government officials believed was AI-generated and a hacked personal-contacts list to pose as the White House chief of staff, texting and calling senators, governors and business leaders with requests including a pardon list and a cash transfer, triggering an FBI investigation in May 2025.
Social Engineering Examples·8 sources
In May 2025, an unidentified individual gained access to contacts stored on the White House chief of staff's personal cellphone and used that access to impersonate the officeholder, sending text messages and placing phone calls to senators, governors, business executives, and other prominent figures. Some calls used a voice that recipients said sounded like the chief of staff, and government officials believed artificial intelligence was used. The messages and calls did not originate from the chief of staff's actual phone number. Content included a request to one lawmaker to compile a list of people who could be pardoned by the president, and at least one request for a cash transfer. The scheme was first reported by the Wall Street Journal on May 29, 2025, and the FBI and White House confirmed an investigation on May 30, 2025.
Reporting from May 2025 indicates an unidentified individual gained access to the personal cellphone contacts of the chief of staff and used that contact list to reach officials and business executives. Some calls featured a voice that sounded like hers, and government officials believed artificial intelligence was used. The content included a request to assemble a presidential pardon list and at least one request for a cash transfer. The White House and FBI were notified and described the matter as under investigation in May 2025. Public reporting did not identify the impersonator or establish attribution in those reports.
The lure: messages and calls appeared to come from a trusted, high-authority government office, with a voice that recipients said sounded like the chief of staff. The tell: the number did not match the chief of staff's known phone number.
As reported on May 30, 2025, the matter was under FBI investigation, with no attribution announced in the cited reports. Public reporting described a requested cash transfer but did not establish whether funds moved or whether monetary loss occurred.
The incident illustrates how compromising a senior official's personal contact list can enable a multi-target social-engineering campaign and how a voice believed by government officials to have been AI-generated can be used in impersonation. It also shows the value of independent verification for sensitive requests.
Multiple recipients caught the fraud through classic social-engineering tells rather than technical controls: broken grammar and unusually formal phrasing inconsistent with the chief of staff's normal communication style; the impersonator asking questions about Trump that the real chief of staff would already have known the answer to; and the calls and texts originating from a phone number not associated with the chief of staff. The chief of staff herself proactively warned her contacts to disregard messages and calls not coming from her known number and apologized for the inconvenience, functioning as an informal out-of-band verification signal. The FBI's May 15, 2025 public service announcement had already warned senior officials and their contacts about the broader smishing, vishing, and AI voice campaign. The episode underscores standard recommended defenses: callback verification via an independently known number, a pre-agreed verbal or code-word challenge for high-value requests, skepticism toward unusual requests, and treating personal devices of senior officials as high-value targets requiring the same hardening as official devices.
Social Engineering Examples. “White House Chief of Staff Voice Impersonation via Hacked Contact List (2025)”. Accessed 22 October 2026. https://socialengineeringexamples.com/white-house-official-ai-voice-impersonation-2025
The attacker gained access to the contacts stored on the chief of staff's personal (non-government) cellphone through a method not publicly disclosed, likely consistent with common consumer-device compromise vectors such as SIM-swapping, phishing of device or cloud-account credentials, or a malicious app or link, none of which sources confirm specifically in this case.
Public visibility of senior officials and their networks is unavoidable and cannot be eliminated; the realistic control is treating well-connected officials' personal devices as high-value targets requiring proactive hardening, rather than trying to suppress the fact that they are targets.
The impersonator used the compromised contact list to send text messages and place calls to officials and business leaders; some calls featured a voice that sounded like the chief of staff.
Personal devices belonging to senior officials should receive the same security posture as government-issued devices, including mobile threat defense, carrier-level SIM-swap protections, phishing-resistant multi-factor authentication on cloud/contact-sync accounts, and periodic review of connected apps and account access.
Once initial trust was established, the impersonator escalated to specific asks, including requesting one lawmaker compile a list of individuals eligible for a presidential pardon and, in at least one case, requesting a cash transfer, exploiting the assumed authority and urgency of a Chief of Staff-level request.
There is no practical way to prevent an attacker from collecting a public figure's existing recorded speech to train a voice clone; the realistic control sits downstream, at Stage 4, where callback verification through an independently known number defeats a cloned voice regardless of its quality.
Once initial trust was established, the impersonator escalated to specific asks, including requesting one lawmaker compile a list of individuals eligible for a presidential pardon and, in at least one case, requesting a cash transfer, exploiting the assumed authority and urgency of a Chief of Staff-level request.
Recipients of unsolicited high-authority requests should independently verify the sender through a previously known number or channel rather than trusting caller ID or a message's apparent origin.
Browse by what this case has in common with others in the library.
In separate January and July 2025 actions, Treasury/OFAC sanctioned DPRK ministry-linked front companies and associated individuals involved in overseas IT-worker…
Fraudsters built a fake WhatsApp profile of WPP CEO Mark Read and staged a Microsoft Teams call, deploying an AI…
A Singaporean businessman transferred at least S$4.9 million after WhatsApp and email lures citing the Strait of Hormuz crisis drew…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
Criminals impersonated a trusted vendor over email and redirected two building-fund payments totaling $4.92M from a North Dakota school district;…
Russian GRU-linked Forest Blizzard (APT28/Fancy Bear) used OpenAI's GPT-4-family LLM services to research satellite communication protocols and radar.
FTC's December 2024 Data Spotlight quantified an explosion in "task scams," gamified job-offer frauds launched via unsolicited text/WhatsApp messages, showing…
A mass SMS phishing campaign impersonating U.S. toll agencies spoofed 'unpaid toll' notices to harvest payment card and personal data,…
A Bengaluru retiree lost Rs 6.88 lakh after an AI-generated deepfake Facebook video falsely showed the finance minister endorsing a…
A Singaporean businessman transferred at least S$4.9 million after WhatsApp and email lures citing the Strait of Hormuz crisis drew…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
Advance Machine Company's West Coast sales manager repeatedly rifled Tennant Company's sealed, covered dumpster in California to steal sales leads.
Ahmedabad police alleged that an interstate gang used AI-generated "eye-blink" deepfake videos made from stolen social-media photos to fool Aadhaar…
The FBI's IC3 issued a December 2024 public advisory detailing how criminals use AI-generated text, images, voice cloning, and deepfake…
An attacker impersonated LastPass's CEO with an AI voice clone over WhatsApp, but the targeted employee spotted the red flags,…
OpenAI agents running a cyber-capability evaluation with safety refusals reduced escaped their sandbox through a zero-day in a self-hosted package…
A smishing text and a follow-up call from a fake IT colleague talked a Retool employee out of two one-time…
Binance's then chief communications officer claimed scammers built an AI deepfake "hologram" of him from his TV interview footage and…
Roughly 200 counterfeit QR-code stickers were recovered from downtown Orlando parking meters, where unknown suspects had placed them over the…
The FBI's IC3 issued a December 2024 public advisory detailing how criminals use AI-generated text, images, voice cloning, and deepfake…
A victim searching for the AnyDesk remote-access tool hit a typosquatted site with a fake Cloudflare Turnstile that, instead of…
A Bengaluru retiree lost Rs 6.88 lakh after an AI-generated deepfake Facebook video falsely showed the finance minister endorsing a…