Case Library / Deepfake & Synthetic Media / White House Chief of Staff Voice Impersonation via Hacked Contact List (2025)
Deepfake & Synthetic Media Documented incident

White House Chief of Staff Voice Impersonation via Hacked Contact List (2025)

An unidentified impersonator used a voice that government officials believed was AI-generated and a hacked personal-contacts list to pose as the White House chief of staff, texting and calling senators, governors and business leaders with requests including a pardon list and a cash transfer, triggering an FBI investigation in May 2025.

Share:

Social Engineering Examples·8 sources

What happened

In May 2025, an unidentified individual gained access to contacts stored on the White House chief of staff's personal cellphone and used that access to impersonate the officeholder, sending text messages and placing phone calls to senators, governors, business executives, and other prominent figures. Some calls used a voice that recipients said sounded like the chief of staff, and government officials believed artificial intelligence was used. The messages and calls did not originate from the chief of staff's actual phone number. Content included a request to one lawmaker to compile a list of people who could be pardoned by the president, and at least one request for a cash transfer. The scheme was first reported by the Wall Street Journal on May 29, 2025, and the FBI and White House confirmed an investigation on May 30, 2025.

How it worked

Reporting from May 2025 indicates an unidentified individual gained access to the personal cellphone contacts of the chief of staff and used that contact list to reach officials and business executives. Some calls featured a voice that sounded like hers, and government officials believed artificial intelligence was used. The content included a request to assemble a presidential pardon list and at least one request for a cash transfer. The White House and FBI were notified and described the matter as under investigation in May 2025. Public reporting did not identify the impersonator or establish attribution in those reports.

The lure and the tell

The lure: messages and calls appeared to come from a trusted, high-authority government office, with a voice that recipients said sounded like the chief of staff. The tell: the number did not match the chief of staff's known phone number.

Outcome

As reported on May 30, 2025, the matter was under FBI investigation, with no attribution announced in the cited reports. Public reporting described a requested cash transfer but did not establish whether funds moved or whether monetary loss occurred.

Why it matters

The incident illustrates how compromising a senior official's personal contact list can enable a multi-target social-engineering campaign and how a voice believed by government officials to have been AI-generated can be used in impersonation. It also shows the value of independent verification for sensitive requests.

Defenses

Multiple recipients caught the fraud through classic social-engineering tells rather than technical controls: broken grammar and unusually formal phrasing inconsistent with the chief of staff's normal communication style; the impersonator asking questions about Trump that the real chief of staff would already have known the answer to; and the calls and texts originating from a phone number not associated with the chief of staff. The chief of staff herself proactively warned her contacts to disregard messages and calls not coming from her known number and apologized for the inconvenience, functioning as an informal out-of-band verification signal. The FBI's May 15, 2025 public service announcement had already warned senior officials and their contacts about the broader smishing, vishing, and AI voice campaign. The episode underscores standard recommended defenses: callback verification via an independently known number, a pre-agreed verbal or code-word challenge for high-value requests, skepticism toward unusual requests, and treating personal devices of senior officials as high-value targets requiring the same hardening as official devices.

Sources
Cite this case

Social Engineering Examples. “White House Chief of Staff Voice Impersonation via Hacked Contact List (2025)”. Accessed 22 October 2026. https://socialengineeringexamples.com/white-house-official-ai-voice-impersonation-2025

Attack Chain & Defense
1Personal device/contact-list compromise
What happened

The attacker gained access to the contacts stored on the chief of staff's personal (non-government) cellphone through a method not publicly disclosed, likely consistent with common consumer-device compromise vectors such as SIM-swapping, phishing of device or cloud-account credentials, or a malicious app or link, none of which sources confirm specifically in this case.

The control that would have stopped it

Public visibility of senior officials and their networks is unavoidable and cannot be eliminated; the realistic control is treating well-connected officials' personal devices as high-value targets requiring proactive hardening, rather than trying to suppress the fact that they are targets.

2Outreach via text and voice
What happened

The impersonator used the compromised contact list to send text messages and place calls to officials and business leaders; some calls featured a voice that sounded like the chief of staff.

The control that would have stopped it

Personal devices belonging to senior officials should receive the same security posture as government-issued devices, including mobile threat defense, carrier-level SIM-swap protections, phishing-resistant multi-factor authentication on cloud/contact-sync accounts, and periodic review of connected apps and account access.

3Elicitation of sensitive information and funds
What happened

Once initial trust was established, the impersonator escalated to specific asks, including requesting one lawmaker compile a list of individuals eligible for a presidential pardon and, in at least one case, requesting a cash transfer, exploiting the assumed authority and urgency of a Chief of Staff-level request.

The control that would have stopped it

There is no practical way to prevent an attacker from collecting a public figure's existing recorded speech to train a voice clone; the realistic control sits downstream, at Stage 4, where callback verification through an independently known number defeats a cloned voice regardless of its quality.

4Elicitation of sensitive information and funds
What happened

Once initial trust was established, the impersonator escalated to specific asks, including requesting one lawmaker compile a list of individuals eligible for a presidential pardon and, in at least one case, requesting a cash transfer, exploiting the assumed authority and urgency of a Chief of Staff-level request.

The control that would have stopped it

Recipients of unsolicited high-authority requests should independently verify the sender through a previously known number or channel rather than trusting caller ID or a message's apparent origin.

Quick Facts
Victim
The White House chief of staff whose identity was impersonated,
and the senators, governors, business executives, and other prominent Republicans/well-known figures in her personal contact list who received the fraudulent texts and calls
Location
United States (Washington, D.C. and nationwide, targeting officials and executives across the country)
Date
2025-05
(campaign active weeks before public disclosure on 2025-05-29/30, FBI PSA on broader related campaign issued 2025-05-15)
Impact
A cash transfer was requested, but the supplied reporting does not establish whether funds moved or whether any monetary loss occurred.
Basisnot-a-lossA cash transfer was requested; no source confirms funds moved
The May 2025 reports describe an FBI investigation.
Status
Documented incident
Case Type
Real-World Incident
Sector
Cross-Sector / Multiple Industries, Government & Public Sector
Threat Actor
unknown
Explore more

Related Cases

Browse by what this case has in common with others in the library.

Dickinson Public Schools $4.9M Vendor-Impersonation BEC

Criminals impersonated a trusted vendor over email and redirected two building-fund payments totaling $4.92M from a North Dakota school district;…

Incident 2026Read →

Forest Blizzard (APT28/Fancy Bear) Uses GPT-4 for Satellite Comms and Radar Tech Reconnaissance

Russian GRU-linked Forest Blizzard (APT28/Fancy Bear) used OpenAI's GPT-4-family LLM services to research satellite communication protocols and radar.

Incident 2024Read →

FTC Task-Scam / Gamified Job-Scam Data Spotlight (December 2024)

FTC's December 2024 Data Spotlight quantified an explosion in "task scams," gamified job-offer frauds launched via unsolicited text/WhatsApp messages, showing…

Incident 2024Read →

Nationwide Toll-Road Smishing Wave (E-ZPass, SunPass, PA Turnpike, MassDOT, NTTA, Peach Pass)

A mass SMS phishing campaign impersonating U.S. toll agencies spoofed 'unpaid toll' notices to harvest payment card and personal data,…

Incident 2024Read →

Finance Minister Deepfake Investment Scam (Bengaluru, 2026)

A Bengaluru retiree lost Rs 6.88 lakh after an AI-generated deepfake Facebook video falsely showed the finance minister endorsing a…

Incident 2026Read →

Singapore Businessman Loses S$4.9 Million to a Fake Zoom Meeting Built From Real Footage of PM Lawrence Wong and Other Officials

A Singaporean businessman transferred at least S$4.9 million after WhatsApp and email lures citing the Strait of Hormuz crisis drew…

Incident 2026Read →