- U.S. prosecutors allege three men used AI to imitate CEOs and law firm attorneys and took about $129 million from companies. The charges are allegations only.
- Prosecutors say fake CEOs sent employees to fake lawyers, who made the deal look real and then gave the wire instructions.
- Leaders should ask whether a payment can rest on a voice or video call alone, and who can stop a wire.
The fake lawyer was the trap
The CEO on the phone was allegedly fake. So was the lawyer the CEO sent the employee to call. Prosecutors say the fake lawyers were used to make the employee believe the deal was real.
The lesson here is that the charges describe deception rather than a system break-in. The scheme copied the way trust is built inside a company, one trusted voice vouching for another. When software can produce both voices, the reassurance comes from the same source as the request.
What prosecutors allege
The U.S. Attorney's Office for the Southern District of New York unsealed an indictment against Jacob Soall, Sharon Hazan and Guy Sheetrit. It says they used what it calls "super intelligence" to defraud victim companies worldwide of more than $100 million. Elsewhere the office puts the total at about $129 million.
The office says the three men and their co-conspirators imitated the voices or images of executives and of attorneys at major law firms between 2024 and 2026. CyberScoop reports that court records describe thousands of targeted victims between July 2024 and February 2026.
The office lists six victims. They include a Missouri hospital system that lost $4,829,580 and a U.K. financial technology company that lost $11,578,474. A Florida pet food company lost $5,242,747. CyberScoop adds a New York investment company that it says lost $2.8 million.
These are accusations only. The office stresses that none of the defendants has been proven guilty. Extradition requests are pending after arrests in Spain and the United Kingdom.
How the scheme worked
The office describes a script with several steps. First, the group allegedly posed as a CEO and asked an employee for help with a confidential financial deal. The office says the group used AI to mimic the CEO's voice or image in calls with the employee.
Next, the fake CEO sent the employee to lawyers at large international firms who were said to be working on the deal. Members of the group allegedly played those lawyers too. The office says this was done to make the employee believe the deal was real. One of them finally told the employee to wire a large sum to a specific bank account. The conspirators controlled that account.
CyberScoop, citing the unsealed indictment, adds detail on the opening move. It says an email from an e-signature company usually started the scheme. In it the impersonated CEO described a "confidential financial transaction" and asked the employee to sign a non-disclosure agreement first.
CyberScoop also reports that prosecutors said the group picked employees with enough authority to approve large wire transfers. It says the impersonated attorneys came from some of the 50 largest law firms worldwide.
Secrecy was part of the design. The office says Soall kept a handwritten script titled "Lawyer Call". It included language meant to persuade victims not to discuss the matter with colleagues. That removes the cheapest control a company has, which is a coworker asking a question.
The office says the wired money landed in accounts across the United States, Europe, the United Arab Emirates, Singapore and China. The named European countries are Spain, Portugal, Greece, Austria and Slovakia. The group then allegedly converted the funds to cryptocurrency.
How an impersonated voice gets past recognition
Most workplace trust rests on recognition. An employee hears a boss's voice, or sees a face on a call, and treats it as proof of who is speaking. Nobody checks a voice the way they check a password.
The office says the group used AI to mimic a CEO's voice or image in calls with the employee. In plain terms, software produced speech or video that sounded or looked like a named person. The employees were tricked, according to the office.
The sources do not say whether the mimicry ran in real time on live calls or was prepared in advance. That matters for controls. If it can run live, a call alone cannot prove who is speaking. Either way, the check has to sit outside the call.
In our reading, the e-signature email and the non-disclosure agreement gave the request the look of a formal process. The sources report that the group chose employees with authority over large wires. The fake lawyers then supplied a second voice to confirm the first.
The sources do not name the software used. They do not say how convincing the imitations were, or how many calls failed. Those are open questions.
How a check fails when the attacker owns every channel
What the sources do show is a chain of reassurance. The employee heard a request from a "CEO". The CEO named a lawyer. The lawyer confirmed the deal and gave the bank details. Every link was supplied by the attacker, so each check pointed back at the attacker.
This is the article's reading, not a prosecutor's claim. The sources do not describe the victims' internal approval rules. The point is simpler: a check only works if it runs through a channel the attacker did not hand over. A call back to a number already on file, or a contact looked up independently, breaks the chain. A number or link supplied in the request does not.
The alleged script was written to leave the employee alone with the decision. Controls should not depend on that person to spot a convincing voice.
Questions to put to your team
Can any wire above a set size be released on the strength of a call or video alone? If so, which callbacks use numbers already on file, rather than numbers supplied in the request?
Does your payment policy treat a request for secrecy as a reason to stop and escalate? The alleged script was written to produce exactly that silence.
Who outside the finance team can pause a transfer, and can an employee do it without fear of blame? Do you confirm a law firm named in a request through a contact you found yourself?
The U.S. Attorney urged businesses to "consider how to best protect themselves" from this kind of crime. The practical answer is dull. Move approval from what someone sounds like to a step that a voice cannot complete.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: U.S. Department of Justice, Southern District of New York.
