Federal prosecutors in Manhattan charged three men with using AI to copy the voices and sometimes the faces of CEOs, then posing as outside lawyers, to get accounting staff to wire about $129 million between July 2024 and February 2026. How the calls worked and the payment controls that break the pattern.
If your company can move money on the strength of a call from the CEO, change that rule this week. Federal prosecutors in Manhattan say three men used AI to copy executives’ voices, and sometimes their faces, on live calls and took about $129 million from companies that way.
What prosecutors allege
The indictment was filed in the Southern District of New York and announced on Thursday, November 5, according to the U.S. Attorney’s Office. It charges Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42, with wire fraud, aggravated identity theft and money laundering, as the Associated Press reported. Soall and Hazan were arrested in Spain in June and August. Sheetrit was arrested in the United Kingdom in September, NBC News reported. An indictment is an accusation. All three are presumed innocent.
The scheme ran from July 2024 to February 2026, according to the prosecutors’ release as quoted by NBC News. Prosecutors say it targeted thousands of companies. The named victim types are an investment bank in New York, hospital systems in Missouri and California, a bank in Rhode Island, a financial technology company in the UK, a mutual fund company in Massachusetts and a pet food company in Florida.
How the calls worked
Court documents describe the same four steps each time, according to the AP:
- An email from “the CEO.” It went to the accounting team and asked for help with a confidential financial transaction.
- A call to make it real. The group set up a phone or video call and used AI to mimic the CEO’s voice and, in some cases, image.
- A handoff to “outside counsel.” The fake CEO told the employee to contact an attorney at a major international law firm. That attorney was also one of the group. Prosecutors say Soall played UK lawyers and used a handwritten script titled “Lawyer Call.”
- The wire. The “attorney” sent the employee to bank accounts around the world. The money was then converted to cryptocurrency and split up.
The New York Times reported on November 8 that the losses came in the 18 months after July 2024. If convicted, each count carries up to 20 years, except aggravated identity theft, which carries two.
A video call is no longer proof of identity
Our read: the second step is the one that changes your controls. Most finance teams were trained to distrust an email and trust a voice they know. This case says the voice and the face can be generated on demand, and the fake lawyer exists to absorb the “should I check this?” moment. Microsoft is adding deepfake warnings to Teams, but it relies on paid third-party detectors, and none of it covers a phone call.
What to put in place, starting with the cheapest:
- Call back on a number you already have. Any request to move money or change bank details gets a callback to the requester’s number from your own directory, never a number, link or meeting invite in the message.
- Two people approve new beneficiaries. A first payment to a new account needs a second approver who was not on the call.
- Treat “confidential” plus “talk to our lawyer” as a stop sign. Secrecy and a third party who confirms the story are the scheme. Tell your finance team, in writing, that they will never be penalized for delaying a wire to verify it.
- Agree on a check phrase with the people who can approve payments. It costs nothing and an AI clone of a voice cannot know it.
- Ask your bank for a hold on first-time international wires above a set amount. Most business banking platforms offer payee approval rules. Turn them on.
If you run a company of 20 people, step 1 is enough to start. The calls in this case worked because one person could act alone on one conversation.