For about a year and a half, a phone call from the boss was allegedly all it took.
On November 5, federal prosecutors in New York unsealed an indictment against three men, Jacob Soall, Sharon Hazan and Guy Sheetrit, accusing them of using AI-generated voices and images to impersonate company CEOs and then the lawyers supposedly handling their deals. According to prosecutors, the scheme pulled in at least $129 million between mid-2024 and early 2026. Victims reportedly included hospitals, banks, a UK fintech that lost $11.6 million and a Florida pet food maker that lost $5.2 million.
The charges include wire fraud and aggravated identity theft. None of it has been proven in court yet, and the defendants are presumed innocent. But the playbook described in the indictment is worth studying closely, because almost nothing about it depends on breaking into a computer. It depends on breaking into a person’s sense of who they’re talking to.
How the alleged scam worked
Strip away the AI and this is old-fashioned business email compromise (BEC) with a much better costume. Based on the court documents described in reporting by CyberScoop and SecurityWeek, it ran in three steps:
- The “CEO” calls. An employee, usually someone in accounting, gets a call or video call from what looks and sounds like their chief executive. There’s a confidential transaction underway. Don’t discuss it with anyone.
- The handoff to a “lawyer.” The fake CEO tells the employee to contact an attorney at a major international law firm who is supposedly running the deal. Prosecutors say the group borrowed the identities of real lawyers at some of the world’s 50 largest firms, often from their European offices.
- The wire. The “attorney,” also an impersonator, walks the employee through sending funds abroad. The money was then allegedly converted to cryptocurrency.
That second step is the clever part. Most fraud training teaches staff to be suspicious of an unusual request from the boss. Far fewer teach them to be suspicious of the respected outside professional the boss just pointed them to. The lawyer acts as a second, independent-seeming confirmation, except that it’s the same criminals on both ends.
Why AI changed the economics
CEO fraud isn’t new. What’s new is how cheap it has become to do it well.
A few years ago, impersonating a specific executive’s voice meant hiring someone who could do a passable imitation, and it fell apart if the employee knew the boss well. Today a minute or two of audio from an earnings call, a conference panel or a podcast appearance is enough to clone a voice convincingly. Real-time face replacement on video calls is no longer a lab demo. And generative AI has quietly removed one of the most reliable warning signs of foreign-run fraud: clumsy language.
Prosecutors say the group targeted thousands of companies. That’s what scale looks like when the cost of each attempt drops close to zero. A 1% success rate is a very good business when each success is worth millions.
We’ve written before about the ethical line around deepfakes. This case is a reminder that the most damaging deepfakes may never go viral. They happen on a private call with one person in a finance office.
What finance teams should change this week
None of the following needs a new security product. Most of it is process, and most of it costs nothing.
1. Make “call back on a known number” non-negotiable
Any request to move money that arrives by phone, video or email gets verified by calling the requester back on a number that’s already in your directory, not one supplied in the message or the call. If the CEO really is on the line, they’ll pick up. This single habit defeats the vast majority of impersonation fraud, AI or not.
2. Verify the outside party independently, too
This is the lesson specific to this case. If you’re told to deal with a law firm, a bank or an auditor, look up that firm’s main switchboard yourself and ask for the person by name. Don’t use the email address or phone number you were handed.
3. Kill the secrecy exception
“Keep this confidential” is the oldest pressure tactic in the fraud book, because it isolates the victim from colleagues who might spot the problem. Write it into policy that no transaction is too confidential for the standard two-person approval. Then make sure executives say this out loud, so staff know a real CEO will never ask them to skip it.
4. Require dual approval above a threshold
Pick a number that matters for your business, whether that’s $10,000 or $250,000. Above it, two people must independently approve a new payee or an overseas wire. One person can be fooled. Two people who each have to verify are far harder to fool.
5. Agree on a verbal code for urgent requests
Some companies now use a simple rotating passphrase between executives and finance staff for out-of-band requests. It sounds old-fashioned. That’s the point. A cloned voice can say anything except the thing it doesn’t know.
6. Train for the new version of the threat
If your security awareness training still centers on spotting typos in phishing emails, it’s out of date. Run a session that plays a cloned voice sample for staff (with the executive’s permission) so people hear how convincing it is. Seeing it once changes behavior more than any slide deck.
What individuals should take from this
The same tactic is already hitting families: the panicked call from a “grandchild” who needs bail money, or a “relative” stranded abroad. The defense is the same as in the office. Hang up and call back on a number you already have. Agree on a family code word. And treat urgency plus secrecy as a red flag, every time. Our guide to personal cyber hygiene habits covers a few more.
The bigger picture
The uncomfortable takeaway from this indictment is that “I recognized their voice” and “I saw them on camera” no longer count as verification. For most of history, those were the gold standard. Companies that rebuild their payment controls around that fact will be fine. The ones that don’t are relying on luck, and on whoever happens to be in the accounting department that day.
If you’re reviewing your wider defenses, our breakdown of the top cyber threats facing businesses is a good place to start.
