Threat intel
Cloned CEOs and fake lawyers: $129M wire fraud charged
Three people are charged with using AI voice clones of CEOs and real lawyers' identities to steal $129M in wires. How it worked and the controls that stop it.
Federal prosecutors in Manhattan announced on Thursday, November 5, an indictment charging three people with stealing at least $129 million from companies by impersonating their chief executives with AI-generated voices, and sometimes faces, and then handing the victim to a fake lawyer who gave the wiring instructions. Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42, each face seven counts of wire fraud, aggravated identity theft and money laundering. They are presumed innocent, and Sheetrit's lawyers say their client had no involvement in the matter.
Prosecutors say the group targeted thousands of companies worldwide between July 2024 and February 2026, aiming at accounting staff who could approve large wires. Named victims include hospital systems in Missouri and California, a Rhode Island bank and a Massachusetts mutual fund company. If your finance team will move money when the CEO's voice asks for it, this case describes your exposure.
How the scheme worked
According to the charges as reported by CyberScoop and Biometric Update, the first contact did not look like ordinary email phishing. It arrived through an electronic signature service such as DocuSign, apparently sent by the company's CEO, describing a confidential deal, often an acquisition, and asking the employee to sign a non-disclosure agreement (NDA). Signing an NDA makes the secrecy feel formal, and it gives the employee a reason not to mention the deal to anyone.
Next came a phone or video call in which the "CEO" spoke with an AI-generated copy of the executive's voice and, in some cases, image. The call's job was to make the request feel real and urgent, then pass the employee to outside counsel.
The lawyer was the second impersonation. The group allegedly used the identity of a real attorney, reportedly at one of the 50 largest law firms and often in its European office. Prosecutors say Soall mainly played UK attorneys and worked from a handwritten script titled "Lawyer Call", written partly to discourage employees from discussing the transaction with colleagues. Because the "lawyer" gave the bank details, no single message from the "CEO" contained the full fraud.
Payments went to accounts in the US, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China, were converted to cryptocurrency and split among the participants. Prosecutors say Hazan and Sheetrit handled the laundering. Hazan allegedly boasted of laundering money since 1994 and moving more than $400 million in the past three years, and was convicted of bank fraud conspiracy in the same court in 2008.
What the charges describe
The six example losses add up to about $32 million, roughly a quarter of the total prosecutors attribute to the scheme. Soall was arrested in Spain on June 17, Hazan in Spain on August 5 and Sheetrit in the UK on September 7. US extradition requests for all three are pending. Wire fraud and money laundering each carry a maximum of 20 years, and each aggravated identity theft count carries two years.
One case shows where the chain can break. Gizmodo and Biometric Update report that in October 2024 an employee at a New York investment bank approved a $2.85 million wire, and the bank's back office stopped it before the money left. CyberScoop's list of losses includes a New York investment company at $2.8 million, so treat the outcome of that attempt as reported, not settled. It still points at the control that matters most: a check that does not depend on the person who was just persuaded.
The scale also stands out against the FBI's own numbers. The Internet Crime Complaint Center (IC3) 2025 annual report says businesses reported more than $30 million in losses to business email compromise (BEC) that involved AI in 2025. This one alleged ring is accused of taking about four times that in 20 months.
What to do
These controls hold even when the voice and video are perfect, because none of them asks anyone to judge whether a voice sounds right.
- Call back on a number you already hold. Any request to pay, or to change bank details, is confirmed by calling the requester on the number in your HR directory or vendor master file, never a number, meeting link or contact given in the request. For a CEO, use their assistant or desk line.
- Require a second approver for every new beneficiary. In your bank's treasury portal, turn on dual authorization so one user creates a wire and a different user releases it, and set the threshold low enough to cover the amounts above. The second approver checks the beneficiary country and account against the request and contacts the requester independently.
- Write down that secrecy is never an exception. A finance policy line such as "no confidential deal, NDA or instruction from an executive or outside counsel bypasses payment approval" gives junior staff something to point to when the "CEO" insists. Genuine deal work involves your own general counsel, so a request that excludes them is the warning sign.
- Verify the lawyer through your own legal team. Your general counsel, or the firm's main switchboard taken from its own website, confirms that the attorney exists and is acting for you on this matter.
- Teach accounting staff the exact pattern: an unexpected NDA from the CEO, a call that follows it, then a handoff to outside counsel with wiring instructions. Run a tabletop exercise with finance, not just an email phishing test.
Check whether you were already targeted. In your mail logs, search for e-signature notifications (DocuSign and similar) sent to finance and accounts payable staff from external senders that mention an NDA, acquisition or confidential transaction since mid-2024. In your bank's wire history for the same period, review first-time beneficiaries in the nine countries listed above that were approved by a single user.
If a wire has already gone out, the IC3 guidance is to contact your bank immediately and request a recall, then file a complaint at ic3.gov with the full transaction details, whatever the amount. The IC3 Recovery Asset Team runs the Financial Fraud Kill Chain, which works with banks to freeze funds. In 2025 it handled 3,900 incidents involving $1.16 billion in attempted theft and froze $679 million, a 58% success rate. Banks that file a suspicious activity report on a deepfake case should use FinCEN's key term FIN-2024-DEEPFAKEFRAUD from its November 2024 alert.
We review payment approval flows and run executive impersonation exercises against finance teams in our safeguarding and hardening work, and we watch for lookalike e-signature lures in security operations. If you want to know how your wire process would hold up against this pattern, open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: SecurityWeek (AP), US Attorney's Office SDNY, CyberScoop, Gizmodo, Biometric Update, CBS News, FBI IC3 2025 Annual Report, FinCEN deepfake alert.