InfoSecurityWeek

Deepfaked CEOs, Fake Lawyers, $129 Million: Three Charged in New York

Three people are charged in Manhattan with stealing about $129 million by impersonating CEOs with AI voice and video, then handing victims to fake attorneys who gave wiring instructions.

U.S. prosecutors have charged three people with stealing about $129 million by posing as company CEOs and the lawyers those CEOs supposedly trusted, using AI to fake the executives’ voices and sometimes their faces on calls. Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42, are charged in Manhattan federal court with wire fraud, aggravated identity theft and money laundering, SecurityWeek reports, citing the Associated Press and the U.S. Attorney’s Office for the Southern District of New York. These are charges; none of the three has been convicted in this case.

For defenders

The playbook, per the indictment: an email to the accounting team from the “CEO” about a confidential transaction (T1566 (Phishing)), then a phone or video call using AI to mimic the CEO’s voice and sometimes image, then a handoff to an “attorney at a major law firm” (also one of the defendants) who gives wiring instructions. Prosecutors say Soall mostly played UK lawyers and kept a handwritten script titled “Lawyer Call.” Money went to accounts worldwide and was converted to cryptocurrency before being split up.

Scale: thousands of companies targeted worldwide over more than a year and a half. Named victim types include hospital systems in Missouri and California, a Rhode Island bank, a UK fintech, a Massachusetts mutual fund company and a Florida pet food company. The defendants are from Spain, the UK, Israel and the UAE and were arrested between June and September. Prosecutors note Hazan was convicted of conspiracy to commit bank fraud in New York in 2008.

Control that breaks this: any request to move money that arrives with secrecy and urgency gets verified through a channel the requester didn’t supply: a known phone number, an in-person check, or a second approver. A convincing voice or face on a video call is no longer evidence by itself.

What it means for you

Scammers can now sound and look like your boss on a call. If you handle payments at work, a request that’s urgent, secret and comes with a “lawyer” giving bank details is the pattern prosecutors describe here, no matter how real the voice sounds.

Do this now

  1. Before sending any unusual payment, call the person back on a number you already had, not one from the email or call.
  2. Agree on a rule that no big payment goes out on one person’s say-so; a second approver checks every new bank account.
  3. Treat “keep this confidential, don’t tell finance” as a warning sign, not an instruction.

More from the Roundup