Deepfake CEOs took $129M from companies, DOJ says

A video call with your CEO no longer proves you are talking to your CEO.

Federal prosecutors in Manhattan have charged three people with a scheme that used AI to mimic the voices, and sometimes the faces, of chief executives and law firm attorneys, CyberScoop reported. The alleged take:

At least $129 million.

How the scheme worked, according to prosecutors

The indictment, filed in the Southern District of New York, names Jacob Soall, 41, of Marbella, Spain, Sharon Hazan, 54, of Israel, and Guy Sheetrit, 42, of Israel and the United Arab Emirates. Court records put the scheme between July 2024 and February 2026, per CyberScoop.

It usually opened with an email sent through an e-signature company that appeared to come from the CEO. It described a "confidential financial transaction" and asked the employee to sign a nondisclosure agreement.

Then came a phone or video call where AI mimicked the CEO, CBS News reported, citing AP. The employee was sent on to a supposed attorney at a major law firm, also an impersonation, who gave the wiring instructions. The money went to accounts around the world and was converted to cryptocurrency, according to CBS.

The group targeted thousands of companies, often their accounting departments, CBS reports.

The named losses, per CyberScoop, include about $11.6 million from a UK fintech company, $5.2 million from a Florida pet food company, $4.8 million from a Missouri hospital system, $4.6 million from a Massachusetts mutual fund company and nearly $2.7 million from a Rhode Island bank.

The seven counts include wire fraud, aggravated identity theft and money laundering, with a combined maximum of 104 years. Soall and Hazan were arrested in Spain and Sheetrit in the UK between June and September. Extradition requests for all three are pending, CBS reports.

These are allegations. Sheetrit's lawyers told CyberScoop he "has no connection to this matter" and maintains his innocence.

"As criminals continue to weaponize emerging technologies, the FBI remains committed to rapidly adapting our capabilities," said FBI Assistant Director in Charge James C. Barnacle Jr., per CBS.

The controls trusted a face

Look at the victim list again. Hospital systems, a bank, a mutual fund company. These are organizations with payment controls and audits.

The controls still treated a familiar face and voice on a call as verification. That assumption is finished. Full stop.

The scam's other trick was secrecy. The NDA came before the money, so the employee had a reason not to ask a colleague. A request to keep a payment quiet is the warning sign itself.

What to change this week

None of this needs new software. It needs two written rules.

First, any wire above a set amount, any new payee and any change to bank details gets confirmed by calling the requester back on a number from your own directory. Never the number in the email. Never the link in the meeting invite.

Second, a second person approves any payment described as urgent or confidential, no matter who asked for it. The more senior the requester, the more this applies.

Then tell your accounting team, out loud, that pausing the CEO to call back is the job, and nobody gets in trouble for it.

More on AI misuse lives in the safety section.

What to watch

Extradition. If the three are brought to New York, the trial record should show which tools they used and how, and every security team will want that detail.

Until then, call back. Every time.