AI voice-clone CEO fraud: DOJ charges 3 in $129M wire scheme
Prosecutors say a ring used AI voice clones of CEOs and fake law-firm attorneys to steal $129M+ by wire. Verify payment requests on numbers you already have.
The CEO calls. The lawyer calls back. Both are fake. Federal prosecutors in Manhattan have charged three foreign nationals in an alleged AI voice-clone CEO fraud scheme that took more than $129 million from companies by wire transfer, NBC News reported on November 6. The playbook didn't hack a single system. It hacked the person who sends the wires.
What actually happened
Per the indictment in the Southern District of New York, as described by NBC from the U.S. attorney's press release:
- Who. Jacob Soall was arrested in Spain in June, Sharon Hazan in Spain in August, and Guy Sheetrit in the U.K. in September. They face wire fraud, aggravated identity theft and money laundering charges. These are allegations, not convictions.
- When. The scheme allegedly ran from July 2024 to February 2026.
- How. The group targeted employees, usually in accounting. They used AI to mimic the CEO's voice and asked for help with a "confidential" transaction. The fake CEO then pointed the employee to attorneys at big international law firms. Those attorneys were part of the scheme too. Soall allegedly used a script titled "Lawyer Call."
- The money. Employees wired funds to accounts around the world. The group then converted the funds to crypto.
- The victims. An investment bank in New York, hospital systems in Missouri and California, a Rhode Island bank, a U.K. fintech, a Massachusetts mutual fund company and a Florida pet food company.
Why it matters for your business
Look at that victim list. These weren't careless shops. They were banks and hospital systems with real finance teams. The scheme worked because it built its own verification step. The employee "checked" with a lawyer, and the lawyer was in on it.
A familiar voice is no longer proof of identity. Your controls have to assume that. Here's what we'd put in place this week:
- Call back on a number you already have. Never on a number, link or contact the requester gives you. That includes "our outside counsel."
- Two people approve every new payee or changed bank details. No exceptions for urgent deals.
- "Confidential" plus "urgent" is the red flag. Write that rule down and tell your team the CEO will never be upset that they checked.
- Use your bank's tools. Turn on payee approval and dual authorization for wires and ACH if your bank offers them.
- Put approvals in a system, not a phone call. A request that skips your workflow doesn't get paid.
Key takeaways
- DOJ charged three people in an alleged $129M+ scheme using AI voice clones of CEOs
- Fake law-firm attorneys gave victims a false way to "verify" each transfer
- Victims included banks and hospital systems, not just small firms
- Verify payment requests only on contact details you already have on file
- Require two approvers for new payees, and make urgency a red flag
Do your wire approvals still live in phone calls and inboxes? We build payment-approval workflows with two-person sign-off, payee change alerts and an audit trail, wired into the tools your team already uses. See how we build, or tell us how money leaves your business today.
Sources: NBC News.
- #ai-voice-cloning
- #wire-fraud
- #deepfakes
- #payment-controls
- #small-business-security
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Microsoft trims neocloud partners: ask where your AI runs
Microsoft is cutting its neocloud partner list over power and build delays. CoreWeave, Nebius, IREN and Nscale are named. Ask your AI vendor where it runs.
Read itInkling 2 Small: 594B model at $0.30 in, weights next week
Thinking Machines' Inkling 2 Small is live on Tinker at $0.30/$1.00 per million tokens. Apache 2.0 weights are promised, not shipped. Here's how to test it.
Read it