Three scammers used AI clones of CEOs and lawyers to steal $129 million from companies

Deepfake fraud long seemed like a horror story from security presentations. Now it has an indictment, names and a price tag: more than $129 million. The US Department of Justice has published case materials against Jacob Soal, Sharon Hazan and Guy Shitrit. According to investigators, they spent two years posing as executives and lawyers to trick employees into making large transfers.

How the scheme worked

The scheme relied on two roles. First, a company “executive” would message or call an employee and ask for help with a sensitive financial transaction. According to the indictment, the voice and image were faked with AI. The employee was then asked to contact a “lawyer” from a major international law firm. The scammers played that role as well, again substituting the lawyer’s voice and appearance.

This is a classic social-engineering tactic. A request from the boss creates pressure and urgency, while the lawyer adds a veneer of official approval: the matter appears to have already been cleared and verified. The employee encounters a familiar voice and a convincing story, then transfers money to the specified account. AI does not invent a new form of deception here; it makes an old one almost free and significantly more credible.

Recipient accounts were located in the US, Spain, Portugal, Greece, the UAE, Singapore, Austria, Slovakia and China. After each transfer, the money was converted into cryptocurrency to conceal its origin and ownership, then divided among the participants. The defendants are charged with conspiracy to commit wire fraud, money laundering and aggravated identity theft.

Who was affected

The list of victims shows that any organization can become a target. A Missouri hospital network lost about $5 million, a California hospital system about $3 million, and a Rhode Island bank about $2.7 million. A Massachusetts mutual fund lost more than $4.6 million, while a Florida animal-feed manufacturer lost about $5 million. The largest incident identified involved more than $11 million stolen from a UK technology company.

For product and engineering teams, one detail matters in particular: an IT company was among the victims. Knowing about AI does not protect an organization from a call by the “boss” if its processes lack hard safeguards.

What to do in practice

First, stop treating a voice or face as a form of authorization. If a payment request arrives by phone, video or messenger, it must undergo mandatory verification through an independent channel: call back using a number from the internal directory, not the number provided in the request.

Second, limit unilateral decisions. Large or unusual transfers should require approval from two people, one of whom must not be under pressure from the specific request. New payment details and unexplained urgency should be treated as warning signs.

Third, train employees with realistic scenarios. This scheme relied on an “executive plus lawyer” chain, so exercises should teach staff to be suspicious of precisely such combinations. If you are building a product for finance, HR or support, consider built-in safeguards: a delay before the first transfer to a new account, warnings about external payment details and an approval log.

Limitations

These are allegations, not a conviction. The press release does not disclose which tools the defendants allegedly used, whether they cloned voices in real time or prepared recordings in advance, or how convincing the results were. Some of their success may have come not from flawless deepfakes but from a persuasive script and victims’ fatigue. The conclusion remains the same: when impersonation is cheap, organizations must rely on processes rather than employees’ intuition.