AI-cloned CEOs stole $129 million from hospitals and banks, DOJ says

The voice on the call sounded like the boss, and the lawyer who rang next sounded like a partner at one of the world’s biggest law firms. Neither was real, according to federal prosecutors in Manhattan. They say three men used artificial intelligence to imitate chief executives and attorneys, and talked accounting staff at hospitals, banks and other companies into wiring money for confidential deals that never existed. The money was turned into cryptocurrency and split among the conspirators.

The case reaches well beyond the companies that lost money. Nobody broke into a computer. The scheme relied on something almost every office worker does without thinking: trusting a familiar voice that asks for help. A chief executive’s speeches, earnings calls and conference panels are public, and voice-cloning software can work from that kind of audio. If a scammer can sound like your manager, a phone call no longer proves who is on the other end.

The indictment, filed in the Southern District of New York, charges Jacob Soall, 41, who lives in Marbella, Spain, and in the United Kingdom; Sharon Hazan, 54, of Israel; and Guy Sheetrit, 42, of Israel and the United Arab Emirates. Each faces seven counts, including conspiracy to commit wire fraud, aggravated identity theft and money laundering. Prosecutors say the group took approximately $129 million from companies in the United States and abroad.

The script rarely changed, according to the indictment. It often started with an email sent through an electronic signature service such as DocuSign, apparently from the target’s own chief executive, asking for help with a secret transaction and attaching a nondisclosure agreement. Then came the calls, where the conspirators allegedly used AI to mimic the executive’s voice and sometimes the executive’s face. The fake CEO handed the employee to a fake lawyer, usually borrowing the name of a real attorney in the European office of a top-50 law firm. Soall, prosecutors say, kept a handwritten script titled “Lawyer Call” that leaned on confidentiality and insider-trading rules to stop employees from talking to colleagues.

The victims are not named, but the losses listed in the charging papers read like a cross-section of the economy. A hospital system in Missouri sent $4,829,580. A Rhode Island bank lost $2,684,580 and a California hospital system $2,968,497. A British financial technology company lost $11,578,474, a Massachusetts mutual fund company $4,639,918 and a Florida pet food company $5,242,747. The money went to accounts in the United States, Spain, Portugal, Greece, the UAE, Singapore, Austria, Slovakia and China before it was converted into crypto.

One target got away. At a major New York investment bank, an employee approved a payment of roughly $2.85 million, but the bank’s back office stopped the wire before it left, prosecutors say. The defense that worked was a second pair of human eyes, not a deepfake detector.

The AI part is newer than the crime. The Justice Department’s announcement calls the tools “super intelligence,” while the indictment itself refers to artificial intelligence, and nothing in the public filings points to anything beyond commercially available voice and face cloning. The rest is an old playbook: fake executive emails, money moved through accounts in several countries, then laundering. Prosecutors say Hazan, who was convicted of conspiracy to commit bank fraud in the same court in 2008, boasted that he had laundered more than $400 million in three years and was “number one all over the world.” These are allegations, none of the three has been convicted, and prosecutors have not said how much money has been recovered or which cloning tools were used.

Companies have seen this coming. Engineering firm Arup lost about $25 million in 2024 after an employee in Hong Kong joined a video call in which the other participants were deepfakes. The standard advice has not changed: call the executive back on a number you already have, require a second approver for large transfers, and treat secrecy demands as a red flag. “I encourage individuals and the business community to consider how to best protect themselves from the emerging threat of SI-enabled crime,” U.S. Attorney Jamie McDonald said.

The alleged conspiracy ran from at least July 2024 to February 2026. Soall was arrested in Spain on June 17 and Hazan in Spain on August 5, and Sheetrit was arrested in the United Kingdom on September 7. The indictment was unsealed in the first week of November, and extradition requests for all three are pending. Wire fraud and money laundering each carry a maximum of 20 years in prison, and the FBI is asking other possible victims to come forward through its tips page.

The bank that kept its money did not own better AI. It had someone in the back office who looked at the wire before it went out.

Tags: Folarin Balogun, Baker Mayfield, Meghan Markle, Cybersecurity, deepfakes, voice cloning