Federal prosecutors in Manhattan have charged three foreign nationals in what may become one of the clearest business cases yet for redesigning payment controls around AI-era impersonation. In a DOJ announcement unsealed Nov. 5, the Southern District of New York said Jacob Soall, Sharon Hazan and Guy Sheetrit used synthetic CEO and attorney voices or images in an alleged 2024–2026 scheme that pulled more than $129 million from companies worldwide. They face wire-fraud, aggravated identity-theft and money-laundering charges; prosecutors said Soall and Hazan were arrested in Spain and Sheetrit in the U.K., with extradition requests pending.
The question many executives should be asking is not whether a deepfake can look convincing. It is what a business must change when a payment request can arrive with a familiar voice, a plausible face, and a supposedly independent lawyer backing it up. On the facts now public, the weak point was not an autonomous AI system breaking into corporate infrastructure. It was a payment workflow willing to treat identity signals as authorization.
How the alleged fraud turned authority into money
According to prosecutors, the scheme followed a disciplined social-engineering script. An employee, often in accounting, would receive an email appearing to come from a CEO who needed help with a confidential transaction. A call would follow in which the speaker allegedly used AI-enabled voice or image mimicry to reinforce the impression that the request was real. The employee was then directed to supposed lawyers at major international law firms, who were also allegedly being impersonated, creating a second layer of authority before the employee was told to wire money.
That detail matters more than the novelty of the software. The attack was designed to answer the usual internal objections before they could be raised: the request looked executive, sounded executive, appeared legally vetted, and came wrapped in secrecy language that discouraged checking with colleagues. Prosecutors say the proceeds were routed through accounts in multiple countries and converted into cryptocurrency. DOJ named losses that included about $4.83 million from a Missouri hospital system, $2.68 million from a Rhode Island bank, $11.58 million from a U.K. fintech company, $4.64 million from a Massachusetts mutual fund company, and other victims across sectors. AP reported that thousands of companies were targeted over more than a year and a half.
Why “call them back” is no longer enough
This case is a warning against an outdated control reflex: if a request seems suspicious, call the executive back. That still helps only if the callback uses a number from a trusted directory, not the one supplied in the message or introduced during the same exchange. Once a fraudster can control the initial email, the live call, and the apparent legal confirmation, a one-channel check becomes a circular exercise. The employee is not verifying the request independently; the employee is staying inside the attacker’s script.
That is why the practical lesson is bigger than deepfake detection. A business has to verify both identity and authority, and those are different things. Even a genuine executive can be wrong, rushed, or operating outside policy; a convincing fake simply raises the odds that someone will skip the policy check altogether. Live audio and video now belong in the category of evidence to evaluate, not proof to trust. Banks, hospitals, law firms, fintech companies, fund managers and multinational businesses are especially exposed because they combine high-value payments, many approvers, time-zone handoffs and frequent exceptions.
The workflow changes this indictment points to
The most useful response is not to ask staff to become media-forensics experts. It is to make payment processes resilient even when the voice sounds right. High-value or unusual wires should require verification through a known, independently sourced channel. Beneficiary changes and confidential transactions should trigger dual approval. No executive or outside lawyer should be the sole basis for sending funds. Payment instructions should be matched against pre-approved records, and exceptions should be slowed down rather than accelerated by urgency language.
That redesign reaches beyond accounts payable. Treasury teams own wire controls, but legal departments need policies on how outside counsel approves transactions, security teams need escalation playbooks, HR and executive assistants often maintain the trusted contact data that make out-of-band verification possible, and senior leadership has to signal that delaying a questionable request is a good outcome, not a career risk. A mandatory cooling-off period for unusual transfers, a second executive signoff, verified callback numbers, and transaction-anomaly checks will usually do more for risk reduction than any promise that software can perfectly spot synthetic speech or imagery.
The public filings do not yet answer several questions that matter for long-term forecasting: the exact tools used, the success rate of the impersonations, how much money was recovered, whether banks blocked some transfers, or whether any victim systems were technically compromised rather than manipulated through trust. DOJ used the phrase “super intelligence,” but the operational takeaway does not depend on a particular model, vendor or breakthrough. If one plausible call can still unlock an irreversible transfer, the control failure is already large enough.
That is what gives this prosecution its staying power after the headline fades. Companies do not need to assume every call is fake. They do need to assume that voice, image and title can all be staged in the same request, and that ordinary approval paths can be chained together against them. The organizations that adapt fastest will be the ones that treat unusual payment requests as a process event requiring independent confirmation, even when the person asking sounds exactly like the boss.
By
By
By
By
By
