US prosecutors have charged three men over an alleged $129 million fraud in which AI impersonations of executives and lawyers persuaded employees around the world to transfer money to accounts controlled by a fraud network. Jacob Soall, Sharon Hazan and Guy Sheetrit are accused in a scheme allegedly operated between 2024 and 2026, with victims including hospitals, a bank and a UK fintech company.
The alleged approach began with someone posing as a CEO and presenting an employee with a transaction that was supposed to remain confidential. The supposed executive would then direct the employee to people presented as attorneys from major law firms, who prosecutors allege were also impersonators. AI-generated imitations of voices and images allegedly supported the effort to pass as executives and lawyers during contact with employees.
Prosecutors say one defendant possessed a script written by hand that was designed to deter employees from discussing the payment with colleagues. Reported losses included $11.6 million at a UK fintech company and $4.8 million at a hospital system in Missouri. Investigators say money moved through bank accounts internationally before being exchanged for cryptocurrency.
Authorities arrested Soall and Hazan in Spain and Sheetrit in the UK between June and September, with extradition pending. Each faces charges involving wire fraud, money laundering and aggravated identity theft. Sheetrit's lawyers deny his involvement, and the defendants remain presumed innocent unless their guilt is proven.
For employees handling payment requests, Bitdefender identifies demands for secrecy, unexpected transfer instructions and authority that cannot readily be checked independently as warning signs. It advises calling the purported executive on a number already known to be theirs and requiring approval from a second person before authorizing a transfer. The FBI also recommends checking payment requests through a separate communication channel.
Bitdefender offers RealCheck to assess suspicious recorded videos for AI manipulation and deceptive intent, but the tool cannot authenticate a live call. Its Scamio service can assess suspect messages and links, while independent confirmation remains necessary before transferring money.
Separately, a November 3 operation against investment fraud infrastructure resulted in seven arrests and the seizure of more than 100 servers. That case involved fraudulent investment platforms, potential victims across at least 50 countries and estimated losses above €4 million.
