Deepfakes Don’t Wire Money
In an alleged $129 million fraud, the fake lawyer's best line was a reason not to ask anyone.
“We need to loop you into a deal we’ve been working on,” read an email sent to an employee at a major New York investment bank on October 8, 2024. It was written as though it came from the CEO. It arrived through an electronic signature service, with a nondisclosure agreement attached and the name of an outside lawyer to call about setting up a compliance call later that day.
The email, reproduced in a federal indictment, sounds less like the opening move in a heist than like the start of a long afternoon at work.
Federal prosecutors in New York announced the indictment on November 5, 2026. It charges Jacob Soall, Sharon Hazan, and Guy Sheetrit with wire fraud, aggravated identity theft, and money laundering, and alleges that they and their co-conspirators targeted thousands of companies and took about $129 million. Authorities arrested all three in Spain or the United Kingdom, and extradition requests are pending. Lawyers for Soall and Sheetrit did not immediately respond to the Associated Press, and it was unclear whether Hazan had one. The men are presumed innocent, and nothing below has been proven in court.
The Justice Department’s press release calls the technology “super intelligence.” Jamie McDonald, the U.S. attorney whose office brought the case, called it “groundbreaking.” The indictment itself just says artificial intelligence, and the scheme it lays out runs on something much older.
Outside counsel would like a word
The targets, prosecutors say, were typically people in accounting with enough authority to approve a large wire. After the email, the group would try to get them on a phone or video call, using AI to mimic the CEO’s voice and, at times, the CEO’s image. The fake CEO would then send the employee to a lawyer at a major firm. Someone in the same operation would play the lawyer, and the lawyer would eventually tell the employee where to send the money.
The lawyers’ names were real. According to the indictment, the group generally borrowed the identities of actual attorneys at real firms, often among the 50 largest in the world. An employee who searched the name would likely find a real lawyer at a real firm.
A lawyer who already knows about the deal can sound like someone who’s independently vouching for it. And once that lawyer starts explaining why the deal is confidential, asking for a second opinion can start to feel like something you’d have to explain later.
The most revealing piece of technology in the case might be a handwritten script titled “Lawyer Call.” Prosecutors say Soall, who allegedly posed mainly as lawyers from the United Kingdom, kept it for his calls. One passage tells the employee that the company being acquired is publicly listed, so “confidentiality is a greater priority” for legal and regulatory reasons, with insider trading thrown in for weight. Then it turns to the question a careful employee might ask: “XYZ said you’d probably ask if anyone else had been NDA’d . . . answer is not yet.”
XYZ is the CEO. Someone had thought about the exact moment the employee would want to check, written down what to say when it came, and put the answer in the boss’s mouth. If you’re that employee, even a quiet word with the person at the next desk now feels like going around the CEO.
Who gets to hold the wire?
None of this is a chatbot behaving badly. No model malfunctioned. If prosecutors are right, the voice cloning did what it was pointed at, and most of what made it convincing was built around it: the e-signature email, the NDA, the borrowed law firm names, the script.
According to the indictment, the employee at the New York investment bank was deceived into authorizing a wire. The group was after about $2.85 million. The bank’s back office gets half a sentence in the filing. In that half sentence, it stops the wire. The filing doesn’t say what made it step in.
A month later, prosecutors say, a bank in Rhode Island lost about $2.68 million to the same routine. Hospital systems in Missouri and California, a mutual fund company in Massachusetts, a financial technology company in the UK, and a pet food company in Florida lost millions more.
At both banks, the con worked on the person it was aimed at. At one of them, it didn’t get past the people behind that person.
That’s the part I keep coming back to. When a scheme like this works, the story usually ends with whoever approved the wire. In New York, the employee was fooled too, and the money still didn’t leave, because someone further down the line could stop it.
Imagine hanging up and calling the CEO at a number the company already has. Even if the deal checks out, someone who wasn’t on the call still has to confirm the receiving account with information the callers didn’t supply. And the employee who holds the wire while that happens should be able to count on the company to back them, even if the caller really is the boss.