The boss on the call was fake. Prosecutors say $129m was real

A New York courthouse. The charges are allegations, not convictions. Photo: Spencer Platt / Getty Images, via The Guardian.

The most dangerous person on a finance team's video call may be someone who is not on the call at all.

US prosecutors have charged three men over an alleged scheme that used AI-generated voices and images to impersonate senior executives and lawyers, persuading employees to send more than $129m to accounts controlled by the conspiracy. The allegations describe a familiar corporate weakness with a new delivery mechanism: authority is being counterfeited, not merely an email address.

The Guardian reports that Jacob Soall and Sharon Hazan were arrested in Spain over the summer, and Guy Sheetrit was arrested in the UK in September. The newly unsealed case concerns alleged conduct between 2024 and 2026. They face wire-fraud conspiracy, money-laundering conspiracy and aggravated identity-theft charges. Charges are not convictions; the defendants are presumed innocent unless proven guilty.

How the alleged trap worked

According to prosecutors' account, the initial approach came from someone apparently acting as a company's chief executive. An employee was told that a sensitive financial transaction required assistance and confidentiality. The supposed executive then introduced the idea of outside lawyers helping with the deal.

The next authority figure was also an impersonation, prosecutors allege. A fake lawyer supplied another layer of credibility before money was transferred. That is a stronger social-engineering setup than a solitary message demanding an urgent payment: two apparently independent professionals seem to corroborate the same request.

The alleged victims included hospital systems, a bank, a mutual fund, a pet-food company and a British technology business. The reported transfers include nearly $5m from a Missouri hospital system and more than $11m from the UK company. The $129m figure concerns the wider alleged scheme, not one employee or a single call.

Funds were allegedly directed through accounts in numerous jurisdictions, including the US, Spain, Portugal, Singapore and the UAE, then converted into cryptocurrency to conceal their origin and control. Prosecutors' description should not be read as a finding that every recipient account holder knew the source of the money.

Why seeing a face is no longer enough

The old security instinct was to move from text to voice, or from voice to video. That remains useful in some contexts, but it cannot establish identity when the communication channel itself is controlled by an attacker. A convincing face is a signal; it is not a bank-transfer authorisation.

The important distinction is between recognising a person and authenticating a request. An employee can believe they recognise the chief executive while still having no independent assurance that the proposed beneficiary account is legitimate.

This does not mean every strange video call is a deepfake. The danger is designing a payment process that requires staff to win an impersonation-detection contest before the company can protect its cash.

The boring controls are the valuable ones

The practical response is procedural rather than theatrical. Confirm unusual transfers through a separately sourced contact route, not a number supplied during the suspicious exchange. Require a second authorised person to approve changes to beneficiary details. Separate the person who requests a payment from the person who releases it.

Those are recommendations, not claims about which controls the alleged victims did or did not have. The public reporting does not provide a complete audit of their payment systems.

Confidentiality should also have limits. A purported executive who says a transaction is so secret that ordinary verification must be bypassed is asking the employee to remove the very safeguards that distinguish a genuine instruction from a persuasive performance.

The alleged fraud is alarming because it does not require AI to become omnipotent. It requires a company to treat a familiar voice, an impressive title and a plausible story as sufficient permission to move millions. The cheapest defence may still be an independently placed phone call and a colleague empowered to say no.

Source: The Guardian