She opened an email that looked exactly like it came from her CEO and clicked the attached NDA. Moments later a call mimicked the executive’s voice and instructed a secret wire transfer. It felt like a ventriloquist had stolen the executive’s mouth, and by the time anyone realized, millions were gone.
I’ve followed fraud cases for years, and I want you to see how this one unfolded so you can spot the warning signs before they hit your inbox or phone. The Southern District of New York unsealed an indictment this week charging three foreign nationals in a sprawling scheme prosecutors say stole at least $129 million (€120 million) from hospitals, banks, and other businesses.
The defendants named are Jacob Soall, 41, of Marbella and the U.K.; Sharon Hazan, 54, of Israel; and Guy Sheetrit, 42, of Israel and the United Arab Emirates. Each faces seven counts, including conspiracy to commit wire fraud, aggravated identity theft, and money laundering; wire fraud and money laundering carry potential maximum sentences of 20 years, aggravated identity theft two years per count. Arrests were made in Spain and the U.K.; extradition requests are pending.
“As criminals continue to weaponize emerging technologies, the FBI remains committed to rapidly adapting our capabilities,” said FBI Assistant Director in Charge James C. Barnacle, Jr., and U.S. Attorney Jamie McDonald warned about what he called “super intelligence” even as the indictment uses the term “artificial intelligence.”
An accounting clerk got an NDA email — How the alleged scam worked
One mid-level employee, trusted to sign off on transfers, opened an innocuous DocuSign message and found themselves at the center of a fake deal.
According to the indictment, the conspiracy ran from about July 2024 through February 2025 and targeted thousands of companies. The playbook was simple and precise: an email sent via an electronic-signature service like DocuSign showed an NDA that appeared to come from a CEO, followed by instructions to contact an attorney for a confidential compliance call. The next step was the call.
On those calls, conspirators allegedly used AI to impersonate executives’ voices and sometimes even their faces on video. The faux executive would then be routed to a fake lawyer — often borrowing the identity of a real lawyer in a European office of a major firm — who described a secret acquisition and told the employee where to wire funds. Prosecutors say the destination accounts belonged to the conspirators, who quickly converted the money into crypto and split it.
Soall is accused of primarily impersonating U.K. attorneys and keeping a handwritten “Lawyer Call” script to guide targets. Hazan and Sheetrit are accused of steering the money laundering. Prosecutors allege Hazan bragged about laundering since 1994 and claimed to have laundered more than $400 million (€372 million) in the prior three years, calling himself “number one all over the world.”
How did AI deepfakes impersonate executives to steal money?
You should assume the voice you hear on a call can be fabricated. Attackers combined spearphishing, stolen contact accounts (often via Telegram) and AI voice models. They used video overlays and synthetic audio to create believable interactions, then relied on secrecy and perceived authority to persuade accounting staff to wire funds. I’ve seen similar social-engineering arcs in cases tied to Telegram and compromised Zoom or Microsoft Teams interfaces.
A Missouri hospital lost about $4.83 million — Hospitals, banks, and a pet food company
Hospital finance offices are busy places; attackers bet on low friction and trust.
The indictment lists victims across industries without naming companies: a Missouri hospital system allegedly lost about $4.83 million (€4.5 million) in November 2024; a Rhode Island bank about $2.68 million (€2.5 million) that same month; a California hospital system about $2.97 million (€2.8 million) in December 2024.
Other alleged thefts include roughly $11.58 million (€10.8 million) from a U.K. fintech firm in March 2025, about $4.64 million (€4.3 million) from a Massachusetts mutual fund company in April 2025, and approximately $5.24 million (€4.9 million) from a Florida pet-food company in June 2025. One attempted transfer for roughly $2.85 million (€2.7 million) at a major New York investment bank was stopped by back-office controls before the wire left the bank.
These numbers stack quickly into that $129 million total because the scheme cast a wide net and relied on repeated, high-dollar tries.
Can banks stop wire fraud using AI?
Yes, but only if controls and human skepticism keep pace with attack sophistication. Back-office reconciliation and hold procedures caught at least one attempted transfer here; AI alone can’t save you if policies aren’t enforced. Firms should combine anomaly detection, strong vendor verification, multi-party approvals for large or unusual wires, and training that focuses on the specific ploys used: fake NDAs, synthetic voices, and bogus attorney identities.
Security teams saw familiar tricks — Deepfakes and impersonation commonly used in crypto hacks
Crypto-focused security shops have been seeing these TTPs for years: fake recruiters, bogus interviews, and counterfeit meeting interfaces.
This is a known pattern in crypto theft. In 2022 the Ronin network lost roughly $625 million (€581 million) after attackers used social engineering and malware; prosecutors later tied other campaigns to fake job offers and compromised accounts. Binance recently attributed a multi-billion-dollar loss to a multistage campaign involving a fake recruitment process and malicious code delivered during a staged interview — the exchange said attackers ultimately drained about $6.3 billion (€5.9 billion).
Investigators like ZachXBT and firms such as Mandiant and the Security Alliance have documented schemes that use compromised accounts and counterfeit Zoom or Microsoft Teams interfaces to trick targets into running commands or revealing secrets. The result is a maze that behaves like a house of mirrors: every reflection looks real until you try to find the exit.
The indictment also notes parallels to other high-profile cases: a separate investigation connected a U.S. Marshals Service contractor’s family member to a roughly $46 million (€42.8 million) theft from seized crypto holdings after a Telegram account linked to him exposed control of the wallet. These are not isolated curiosities; they’re the playbook moving into corporate finance.
I’ll leave you with one point that matters when the next fake-CEO call hits your desk: authority can be imitated, but procedures and a single skeptical question can stop an expensive mistake — will your organization ask the right question when the phone rings?
More than 10 of my bitcoin friends got hacked in the past month. All had 2FA enabled. It didn’t help. Here’s how they almost got me too
HOW THEY FOOL YOU
1⃣ Someone from your contacts messages you to schedule a call. This is already a stolen account. A friend who got scammed… pic.twitter.com/UmFi06Hi5p
— Kristian Csepcsar (@KristianCsep) January 27, 2026