Phishing · Identity · AI Security
AI-powered impersonation scam targeted companies worldwide, say US prosecutors
Three people have been charged with using AI to impersonate CEOs and lawyers, stealing $129 million from companies and hospitals. The group allegedly used fake emails, calls, and video to trick staff into wiring money.
Ross Grant2 min read
The short version
Three people are accused of using AI to pretend to be company leaders and lawyers, tricking staff into sending them $129 million. They targeted hospitals, banks, and other companies, often by faking emails and calls. The US authorities have arrested the suspects. This shows how AI can be used in scams and why companies need to verify unusual requests.
By the numbers
- $129 millionamount allegedly stolen in the scamSecurityWeek
- 3suspects charged with wire fraud and identity theftSecurityWeek
- thousandscompanies targeted worldwideSecurityWeek
What happened?
Three people have been charged in the US with using artificial intelligence to impersonate CEOs and lawyers, stealing about $129 million from companies worldwide. The group allegedly used fake emails, phone calls, and video to trick staff into wiring money. Victims included hospitals, banks, and other businesses. The case is based on an indictment filed in New York, according to SecurityWeek.
Who is affected
According to US prosecutors, the accused targeted thousands of companies across the world over a year and a half. Victims included hospital systems in Missouri and California, a bank in Rhode Island, a financial technology company in the UK, a mutual fund company in Massachusetts, and a pet food company in Florida. The group often focused on accounting departments, which handle financial transactions and payments.
How the attack worked
The indictment says the group used artificial intelligence (AI) to impersonate corporate executives and attorneys. First, they would send an email pretending to be the CEO, asking for help with a confidential financial transaction. Next, they would arrange a phone or video call, using AI to mimic the CEO’s voice and sometimes their image. This made the scam more convincing.
After the call, the victim would be told to contact an attorney at a well-known law firm. The group was ready for this: one member, Jacob Soall, mainly impersonated attorneys from the UK and used a handwritten script titled “Lawyer Call” to sound convincing. The fake attorney would then instruct the employee to wire large sums of money to bank accounts controlled by the group. The funds were quickly converted into cryptocurrency to hide their origin and then distributed among the conspirators.
The response
The three suspects, Jacob Soall, Sharon Hazan, and Guy Sheetrit, were arrested between June and September. They face charges of wire fraud, aggravated identity theft, and money laundering. The US Attorney’s Office for the Southern District of New York is leading the prosecution. The FBI’s Assistant Director in Charge, James C. Barnacle, Jr., said the case shows how criminals are using advanced technology to commit large-scale fraud, and that the FBI is adapting its methods to counter these threats.
What you should do
This case highlights the importance of verifying unusual requests for financial transactions, even if they appear to come from senior executives or trusted lawyers. Companies should train staff to spot signs of social engineering and use multi-step verification for large payments. If a request seems suspicious, confirm it through a separate, trusted channel before acting.
Why it matters
This case shows that AI tools can now be used to make scams much more convincing, putting even experienced staff at risk. It highlights the need for strong verification processes and staff training to prevent social engineering attacks.
Key points
- AI was used to impersonate CEOs and lawyers in a $129 million scam.
- Thousands of companies worldwide were targeted, including hospitals and banks.
- The attackers used fake emails, calls, and video to trick accounting staff.
- Funds were laundered through cryptocurrency to hide their origin.
- Staff training and strong verification processes are key to prevention.
Sources
SecurityWeek
Reference
