US DOJ charges three men over $129M deepfake BEC scheme impersonating CEOs and law firm attorneys
The U.S. Department of Justice unsealed an indictment in the Southern District of New York charging three foreign nationals — Jacob Soall (41), Sharon Hazan (54) and Guy Sheetrit (42) — with running an international business email compromise (BEC) scheme that used AI-generated deepfakes of corporate executives and impersonated attorneys to divert at least US$129 million (about R$710 million) from hospitals, banks and other companies. Prosecutors say the operation targeted thousands of companies worldwide and focused on accounting and finance staff authorized to approve large wire transfers, with proceeds converted into cryptocurrency. The indictment was unsealed on Thursday by the U.S. Attorney's Office in Manhattan, which says the men posed as executives and lawyers on calls and laundered the money through crypto (thenextweb.com). Soall was arrested in Spain on 17 June 2026, Hazan in Spain on 5 August 2026 and Sheetrit in the United Kingdom on 7 September 2026, with extradition requests pending (townhall.com). This is a law-enforcement and fraud story rather than a technical vulnerability: there is no CVE, malware family or IOC, but the tradecraft is directly relevant to payment-approval controls.
Detalhes técnicos
The approach typically began with an email apparently sent by the company president requesting help with a confidential transaction; in one case a non-disclosure agreement was attached to lend credibility. Targets were then moved to phone or video calls with a person posing as an outside attorney, where AI was used to reproduce the voice and, in some cases, the appearance of real executives. The fake lawyer explained the supposed deal and supplied the destination accounts. Prosecutors describe roughly a year and a half of cloning voices and faces of real executives to push corporate finance teams into wiring funds (startupfortune.com). Each defendant faces seven counts including wire fraud and aggravated identity theft (aiweekly.co); Soall allegedly played the attorney role while Hazan and Sheetrit handled laundering. Soall allegedly worked from a handwritten script titled "Lawyer Call" (newscord.org). Named losses include a Missouri hospital network (~US$4.83M, November 2024), a Rhode Island bank (~US$2.68M, November 2024), a California hospital network (~US$2.97M, December 2024), a UK fintech (~US$11.58M, March 2025), a Massachusetts investment fund (~US$4.64M, April 2025) and a Florida animal-feed maker (~US$5.24M, June 2025). A ~US$2.85M payment authorized at a New York investment bank in October 2024 was stopped by the institution's operations team. Hazan was previously convicted in 2008 of conspiracy to commit bank fraud in the same district.
Remediação
Enforce out-of-band callback verification to known-good numbers for any payment-instruction change or "confidential deal" request, require dual authorization for high-value wires, and treat urgency, secrecy and NDAs as fraud indicators. Train finance and accounting staff that voice and video on a live call are no longer proof of identity, and rehearse rapid wire-recall procedures with the bank.
Linha do tempo
-
US DOJ charges three men over $129M deepfake BEC scheme impersonating CEOs and law firm attorneys
ler a análise desta fonte ocultar
The U.S. Department of Justice unsealed an indictment in the Southern District of New York charging three foreign nationals — Jacob Soall (41), Sharon Hazan (54) and Guy Sheetrit (42) — with running an international business email compromise (BEC) scheme that used AI-generated deepfakes of corporate executives and impersonated attorneys to divert at least US$129 million (about R$710 million) from hospitals, banks and other companies. Prosecutors say the operation targeted thousands of companies worldwide and focused on accounting and finance staff authorized to approve large wire transfers, with proceeds converted into cryptocurrency. The indictment was unsealed on Thursday by the U.S. Attorney's Office in Manhattan, which says the men posed as executives and lawyers on calls and laundered the money through crypto (thenextweb.com). Soall was arrested in Spain on 17 June 2026, Hazan in Spain on 5 August 2026 and Sheetrit in the United Kingdom on 7 September 2026, with extradition requests pending (townhall.com). This is a law-enforcement and fraud story rather than a technical vulnerability: there is no CVE, malware family or IOC, but the tradecraft is directly relevant to payment-approval controls.
Technical Details
The approach typically began with an email apparently sent by the company president requesting help with a confidential transaction; in one case a non-disclosure agreement was attached to lend credibility. Targets were then moved to phone or video calls with a person posing as an outside attorney, where AI was used to reproduce the voice and, in some cases, the appearance of real executives. The fake lawyer explained the supposed deal and supplied the destination accounts. Prosecutors describe roughly a year and a half of cloning voices and faces of real executives to push corporate finance teams into wiring funds (startupfortune.com). Each defendant faces seven counts including wire fraud and aggravated identity theft (aiweekly.co); Soall allegedly played the attorney role while Hazan and Sheetrit handled laundering. Soall allegedly worked from a handwritten script titled "Lawyer Call" (newscord.org). Named losses include a Missouri hospital network (~US$4.83M, November 2024), a Rhode Island bank (~US$2.68M, November 2024), a California hospital network (~US$2.97M, December 2024), a UK fintech (~US$11.58M, March 2025), a Massachusetts investment fund (~US$4.64M, April 2025) and a Florida animal-feed maker (~US$5.24M, June 2025). A ~US$2.85M payment authorized at a New York investment bank in October 2024 was stopped by the institution's operations team. Hazan was previously convicted in 2008 of conspiracy to commit bank fraud in the same district.
Remediation
Enforce out-of-band callback verification to known-good numbers for any payment-instruction change or "confidential deal" request, require dual authorization for high-value wires, and treat urgency, secrecy and NDAs as fraud indicators. Train finance and accounting staff that voice and video on a live call are no longer proof of identity, and rehearse rapid wire-recall procedures with the bank.