DOJ charges three men over AI deepfake BEC scheme that defrauded companies of at least $129M
The U.S. Department of Justice announced charges against Jacob Soall, Sharon Hazan and Guy Sheetrit for an alleged years-long business email compromise scheme that used AI-generated deepfakes of CEOs and of attorneys at some of the world's 50 largest law firms to steal at least $129 million. Court records say the trio and co-conspirators targeted thousands of victims between July 2024 and February 2026, selecting employees with authority to approve large wire transfers. Named losses include a UK fintech (~$11.6M), a Florida pet food company ($5.2M), a Missouri hospital system ($4.8M), a Massachusetts mutual fund company ($4.6M), a California hospital system (~$3M), a New York investment firm ($2.8M) and a Rhode Island bank (~$2.7M). Funds were wired to accounts in the United States, Spain, Portugal, Greece, the UAE, Singapore, Austria, Slovakia and China, then converted to cryptocurrency and split among the conspirators. Soall was arrested in Spain on June 17, Hazan in Spain on Aug. 5 and Sheetrit in the United Kingdom on Sept. 7; the seven counts carry a maximum of 104 years. Reporting by itpro.com corroborates the DOJ figures and the roles attributed to each defendant (itpro.com).
Detalhes técnicos
The social engineering chain began with an email purportedly from an e-signature provider, in which the impersonated CEO described a "confidential financial transaction" and required the targeted employee to sign an NDA before contacting a supposed outside counsel. The crew then impersonated that attorney, using AI-cloned voices and images to validate the transaction; Soall allegedly voiced UK-based lawyers from a handwritten script. Hazan allegedly claimed to have laundered money since 1994, including more than $400 million in the past three years, and was convicted of bank fraud conspiracy in the Southern District of New York in 2008. No malware, CVEs or technical indicators are involved — the scheme relies entirely on impersonation and payment-process abuse.
Remediação
Finance and accounts-payable teams should enforce out-of-band callback verification on a known-good number for any payment change or "confidential" transaction, treat secrecy and NDA pressure as a red flag, require dual authorisation above a threshold, and verify outside counsel through the firm's published contacts rather than details supplied in the request. Voice and video calls must no longer be accepted as proof of identity.
Linha do tempo
-
DOJ charges three men over AI deepfake BEC scheme that defrauded companies of at least $129M
ler a análise desta fonte ocultar
The U.S. Department of Justice announced charges against Jacob Soall, Sharon Hazan and Guy Sheetrit for an alleged years-long business email compromise scheme that used AI-generated deepfakes of CEOs and of attorneys at some of the world's 50 largest law firms to steal at least $129 million. Court records say the trio and co-conspirators targeted thousands of victims between July 2024 and February 2026, selecting employees with authority to approve large wire transfers. Named losses include a UK fintech (~$11.6M), a Florida pet food company ($5.2M), a Missouri hospital system ($4.8M), a Massachusetts mutual fund company ($4.6M), a California hospital system (~$3M), a New York investment firm ($2.8M) and a Rhode Island bank (~$2.7M). Funds were wired to accounts in the United States, Spain, Portugal, Greece, the UAE, Singapore, Austria, Slovakia and China, then converted to cryptocurrency and split among the conspirators. Soall was arrested in Spain on June 17, Hazan in Spain on Aug. 5 and Sheetrit in the United Kingdom on Sept. 7; the seven counts carry a maximum of 104 years. Reporting by itpro.com corroborates the DOJ figures and the roles attributed to each defendant (itpro.com).
Technical Details
The social engineering chain began with an email purportedly from an e-signature provider, in which the impersonated CEO described a "confidential financial transaction" and required the targeted employee to sign an NDA before contacting a supposed outside counsel. The crew then impersonated that attorney, using AI-cloned voices and images to validate the transaction; Soall allegedly voiced UK-based lawyers from a handwritten script. Hazan allegedly claimed to have laundered money since 1994, including more than $400 million in the past three years, and was convicted of bank fraud conspiracy in the Southern District of New York in 2008. No malware, CVEs or technical indicators are involved — the scheme relies entirely on impersonation and payment-process abuse.
Remediation
Finance and accounts-payable teams should enforce out-of-band callback verification on a known-good number for any payment change or "confidential" transaction, treat secrecy and NDA pressure as a red flag, require dual authorisation above a threshold, and verify outside counsel through the firm's published contacts rather than details supplied in the request. Voice and video calls must no longer be accepted as proof of identity.