# AI Voice Impersonation Ring Stole $129M From Global Companies > Three individuals charged with using AI to impersonate CEOs and attorneys in a global fraud scheme, stealing $129 million from diverse companies. - Published: 2026-11-06T04:13:30.000Z - Severity: medium - Category: Threat Intel - Tags: Wire Fraud, Social Engineering, Financial Crime, Identity Theft, AI Fraud - Author: Runtime Rebel Intel - Primary source: https://www.securityweek.com/3-charged-in-scheme-to-use-ai-to-impersonate-ceos-and-attorneys-to-steal-129-million/ - Canonical: https://runtimerebel.com/blog/ai-voice-impersonation-ring-stole-129m-from-global-companies ## Key points - A criminal syndicate used AI to impersonate executives and attorneys, stealing $129 million from global companies. - Thousands of companies across diverse sectors, including healthcare and finance, were targeted over 18 months. - Implement robust multi-factor verification for high-value transactions and train staff on AI-driven social engineering. Three individuals have been indicted on charges of wire fraud, aggravated identity theft, and money laundering for their alleged roles in a sophisticated scheme that leveraged artificial intelligence ([AI](/glossary#ai)) to impersonate corporate executives and attorneys, ultimately siphoning approximately $129 million from unsuspecting companies worldwide. The indictment, filed in a U.S. District Court in New York, reveals an operation that targeted thousands of businesses over more than a year and a half, underscoring the escalating threat posed by AI-powered [social engineering](/glossary#social-engineering). According to [SecurityWeek](https://www.securityweek.com/3-charged-in-scheme-to-use-ai-to-impersonate-ceos-and-attorneys-to-steal-129-million/), Jacob Soall, Sharon Hazan, and Guy Sheetrit were arrested between June and September. These individuals, with reported ties to Spain, the UK, Israel, and the United Arab Emirates, employed advanced tactics to defraud victims across diverse sectors, including hospital systems in Missouri and California, a bank in Rhode Island, a financial technology company in the United Kingdom, a mutual fund company in Massachusetts, and a pet food company in Florida. This widespread impact highlights the indiscriminate nature of such financially motivated cybercrime. ### Anatomy of an AI-Powered Impersonation Fraud The criminal methodology employed by the trio was multi-stage and highly deceptive, designed to [exploit](/glossary#exploit) trust and urgency within corporate financial departments. The scheme typically initiated with a [phishing](/glossary#phishing) email, carefully crafted to appear as if originating from a company's CEO. This initial communication would request assistance with a "confidential financial transaction," creating a pretext for subsequent interactions and bypassing standard protocols. Following the initial email contact, the fraudsters would coordinate phone or video calls. During these calls, they utilized AI-driven voice synthesis and, at times, visual [deepfake](/glossary#deepfake) technology to mimic the voice and image of the purported CEO. This technological sophistication allowed the attackers to overcome auditory and visual verification cues that might otherwise expose a typical social engineering attempt. The seamless integration of AI in these interactions made the impersonation highly convincing, eroding the target's ability to discern genuine communication from fraudulent activity. After establishing credibility as the CEO, the victim would be directed to contact an "attorney" from a major law firm, who was also an accomplice within the fraud ring. Jacob Soall, in particular, specialized in impersonating UK-based attorneys, even utilizing a "handwritten script titled ‘Lawyer Call’" to enhance the authenticity of his deception. This impersonated attorney would then instruct the targeted employee to execute large wire transfers to various bank accounts established globally by the fraudsters. To further obscure the illicit financial trail, the stolen funds were subsequently converted into cryptocurrency and distributed among the perpetrators and their associates. This tactic, often observed in sophisticated financial crimes, aims to complicate asset tracing and recovery efforts. This case serves as a stark reminder of the evolving landscape of financially motivated cyber threats, particularly in how to detect AI voice deepfake attacks. The FBI Assistant Director in Charge, James C. Barnacle, Jr., noted that this case exemplifies how advanced technology can be weaponized for large-scale fraud, emphasizing the need for rapid adaptation in investigative capabilities. ## Mitigating AI-Powered Impersonation Fraud Organizations must proactively enhance their defenses against these increasingly sophisticated social engineering tactics. Preventing CEO fraud and wire transfer scams requires a multi-layered approach that combines technological controls with rigorous employee training and established verification protocols. #### Actionable Recommendations for Defenders: * **Reinforce Payment Verification Protocols:** Implement strict multi-factor authentication and verification processes for all financial transactions, especially those involving large sums or external transfers. This should include mandatory out-of-band verification (e.g., a call back to a known, pre-registered phone number, not one provided in an email) for any high-value wire transfers, regardless of the sender's apparent identity. * **Conduct Targeted Awareness Training:** Educate employees, particularly those in finance, accounting, and executive support roles, on the dangers of AI-driven impersonation and deepfake technologies. Training should cover how to identify anomalies in voice, speech patterns, and video, as well as the importance of verifying unusual requests through established, secure channels. * **Implement Anti-Phishing and Email Security Solutions:** Deploy advanced email security gateways capable of detecting sophisticated phishing attempts, including those designed to spoof executive identities or create urgency around financial transactions. Regularly update these systems and conduct simulated phishing exercises. * **Review and Strengthen Internal Controls:** Establish clear, documented policies for approving and executing financial transfers. Ensure that no single individual can authorize a significant payment and that multiple layers of approval and verification are required. * **Verify New Contacts Independently:** When instructed to contact an attorney or external party for a sensitive transaction, employees should verify the contact details independently through official, publicly available channels (e.g., law firm's official website) rather than relying on information provided in the suspicious email or call. * **Consider Voice and Video Authentication:** For organizations handling extremely sensitive transactions or communications, explore technologies that can authenticate voice and video against known biometric profiles, though these are still evolving. This incident underscores that while AI offers immense potential, its misuse by criminal elements necessitates a heightened state of vigilance and continuous adaptation of security strategies to combat emerging threats. **Related:** [AI Agent Social Engineering: The Future of BEC by 2026](/blog/ai-agent-social-engineering-the-future-of-bec-by-2026), [Spring Ring Voice Phishing Targets Microsoft Teams Users](/blog/spring-ring-voice-phishing-targets-microsoft-teams-users) --- AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/ai-voice-impersonation-ring-stole-129m-from-global-companies