The CEO on the Call Wasn’t Real. $129 Million Walked Out.

The chief executive was on the video call. His face was right. His voice was right. He had an urgent, confidential transaction that needed the employee’s help, and he had a lawyer ready to walk them through it.

None of it was real. The executive was a deepfake. The lawyer was a deepfake. And by the time anyone figured that out, more than $129 million had walked out of companies around the world.

US authorities have now indicted three men — Jacob Soall, Sharon Hazan, and Guy Sheetrit — for an alleged AI-powered impersonation scheme that prosecutors say stole that money from companies in the United States and around the world. They face wire fraud, aggravated identity theft, and money laundering charges, and up to 104 years in prison if convicted. Soall was arrested in Spain on June 17, 2026, Hazan in Spain on August 5, and Sheetrit in the United Kingdom on September 7. Extradition requests are pending.

How the scheme worked

According to the indictment, the group and their co-conspirators built deepfakes of corporate executives at numerous companies and attorneys at major law firms, then used them to pressure employees into sending large payments.

The play ran in four moves:

1. The fake CEO call. The suspects approached employees of the companies they targeted, mimicking the voice and image of the business’s chief executive on calls. The “CEO” told the worker they needed help carrying out a confidential financial transaction.
2. The fake lawyer. The employee was directed to lawyers at large international law firms supposedly working on the transaction — and the suspects impersonated those lawyers too.
3. The wire transfer. The employee was ordered to wire large sums of money into bank accounts controlled by members of the conspiracy — in Austria, China, Greece, Portugal, Singapore, Slovakia, Spain, the United Arab Emirates, and the United States.
4. The crypto wash. Once the money landed, it was converted into cryptocurrency to hide where it came from, then distributed among the conspirators.

“The alleged scheme orchestrated by Soall, Hazan, and Sheetrit demonstrates how the use of advanced technology can be exploited to commit large-scale fraud,” FBI Assistant Director in Charge James C. Barnacle, Jr. said in the Justice Department’s statement. “As criminals continue to weaponize emerging technologies, the FBI remains committed to rapidly adapting our capabilities to identify, investigate, and disrupt those who seek to harm New Yorkers and businesses operating in our communities.”

Why this is different from the usual CEO fraud

Business email compromise — the classic “CEO needs a wire transfer” scam — has drained companies for years. What changed here is the medium. A spoofed email can be checked. A video call with a face and voice that look and sound like your chief executive is much harder to doubt in the moment, especially when a second “lawyer” on another call confirms the story.

The technology did not create a new kind of fraud. It removed the tells that used to give the old kind away. The employee who wired the money was not careless — they were shown two people they believed they knew, saying the same thing, in real time.

The sums show how well it worked: $129 million, moved through nine countries and laundered through cryptocurrency, from companies with finance staff, legal counsel, and approval processes — and still paid.

What companies should check now

Four controls would have broken this scheme, and every one is worth testing this week:

1. Out-of-band confirmation for large transfers. No payment above a set threshold should move on one call or message, however senior the caller appears. Confirm it through a second, independent channel — a number you already have, not one the caller gives you.
2. A callback rule, written down and enforced. If the “CEO” calls with an urgent confidential payment, the procedure should be to hang up and call them back on a known number. Deepfakes can join a call. They cannot answer your callback.
3. A code word for executives. A simple shared phrase, changed regularly, gives staff something a deepfake cannot know — and a reason to pause a call that feels wrong.
4. Dual approval on wires, no exceptions for urgency. Confidentiality and time pressure were the scheme’s weapons. A rule that no single person can authorize a large transfer — even for the CEO — removes the leverage.

The arrests here are a win, but they are not the end of the pattern. The same week this indictment surfaced, attackers were reselling stolen AI access and running up million-dollar bills on victims’ accounts — a different crime, the same shift. AI is now the tool on both sides of the ledger: it finds the vulnerabilities, it fakes the voices, and it launders the money.

That means the defense has to change too. Training that tells staff to “look for the signs of a phishing email” is not enough when the attack arrives as a face on a video call. The control that works is a procedure that does not depend on anyone’s ability to spot a fake — a callback, a second approver, a rule that urgency never overrides. The $133 million French bank heist showed how fast stolen money moves once it leaves; this case shows how convincingly the instruction to move it can now be delivered.

The next call from your CEO might be real. Verify it anyway.