Federal prosecutors in Manhattan this week unsealed an indictment alleging that three people used AI to impersonate corporate CEOs and attorneys supposedly advising them, to persuade employees at multiple companies to wire nearly $130 million to accounts the group controlled.

How the executive impersonation scheme worked

According to the indictment, as reported by ABC News, Jacob Soall, Sharon Hazan, and Guy Sheetrit ran the scheme from July 2024 to February 2026. Prosecutors describe a consistent playbook.

An email that appeared to come from the CEO asked an employee for help with a confidential financial transaction. A phone or video call followed, with AI mimicking the CEO's voice and, in some cases, their face. The impersonated CEO then directed the employee to attorneys at large international law firms who were supposedly working on the deal. Those lawyers were impersonated as well. The final step was a wire transfer.

The victims named in the indictment span industries: hospital systems in Missouri and California, a bank in Rhode Island, a mutual fund company in Massachusetts, a pet food company in Florida, and a U.K. fintech. All of them lost millions.

All three defendants were arrested in Europe and are awaiting extradition.

A lowered barrier to entry

According to prosecutors, the operation was run by just three people. The material needed to impersonate an executive is largely public: earnings calls, keynotes, podcasts, and press interviews all capture a leader's voice and face.

"An audio deepfake is pretty easy to pull off if you've got a sample of maybe 20 or 30 seconds of someone speaking," GetReal Head of Threat Research Tom Cross has noted.

In 2024, the engineering firm Arup lost $25 million after a single deepfake video call. This case alleges a similar approach used repeatedly, across multiple companies, over roughly 19 months.

A familiar voice or face is no longer enough to securely confirm high-stakes business decisions.

Why human perception can't be the only control

Each step of the alleged scheme was aimed at the judgment and perception of the employee on the call. Framing the transaction as confidential limited who they might consult. Introducing a "lawyer" from a reputable firm provided what looked like independent confirmation of the CEO's request.

Deepfakes add a further problem: they target perception itself. Research, including from GetReal co-founder Dr. Hany Farid, has shown again and again that humans have approximately a coin flip’s chance of telling the difference between AI-generated faces and voices and real ones — and that’s in a controlled, lab setting.

Training can help employees recognize the pattern of a scam, but it can't reliably help them recognize a cloned voice or face. Common verification steps, like a callback or a quick video check, can be forged as well.

A control that depends on someone noticing that something is off will eventually fail against a convincing impersonation. Defending against deepfakes requires verification that doesn't rely on human perception alone.

How enterprises can defend against executive impersonation

Several steps raise the cost of this kind of attack:

Treat the pattern as a tripwire. Secrecy, urgency, a new beneficiary, and a third party introduced by the requester should trigger independent verification every time.
Verify outside parties through channels you already trust. Contact the law firm using contact details on file, never a number or address supplied in the request.
Don't accept a voice or face as proof of identity for wire transfers, credential resets, or the release of sensitive information.
Add technical verification to live calls. Real-time deepfake detection and continuous identity verification give employees and security teams incident alerts when something is detected, and provides evidence they can't produce on their own should an investigation be warranted.

Learn more about how GetReal protects leaders and the teams they work with from executive impersonation.

Verification has to extend beyond the person on the call

As AI voice and video tools continue to improve, cases like this one are likely to become more common.

For finance, treasury, and legal teams, a familiar voice or face on a call is no longer sufficient evidence of who or what is on the other end. Security teams must work across teams, in places where perimeters traditionally haven’t had to be raised, to ensure verification is built into the interaction itself.

‍

See How GetReal Stops AI Impersonation

Schedule a demo of GetReal Protect