Fake Bosses, Real Losses: How AI Voice Clones Helped Steal $129 Million From Companies Around the World

Imagine you work in the accounts department of a hospital. One morning, you get an email from your chief executive. It is urgent and confidential: the company is about to make a big financial deal, and you need to move money right away. A few minutes later, your boss calls you. You hear their voice. You may even see their face on a video call. Everything sounds normal, so you send the money.

There is only one problem. Your boss never sent that email. They never made that call. The voice and the face belonged to a computer programme — an artificial intelligence (AI) tool that copied them.

That is what United States prosecutors say happened to companies around the world in a fraud worth about $129 million. On Thursday, 5 November 2026, a federal court in New York unsealed an indictment against three men accused of running the scheme for more than a year and a half. The case is one of the biggest examples yet of criminals using AI to impersonate real people and steal real money.

What happened

Federal prosecutors in Manhattan charged three men — Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42 — with using AI to pretend to be company chief executives and lawyers. According to the indictment, they targeted thousands of companies across the world over more than a year and a half.

The three men face seven counts each, including conspiracy to commit wire fraud, wire fraud, aggravated identity theft, and money laundering. If convicted, the fraud and money laundering charges each carry a maximum sentence of 20 years in prison. Aggravated identity theft carries a maximum of two years.

All three were arrested in Europe in recent months and are awaiting extradition to the United States. Spanish police detained Soall on 17 June and Hazan on 5 August. Britain’s National Crime Agency arrested Sheetrit on 7 September.

It is important to remember that these are charges, not convictions. The men are presumed innocent unless proven guilty in court.

How the scam worked

The scheme followed a simple but clever pattern, according to court documents reported by the Associated Press and other outlets. It had three steps.

Step 1: The email from the “boss”

First, an employee in a company’s accounts or finance department received an email that appeared to come from the chief executive. The email asked for help with a confidential financial transaction. It often created a sense of urgency — the deal was secret, the money had to move quickly, and the employee should not discuss it with colleagues.

This is a classic trick known as business email compromise. Criminals have used it for years. What made this case different was what came next.

Step 2: The call from the “boss”

Next, the defendants arranged a phone or video call. On the call, they used AI tools to mimic the voice of the chief executive — and in some cases, the executive’s image as well. The employee heard what sounded like their boss’s voice giving them instructions. On video calls, they may have seen a face that looked like their boss.

This is sometimes called a “deepfake” — an AI-generated copy of a person’s voice or face that can be very hard to tell apart from the real thing. In the past, criminals could only fake a written email. Now they can fake a live conversation.

Step 3: The fake lawyer

Finally, a person pretending to be a lawyer from a major law firm stepped in to direct the payment. The “lawyer” gave the employee the bank details and confirmed that everything was proper and legal. With the boss’s voice still fresh in their mind, the employee sent the money — often millions of dollars — to bank accounts controlled by the criminals.

The money was then moved through other accounts, prosecutors say, in an attempt to hide where it came from. That is the money laundering part of the charges.

Who was targeted

The indictment names several victims, and they show how wide the net was:

• A hospital system in Missouri lost about $4.8 million.
• A hospital system in California lost nearly $3 million.
• A bank in Rhode Island lost about $2.7 million.
• A financial technology company in the United Kingdom lost $11.6 million.
• A mutual fund company in Massachusetts lost about $4.6 million.
• A pet food company in Florida lost about $5.2 million.

These are only the victims named in the court documents. Prosecutors say thousands of companies around the world were targeted, and the total alleged theft comes to about $129 million.

Hospitals, banks, and ordinary businesses were all on the list. That is one reason the case has drawn so much attention: the victims were not careless individuals, but professional finance teams at established organisations.

Who are the three men?

The three defendants hold citizenship in several countries. Soall is from Spain and the United Kingdom. Hazan is from Israel. Sheetrit is from Israel and the United Arab Emirates.

Prosecutors say the men used nicknames among themselves, including “Rocky Balboa,” “Superman Cash,” and “Fat Boy.”

One of the men has a previous fraud conviction. In 2008, Hazan was convicted in a New York court of conspiracy to commit bank fraud, according to the US Attorney’s Office.

As of Thursday evening, the court records listing their defence lawyers were still sealed, and the US Attorney’s Office for the Southern District of New York had not immediately responded to questions from the Associated Press.

What the FBI says

The Federal Bureau of Investigation (FBI) helped investigate the case. FBI Assistant Director in Charge James C. Barnacle Jr. said the case shows how advanced technology can be used to commit large-scale fraud.

The FBI has asked anyone who believes they were targeted in this scheme to report it through its tips website, tips.fbi.gov.

Why this case matters

This is not the first time criminals have used AI to impersonate someone. But the size of this case — $129 million, thousands of targets, and more than 18 months of activity — makes it a warning sign for every business.

There are three reasons this case is important.

1. AI has made old scams much harder to spot

For years, security experts have warned employees: if you get a strange email from your boss asking for money, call them back and check. That advice still works — but only if the call itself cannot be faked. In this scheme, the criminals faked the call too. An employee who did the “right thing” and asked for a phone call could still have been tricked, because the voice on the other end sounded like the boss.

2. The tools are now cheap and easy to use

Cloning a voice used to need a lot of recordings and specialist skill. Today, AI tools can copy a person’s voice from a short audio clip — a speech, an interview, a video on the company’s website. A face can be copied from photos and videos that are already public. The technology that makes this possible is widely available, and it keeps getting better and cheaper.

3. No company is too small — or too careful — to be targeted

The victims in this case included hospitals and a bank. These are organisations with professional finance teams and security procedures. If they can be fooled, any business can. Small companies with fewer checks may be even more exposed, because a single employee may handle payments without a second person verifying them.

How businesses can protect themselves

Security experts say there are practical steps companies can take to reduce the risk of this kind of fraud. None of them is perfect, but together they make a scam much harder to pull off.

Agree on a secret word or code. A company can choose a word or phrase that only real senior staff know. If a “boss” calls with an urgent payment request and cannot give the code word, the employee should not send the money.

Use a second channel to verify. If a payment request arrives by email, confirm it through a different method — for example, a phone call to a number you already have saved, not a number given in the suspicious message. If a request arrives by phone or video call, confirm it by email or in person.

Require two people to approve large payments. A rule that any payment above a certain amount needs approval from two people makes it much harder for one tricked employee to send money alone.

Slow down urgent requests. Criminals rely on pressure. They want the victim to act before they have time to think. A simple rule — no large payment is ever truly urgent enough to skip the normal checks — removes their main weapon.

Train staff with real examples. Employees should know what AI voice and video cloning is, and that a familiar voice on a call is no longer proof of who is speaking. Regular training, using cases like this one, helps people recognise the pattern.

Limit public audio and video of senior staff. Companies may want to think about how much video and audio of their chief executive is freely available online, since that material can be used to train a voice or face clone.

What happens next

The three men are in custody in Europe while the United States seeks their extradition. Extradition is the legal process by which one country hands over a person accused of a crime to another country for trial. If they are extradited, they will face trial in a federal court in New York.

The case is still at an early stage. The indictment is an accusation, and prosecutors will need to prove the charges in court. But the case has already become a landmark example of a new kind of crime — one in which the criminal does not need to break into a computer system. They only need to sound like the boss.

As AI tools improve, experts expect more cases like this. The lesson for businesses is simple: trust, but verify — and verify through a channel the caller does not control.

Frequently asked questions

What is a deepfake?

A deepfake is a video, image, or audio clip made with artificial intelligence that copies a real person’s face or voice. The word comes from “deep learning,” a type of AI, and “fake.” Deepfakes can be used for entertainment, but they can also be used to trick people.

How much money was stolen in this case?

Prosecutors say about $129 million was stolen from companies around the world over more than a year and a half. The figure is an allegation in the indictment, not a finding by a court.

How did the criminals copy the executives’ voices?

According to the indictment, the defendants used AI tools to mimic the executives’ voices, and in some cases their images, on phone and video calls. The court documents do not name the specific AI products used.

Were the companies named?

Yes, several victims are named in the court documents by type and location, including hospital systems in Missouri and California, a bank in Rhode Island, a financial technology company in the United Kingdom, a mutual fund company in Massachusetts, and a pet food company in Florida. Their individual company names have not been widely reported.

What should I do if I think my company was targeted?

The FBI has asked anyone who believes they were a victim of this scheme to report it at tips.fbi.gov.

Are the three men guilty?

Not yet. They have been charged, but the charges are allegations. They are presumed innocent unless proven guilty in court. They have not yet been tried, and their extradition to the United States is still pending.

Conclusion

The $129 million AI impersonation case is a warning about how quickly crime is changing. The criminals in this case did not need to hack a single computer. They used AI to copy the voices and faces of company bosses, then asked employees to send money — and the employees believed them.

For businesses, the message is clear. A familiar voice is no longer enough. Payment requests, however urgent and however convincing they sound, should always be checked through a separate, trusted channel, and approved by more than one person. The technology that makes these scams possible will only get better. The defences need to keep up.

Sources

• Associated Press via The Korea Times, “3 charged in scheme to use AI to impersonate CEOs, attorneys to steal $129 mil.”, 6 November 2026: https://www.koreatimes.co.kr/amp/world/20261106/3-charged-in-scheme-to-use-ai-to-impersonate-ceos-attorneys-to-steal-129-mil
• PYMNTS, “FBI Charges Three in $129 Million AI Impersonation Scam”, 6 November 2026: https://www.pymnts.com/cybersecurity/identity-theft/2026/fbi-charges-three-129-million-dollar-ai-impersonation-scam/
• Ally Daily, “Feds charge trio with using AI to impersonate CEOs in $129 million fraud scheme”, 6 November 2026: https://allydaily.com/en/news/feds-charge-trio-with-using-ai-to-impersonate-ceos-in-129-million-fraud-scheme

This article is for general information and education only. It is not legal or financial advice.