Three charged in New York with using AI to impersonate executives and steal about $129 million
For the treasury services head at a regional bank
Three people were indicted in U.S. District Court in New York on charges of wire fraud and aggravated identity theft for allegedly using artificial intelligence to impersonate executives and attorneys and steal about $129 million, prosecutors said Thursday.1
According to court documents, the defendants often targeted accounting departments with an email purporting to be from the CEO that asked for help with a confidential financial transaction.1 The indictment says they then arranged a phone or video call in which they used AI to mimic the CEO's voice and sometimes image, and told the employee to contact an attorney at a major law firm, whom the group was also ready to impersonate.1
According to court documents, the impersonated attorney would tell the employee to wire large payments to bank accounts across the world. The funds were then converted into cryptocurrency to try to conceal where they came from, according to court documents.1
The defendants, Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42, are from Spain, the U.K., Israel and the United Arab Emirates, and were also charged with money laundering, according to the indictment. CBS/AP reported that over more than a year and a half they targeted thousands of companies across the world, according to the indictment.1
Court documents list victims including hospital systems in Missouri and California, a bank in Rhode Island, a financial technology company in the United Kingdom, a mutual fund company in Massachusetts and a pet food company in Florida.1
The U.S. Attorney's Office said Soall mainly impersonated attorneys from the U.K. and used a handwritten script titled 'Lawyer Call'. If convicted, the defendants face a maximum of 20 years, except for aggravated identity theft, which carries a maximum of two years, according to the attorney's office. CBS/AP reported that the three were arrested between June and September, Soall and Hazan in Spain and Sheetrit in the U.K., and that extradition requests for all three are pending.1
These are charges, not convictions. The alleged scheme supplied the CEO email, the call and the lawyer, so a callback or confirmation using contact details the requester provided would not have exposed it; payment controls may need to rely on contact details already on file.
CBS/AP reported that extradition requests for all three defendants are pending; the sources did not give a trial date.1
Our take. A callback rule assumes the person on the other end is hard to fake. Prosecutors say this ring faked the CEO on video, then supplied the lawyer to call. One victim was a bank.
Action. Treasury services: Require corporate wire callbacks to numbers on file at onboarding, never to contacts supplied in the request email or call.