Prosecutors say three men used AI clones of executives and lawyers to take $129 million from hospitals and banks - eGamers.io
Three foreign nationals were charged in New York on Thursday for allegedly using AI clones of executives and lawyers to steal at least $129 million from hospitals, banks and other businesses.
The indictment, unsealed in the Southern District of New York, details a conspiracy that began with a seemingly ordinary request for an electronic signature and ended with the transfer of millions of dollars into cryptocurrency accounts.
The core of the fraud involved creating convincing digital replicas of real executives and lawyers. Prosecutors say the conspirators used artificial intelligence to copy the voices and, in some cases, the appearances of their victims on phone and video calls. This allowed them to pose as high-ranking officials authorizing secret financial transactions.
The process typically started with an email from a chief executive asking an employee to sign a nondisclosure agreement via a service like DocuSign. Once the employee was engaged, they were told to contact a lawyer for a compliance call. It was during this call that the AI-generated impersonators would take over.
Fake Lawyers and Handwritten Scripts
According to the indictment, one defendant, Jacob Soall, 41, of Marbella, Spain, and the United Kingdom, primarily posed as U.K. attorneys. He allegedly kept a handwritten script for these calls that focused on confidentiality and insider-trading concerns to prevent employees from discussing the supposed deal with colleagues.
The script was designed to create a sense of urgency and secrecy. Prosecutors allege that the conspirators used the AI clones to pass the employee to a fake attorney. This fake lawyer often adopted the identity of a real lawyer from the European office of one of the world’s 50 largest law firms.
Victims and Financial Losses
The victims are not named in the charging documents, but the alleged losses span several industries. A Missouri hospital system lost about $4.83 million in November 2024, and a Rhode Island bank lost about $2.68 million that same month. A California hospital system allegedly lost roughly $2.97 million in December 2024.
The largest single loss listed in the indictment is approximately $11.58 million from a U.K. financial technology company in March 2025. Prosecutors also allege that about $4.64 million was taken from a Massachusetts mutual fund company in April 2025 and about $5.24 million from a Florida pet food company in June 2025.
The New York investment bank mentioned in the indictment escaped the full loss. In an October 2024 attempt, its employee approved a roughly $2.85 million payment, but the bank’s back office halted the wire before it was sent.
Arrests and Legal Consequences
The three defendants face seven counts each, including conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy and two counts of money laundering. The wire fraud and money laundering charges carry a maximum of 20 years each, and each aggravated identity theft count carries two years.
Spanish authorities arrested Soall on June 17, and Sharon Hazan was arrested on August 5. Guy Sheetrit was arrested in the United Kingdom on September 7. Extradition requests are still pending, and all three are presumed innocent unless and until proven guilty.
As criminals continue to weaponize emerging technologies, the FBI remains committed to rapidly adapting our capabilities to identify, investigate, and disrupt those who seek to harm New Yorkers and businesses operating in our communities.
A Growing Threat in Crypto
The indictment notes that cryptocurrency has seen this playbook for years. Scammers have long used fake executives and recruiters in phishing campaigns to infect computers, steal funds or break into company systems. The roughly $625 million Ronin network hack in 2022, attributed to North Korea, reportedly started with a developer being contacted on LinkedIn.
Cybersecurity firm Mandiant has documented a scam where attackers hijacked a crypto executive’s Telegram account and arranged a meeting on a counterfeit Zoom interface. Staged audio problems gave them a reason to have the target run troubleshooting commands, which installed malware.
The use of AI in these scams is becoming more sophisticated. Binance recently described a fake hiring process at the center of an attack that drained approximately $6.3 billion from the exchange. A person posing as a project director approached an engineer through a legitimate job-hunting platform, followed by a fake human resources representative who conducted a video interview.
Related
