CEO Voice Cloning Shows a New Gap for Payment Approvals

CEO voice cloning helped an alleged impersonation scheme steal approximately $129 million, prosecutors say. The group targeted thousands of companies, using fake executives and purported lawyers to solicit wire transfers. Federal prosecutors in New York say three men used AI copies of chief executives’ voices, then added a second fake voice, a lawyer, to give the order to wire the money. A shared code word is the usual advice for voice scams, but the reporting does not establish that a properly enforced code-word check on the first contact would have failed.

The U.S. Attorney’s Office for the Southern District of New York announced the charges Thursday, the Associated Press reported on PBS NewsHour. Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42, face counts of wire fraud, aggravated identity theft and money laundering, according to AP. CyberScoop, which reviewed the unsealed indictment, counted seven charges with a combined maximum of 104 years in prison. These are allegations, and no one has been convicted in this case.

What prosecutors say the CEO voice cloning scheme did

The scheme ran from July 2024 to February 2026 and targeted thousands of companies, according to court records cited by CyberScoop. The reporting reviewed does not establish how many of those companies lost money. It started with accounting staff, the employees who can approve large wire transfers. An email, sent in the name of the company’s CEO, asked for help with a confidential financial transaction.

In the indictment as CyberScoop described it, the fake CEO required the employee to sign a nondisclosure agreement before speaking with a purported attorney. AP reported that the group then arranged a phone or video call in which AI mimicked the CEO’s voice and sometimes the CEO’s image. Neither outlet says which tools were used.

The second fake is the real lesson

The employee was then sent to a lawyer, who was also an impersonator. Both outlets report that the crew posed as attorneys at major law firms, and CyberScoop said some were among the 50 largest firms in the world. AP reported that Soall mainly posed as British attorneys and used a handwritten script titled “Lawyer Call.”

The supposed attorney told the employee to wire large payments to bank accounts around the world. CyberScoop listed accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China. The money was converted to cryptocurrency and divided among the participants, according to both outlets.

That sequence matters for anyone who relies on a shared secret. In this CEO voice cloning scheme, the CEO’s voice was not the only voice involved. The instruction to move money came from a second voice, on a second call, with its own borrowed authority.

The voice that earned the employee’s trust was not the voice that gave the order. KMOB1003’s analysis: a defense built around recognizing one speaker, or guarding one secret, can leave the lawyer and the payment authorization unchecked.

Who lost money to CEO voice cloning

CyberScoop listed seven victims and their losses. A U.K. financial technology company lost nearly $11.6 million. A Florida pet food company lost $5.2 million and a Missouri hospital system $4.8 million. A Massachusetts mutual fund company lost $4.6 million, a California hospital system nearly $3 million, a New York investment company $2.8 million and a Rhode Island bank nearly $2.7 million.

The list is a cross-section, not a profile. A hospital, a bank, an investment manager and a pet food maker have little in common except an accounting desk and someone with authority to send a wire. AP said the group targeted thousands of companies but did not say how many lost money.

James C. Barnacle Jr., the FBI’s assistant director in charge in New York, said criminals continue to “weaponize emerging technologies,” AP reported, and that the case shows how advanced technology can enable fraud on a large scale.

What the defense says

Sheetrit’s attorneys, Sharon Nahari and Shay Shorer, told CyberScoop their client “has no connection to this matter and has had no involvement in it whatsoever.” They said he maintains his complete innocence. Prosecutors allege he laundered scheme proceeds. He was arrested in the United Kingdom on Sept. 7, CyberScoop reported.

AP reported that lawyers for Soall and Sheetrit did not immediately respond to its request for comment, and that it was unclear whether Hazan has an attorney. According to CyberScoop, Soall was arrested in Spain on June 17 and Hazan in Spain on Aug. 5.

What the reporting leaves out matters as much. Neither article says how much audio the group needed to clone a voice, and neither names a tool, so those details remain unknown. Neither offers guidance for companies. What follows is KMOB1003’s analysis, not advice from the FBI or prosecutors.

A company can verify a speaker. It cannot verify a voice. The difference is where the check sits: verification can cover the purported executive, the purported lawyer and the payment authorization, not only the voice on the call.

Why verification should cover the payment

Against CEO voice cloning, a verification habit is stronger when it is attached to the money as well as the voice. A shared code word is cheap, and families should have one. For a company, the wire is the step where every impersonator in this scheme, as described, needed one employee to say yes.

Three controls follow from the facts as reported. First, call back on a number already on file, never the one in the email or the one the caller offers, and do it for the lawyer as well as the executive. Second, require a second approver for any first-time recipient or any transfer tied to a confidential deal. Third, treat secrecy as the alarm, because an unexpected nondisclosure agreement attached to an urgent payment is a pressure device.

None of this needs software that can detect a fake voice. Each control assumes the voice might be perfect and places the check where an impersonator is harder to reach: a known phone number, a second employee, a delay before the money moves. That is why the controls should hold up as the audio improves. A board can audit a callback rule; it cannot audit a promise to recognize a voice.

Companies should also decide in advance who may be told to keep a deal quiet. A chief executive who truly wants a confidential transaction can accept a callback and a second signature. One who cannot is, on the evidence in this case, the red flag.

A callback takes minutes. A wire sent to a stranger can cost millions.