Scammers use AI voice cloning to steal $129 million from global firms

The mechanics of the heist

A group of three scammers exploited AI voice-cloning software to orchestrate a massive theft totaling over $129 million. According to a report by PCMag Middle East, the suspects targeted major law firms and global companies starting in 2024. They used these tools to impersonate high-ranking corporate executives and attorneys to trick victims into wiring large sums of money.

The group did not need to hack into any internal corporate systems to succeed in their crimes. Instead, they relied on the psychological pressure of a familiar voice and a process that appeared legitimate to the employees involved. By mimicking the specific vocal patterns of leaders, the scammers were able to convince staff that the requests for funds were authentic and authorized.

The suspects were identified as Jacon Soall of Spain, Sharon Hazan of Israel, and Guy Sheetrit of Israel and the United Arab Emirates. While Soall focused on impersonating UK attorneys, Hazan and Sheetrit were primarily responsible for laundering the stolen money. They worked with unnamed co-conspirators to move the funds into bank accounts across the globe before converting the currency into cryptocurrency.

How the scam was initiated

The fraud typically began with a targeted email sent to employees in accounting roles who had the authority to initiate wire transfers. These emails often arrived through electronic signature companies, such as DocuSign, to add a layer of perceived legitimacy. The messages would appear to come from a company's CEO and claim that the employee's help was needed for a confidential financial transaction, such as a secret acquisition.

To further isolate the victim, the scammers would often ask the employee to sign a nondisclosure agreement. This tactic was designed to ensure that the employee would not discuss the transaction with any of their colleagues. By creating a sense of secrecy, the scammers prevented the staff member from seeking a second opinion or noticing the irregularities in the request.

Once the employee was engaged, the group would use AI programs to impersonate fake attorneys during phone or video calls. These AI-generated voices and deepfakes of physical appearances urged the employee to complete the transfer quickly. The Justice Department noted that the suspects would explain they needed assistance on a confidential matter, making the request feel like a standard, albeit private, business operation.

Impact on global firms

The scale of the theft highlights how lucrative and effective AI impersonation has become for organized crime. The group successfully scammed $4.8 million from a hospital system in Missouri and nearly $2.7 million from a bank in Rhode Island. One of the largest single thefts involved a UK financial tech company, from which the group stole $11.5 million.

This case serves as a significant warning for finance teams in regions like the UAE, Saudi Arabia, and Egypt. Because AI voice cloning is now bundled into mainstream products, it is no longer a niche technology available only to sophisticated actors. Companies in these regions face the same pressure tactics where a senior figure asks for urgent, confidential help via a call that sounds and looks real.

The indictment emphasizes that the primary vulnerability in these attacks is the human element rather than a software flaw. Because the scammers successfully mimicked the voices of trusted figures, the victims felt they were following a legitimate internal process. This demonstrates that even large corporations with robust cybersecurity can be vulnerable to social engineering powered by generative AI.

Legal consequences and next steps

Federal investigators have taken significant action against the trio following the discovery of the fraud. Each of the three suspects was arrested earlier this year in Spain and the UK. The Justice Department has since filed for the extradition of all three individuals to the United States to face trial.

The defendants are currently facing a maximum of 104 years in prison if found guilty of all charges. These charges include aggravated identity theft, wire fraud, and money laundering. The 15-page unsealed indictment provides a detailed look at how the group coordinated their efforts to move money through various international accounts.

Moving forward, security experts suggest that businesses must rely on basic controls rather than just detection tools. Any request to move money outside of normal approval channels—especially those marked as urgent or confidential—should be treated with extreme caution. The goal for companies is to establish a culture where employees feel empowered to verify unusual requests through pre-established channels.