An accountant at a regional hospital system in Missouri answering the phone recognized the voice on the other end as that of the organization’s chief executive.
There was an urgent matter that required confidentiality and an immediate wire transfer, the caller said. A lawyer then quickly followed up to complete the transaction.
By the time the hospital’s actual executives realized what had happened, $4.8 million had vanished.
The executive and the lawyer never made the calls; instead, both voices had been generated by artificial intelligence, according to the U.S. Attorney’s Office for the Southern District of New York.
The same script played out several times over approximately 18 months, beginning in July 2024, prosecutors said, costing companies based in the United States and Europe more than $129 million.
Attempts were also made to engage employees in video calls, deploying deepfakes of the chief executive in the scheme, prosecutors said.
Among the unnamed victims were: a British financial technology company ($11.6 million); a pet food company in Florida ($5 million); a hospital system in California ($3 million); a mutual fund company in Massachusetts ($4.7 million); and a bank based in Rhode Island ($2.7 million).
The authorities in Britain and Spain arrested Jacob Soall, Sharon Hazan and Guy Sheetrit over several months starting in June, according to an indictment unsealed on Thursday.
Mr. Soall, 41, of Marbella, Spain and Britain, was arrested in Spain. Mr. Hazan, 54, of Israel, was also arrested there. Mr. Sheetrit, 42, of Israel and the United Arab Emirates, was arrested in Britain.
The three men are awaiting extradition to the United States, where they face charges of wire fraud, aggravated identity theft and money laundering.
It was unclear whether the men have lawyers in the United States. Efforts to find contact information for them were unsuccessful.
Prosecutors said the men would send a “victim employee,” typically an accountant or finance manager, an email.
The indictment included an example of an email sent to “a major investment bank” in New York City in October 2024. The message said the employee needed to sign a nondisclosure agreement. After signing, the employee was asked to call a lawyer.
The defendants used the names of actual people at real law firms, often among the 50 largest firms in the world, to impersonate, prosecutors said.
Only a few years ago, a bad actor needed hours upon hours of audio to mimic a voice, said Hany Farid, a Dartmouth College computer science professor and chief science officer at GetReal Security, a cybersecurity company that guards against A.I.-powered identity attacks and deepfakes.
That left chief executives and public-facing lawyers — with hours of high-fidelity audio online via earnings calls, keynotes and media appearances — as targets.
Now we are all potential targets, he said.
“I would comfortably say with less than a minute, you can clone somebody,” Dr. Farid said on Sunday.
Instead of needing thousands of images of somebody with different head poses, lighting and camera angles to capture their facial geometry, all that is needed is a single photo to create an “avatar deepfake,” he said.
The software for this is easy to use and newer laptops can keep up with the necessary computational demand, Dr. Farid said.
While many people claim to be able to tell the difference, Dr. Farid said his studies had shown otherwise.
“People are just slightly above chance performance,” he said. “So they’re really, really bad at it.”
Federal prosecutors said the men directed the victims to wire money to bank accounts controlled by conspirators across the world, including in Austria, China, Greece, Portugal, Singapore, Slovakia, Spain, the United Arab Emirates and the United States.
After the money had been wired, the men and co-conspirators converted it into cryptocurrency, the U.S. Attorney’s Office said, to try to conceal the source, ownership and control of the stolen money, while distributing it among themselves.
Mr. Soall kept a handwritten script, “Lawyer Call,” that he used when speaking with victims, the prosecutors said, including language to help persuade the employees not to discuss their communications with colleagues.
The script used regulatory jargon and insider trading risks as a pretext for strict secrecy, according to the indictment.
Mr. Hazan and Mr. Sheetrit laundered funds from the fraud scheme, among other activities, officials said.
Mr. Hazan bragged that he had laundered more than $400 million in the last three years.
Among themselves, Mr. Soall used the alias “Rocky Balboa” and Mr. Hazan went by “Superman Cash” and “Fat Boy,” among others, prosecutors said.
The F.B.I. Internet Crime Complaint Center’s 2025 report highlighted a surge in digital fraud and cyberthreats. Total complaints surpassed one million for the first time, while total losses surpassed $20 billion, a 26 percent increase in losses compared with 2024.
The agency logged more than 22,000 complaints related to artificial intelligence, totaling over $890 million in losses. Those schemes used generative A.I. to create realistic phishing emails, clone voices for family emergency/distress scams and enhance romance fraud scripts, it said.
Dr. Farid said that through his company he speaks with company executives who are struggling with everything from fake remote interviews to multimillion-dollar scams.
“I had one C.E.O. tell me a couple of months ago, ‘That’s it, we’re doing everything in person,’” he said.
The post When the Boss on the Phone Isn’t Real: How More Than $129 Million Was Stolen Using A.I. appeared first on New York Times.
