Deepfake CEO fraud: The payment rule that stops it

Deepfake CEO fraud has moved from a warning on a conference slide to a federal indictment. On November 5, 2026, federal prosecutors in Manhattan announced charges against three men they say used AI to copy the voices and faces of company executives and lawyers, then talked employees into wiring money to accounts around the world. The FBI puts the losses at more than $129 million, according to CBS News and the Associated Press and IT Pro. The named victims include two hospital systems, a bank and a mutual fund company.

Our stance is simple. You cannot train your staff to hear the difference between a real voice and a cloned one, so stop asking them to. What stops this kind of CEO fraud is a payment rule that nobody can talk their way around, not even the CEO. Here is what prosecutors say happened, why it matters for a small or mid-size business, and the rules we would put in place this week.

What prosecutors say happened

The case was brought by the U.S. Attorney’s Office for the Southern District of New York. The Justice Department announcement names Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42. They face charges that include wire fraud, aggravated identity theft and money laundering, according to CBS News, Cybernews and Ynet. Soall and Hazan were arrested in Spain in June and August, and Sheetrit was arrested in the United Kingdom in September. Extradition requests for all three are pending.

These are charges. The three men are presumed innocent unless proven guilty in court. CBS News reported that lawyers for Soall and Sheetrit did not immediately respond to a request for comment, and that it was unclear whether Hazan had a lawyer.

According to the prosecutors, as described by CBS News, IT Pro and Cybernews, the scheme followed a pattern:

• An employee, often in the accounting department, received an email that appeared to come from the company’s CEO asking for help with a confidential financial deal.
• A phone or video call followed. AI was used to imitate the CEO’s voice and, in some cases, the CEO’s face.
• The employee was told to contact a lawyer at a large, well-known law firm who was supposedly handling the deal.
• That lawyer was also fake. Prosecutors say Soall mainly posed as British lawyers and used a written script titled “Lawyer Call.”
• The fake lawyer told the employee to wire large sums to bank accounts around the world. The money was then converted to cryptocurrency to hide where it came from.

IT Pro and Ynet both list the amounts the FBI attributes to individual victims. They include about $5 million from a Missouri hospital system, about $3 million from a California hospital system, about $2.7 million from a Rhode Island bank, about $4.6 million from a Massachusetts mutual fund company, about $5.2 million from a Florida pet food company and about $11.5 million from a UK financial technology firm.

FBI Assistant Director in Charge James C. Barnacle Jr. said the case “demonstrates how the use of advanced technology can be exploited to commit large-scale fraud,” as quoted by Cybernews and summarized by CBS News.

Why deepfake CEO fraud works on smart people

The named victims include hospital systems, a bank and a fund company. Organizations like these have finance teams, auditors and compliance staff. We think a scheme like this gets past them because it targets the checks people trust most.

Think about how most offices confirm a strange request. Someone hears the boss’s voice, or sees the boss’s face on a video call, and the doubt goes away. AI voice cloning attacks that exact habit. The FBI said as much in a May 2025 public service announcement about scammers impersonating senior U.S. officials, warning that AI-generated voices can be hard to tell apart from real ones. SecureWorld covered the same warning at the time.

The fake lawyer step matters too. A second person from a respected firm makes the request feel checked and approved. It also gives the employee a reason not to ask around. The word “confidential” does the rest. People who are told a deal is secret are less likely to walk down the hall and ask a coworker if it sounds right.

This is a social engineering attack with better tools. The steps are the same ones we described in How to Recognize Social Engineering Attacks Before They Work: authority, urgency and secrecy. AI simply makes the authority part more convincing.

How big the AI fraud problem has become

The $129 million case is one ring. The wider numbers show it is part of a trend. The FBI’s 2025 Internet Crime Report tracked AI-related complaints and counted 22,364 of them, with reported losses of about $893 million, as reported by Malwarebytes and SecureWorld. Business email compromise complaints with a confirmed AI link made up more than $30 million of that total, according to SecureWorld’s summary. Those figures only include what victims chose to report.

Email has been getting harder to judge for the same reason. AI writes clean, natural messages with no spelling mistakes, which used to be the easy giveaway. We covered that shift in Phishing attacks are getting smarter: How AI is changing the threat landscape. The new case shows the same thing happening to phone and video calls.

The debate: spot the fake, or remove the chance to be fooled?

Business owners hear two answers to deepfake fraud.

The first answer is detection. Train staff to listen for odd pauses, flat tone or strange word choices. Buy software that claims to flag synthetic voices and video. The FBI’s own tips include watching for audio and visual irregularities, and there is some value in that. A trained employee who feels something is off and speaks up is a real asset.

The second answer is process. Assume that any voice, face or email can be faked, and build payment rules that do not depend on recognizing anyone. Under this approach, a call from the CEO is never enough to move money, no matter how real it sounds.

We side firmly with process. Detection asks a busy bookkeeper to win a contest against software that gets better every month. Process asks that same bookkeeper to follow a written rule, which is something people already do well. The FBI’s advice points the same way. In its May 2025 announcement, it told people to verify a caller by looking up the number on their own and calling back, and not to send money to someone they know only by phone until the request is confirmed through a separate channel.

Detection tools and training still have a place. They are a second layer. The first layer is a rule that makes the fake call useless even when it is perfect.

Payment rules that stop CEO fraud

These rules cost little to set up. Most fit on one page.

1. Call back on a number you already have

Any request to send money, change bank details or buy gift cards gets confirmed by calling the person back on a number from your own records. Never use the number in the email, the text or the caller ID. If the “CEO” is on a video call, hang up and call their cell from the company directory.

2. Require two people for large payments

Set a dollar amount above which two employees must approve a wire or ACH payment. One of them should not be in the same chain of email or calls. A scammer who fools one person now has to fool a second person who was never part of the conversation.

3. Make “confidential” a reason to slow down

Write it into the policy: no payment request is too secret for the verification steps. Tell your team the CEO will never be upset that they called to confirm. Then have the CEO say it out loud at a staff meeting. That one sentence removes the pressure that makes these scams work.

4. Verify outside lawyers and vendors on your own

If someone claims to be an attorney or a vendor handling a deal, look up the firm’s main number on its official website and ask for that person by name. Do not trust contact details sent inside the request.

5. Agree on a code word for urgent requests

The FBI suggests families agree on a secret word or phrase to confirm identity. The same idea works for a small leadership team. Keep the word out of email and chat, and change it if anyone leaves.

6. Tighten email so fakes stand out

In Microsoft 365 or Google Workspace, turn on warnings for messages from outside your company, watch for look-alike domains, and protect executive accounts with strong sign-in methods. Our post on Microsoft passkeys explains why phishing-resistant sign-in matters for the people who approve payments.

7. Practice once

Run a short drill. Have a trusted person call your accounts payable staff with a fake urgent request and see what happens. Use the result to improve the policy, and keep it blame free. Security awareness training works best when it practices the exact rules your team will follow.

What regulated businesses should add

Many of our clients in DC, Maryland and Virginia are healthcare practices, government contractors and financial firms. Two of the named victims in this case were hospital systems, and others were a bank and a mutual fund company. For these businesses, a fraudulent wire is more than a cash loss.

• Talk to your insurance broker. Ask whether your cyber or crime policy covers social engineering fraud, what the limit is, and what verification steps the policy expects you to follow. Put those steps in your payment policy so they match.
• Know who to call first. If money leaves by mistake, call your bank right away and ask about a recall, then report it to the FBI at ic3.gov. Speed matters for any chance of getting funds back.
• Check for a bigger breach. If a scammer had access to a real executive’s email account, treat it as a security incident. That can bring reporting duties under HIPAA, DFARS or state breach laws, depending on what data was exposed.

Frequently asked questions

What is deepfake CEO fraud?

It is a scam in which criminals use AI to copy an executive’s voice or face, then use a call, voicemail or video meeting to pressure an employee into sending money or sensitive data. It is a newer form of business email compromise, which has long relied on fake emails from leaders.

Can our staff tell a cloned voice from a real one?

Sometimes, but you should not count on it. The FBI has warned that AI-generated voices can be hard to tell apart from real ones. A callback rule works whether the voice sounds real or not.

Is this only a problem for large companies?

The named victims in this case include hospital systems and a bank, but the tools behind these calls are widely available. A small business with one person who handles payments is often easier to fool, since there is no second person to catch the mistake.

What should we do if we already sent the money?

Call your bank immediately and ask them to try to recall the wire. Then report it to the FBI at ic3.gov, call your IT provider to check whether any email accounts were compromised, and notify your insurance carrier.

Put a payment rule in place before the call comes

SADOS helps businesses across DC, Maryland and Virginia protect the people and systems that move money, from Microsoft 365 sign-in security to staff training and written verification policies. If you want a second set of eyes on how your team approves payments, talk to a SADOS engineer. If you think a fraudulent payment or email compromise is happening right now, use our emergency IT support line.