Every corporate fraud-prevention deck in America ends the same way: if a wire request smells wrong, call the boss back on a number you already have. The crew that took more than $129 million from six named companies let the employee make that call. Then it answered as the lawyer.
The indictment unsealed Thursday in Manhattan federal court charges three foreign nationals with running the scheme for more than eighteen months: wire fraud, aggravated identity theft, money laundering, seven counts apiece, twenty years on most of them. They are presumed innocent and none of it has been tested in court. What is not in dispute is the architecture, and the architecture is the story. The charging announcement from the Southern District of New York reads like a manual for the next crew.
Jamie McDonald — The Advice Was Right, and That Is Exactly Why It Stopped Working
The U.S. Attorney used the announcement to urge the business community to think hard about protecting itself from what his office calls SI-enabled crime. Sound advice, delivered to an audience that already had it laminated in the finance department.
That is the trap in this case. The defendants, prosecutors allege, never had to defeat a control. They had to become one. Employees in accounting departments were emailed by someone claiming to be their own chief executive and asked for discreet help with a confidential transaction, the Associated Press reported from the unsealed papers. Then came the phone call, sometimes a video call, carrying a voice and occasionally a face that matched. The employee did the thing the training says to do, and asked to confirm with counsel. The confirmation was the con.
Prosecutors say the defendants stood up a fake law firm on demand, complete with a fake lawyer who told the employee to move the money. Two verification steps, both impersonated, both in the same afternoon. The containment worked right up until the part where it turned out to be the payload.
The Missouri Hospital — $4.8 Million Is Not a Line Item, It Is a Ward
The named losses are specific enough to hurt. A hospital system headquartered in Missouri lost $4,829,580. A hospital system in California lost $2,968,497. A Rhode Island bank lost $2,684,580, a Massachusetts mutual fund company $4,639,918, a Florida pet food maker $5,242,747, and a British financial technology firm $11,578,474 — the tally laid out by federal prosecutors and carried across the wire services.
Two of those six are hospital systems. Four point eight million dollars is a rounding error on a health system balance sheet and a catastrophe on a ward, because hospitals do not lose money in the abstract — they lose the shift they cannot staff, the scanner they delay, the contract they renegotiate. The wire cleared in minutes. The consequences do not clear at all; they get spread across nurses who will be asked to do more with the same.
And the money did not stay put. Prosecutors say it landed in accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China, then got converted to cryptocurrency to make it harder to trace. Nine jurisdictions, one phone call, no gun.
Jacob Soall — One Handwritten Page Beat Every Identity Check in the Building
Soall, 41, of Marbella and the United Kingdom, allegedly handled the lawyer role, and he did it with a handwritten script titled, with no apparent irony, Lawyer Call. The script existed to keep the employee from doing the single most useful thing available to her: walking twenty feet down the corridor and asking a colleague whether any of this was real.
Read that again as a security finding. The attack did not defeat multifactor authentication, a firewall or an endpoint agent. It defeated the informal human backchannel that no vendor sells and every auditor ignores. The indictment says the script contained language specifically meant to stop the target from discussing the request with co-workers. Isolation was not a side effect of the fraud. Isolation was the product.
All three were picked up between June and September — Soall in Spain on 17 June, Hazan in Spain on 5 August, Sheetrit in the United Kingdom on 7 September — and all three are awaiting extradition, which means the discovery fight has not started and the victims have not seen a dollar returned.
Sharon Hazan — Convicted in 2008, Allegedly Back at $400 Million Scale
Hazan, 54, of Israel, is described in the charging documents as the money man, and he is the part of this story that should make a compliance officer put down the coffee. He was convicted in the same Manhattan courthouse in 2008 of conspiracy to commit bank fraud. He is now alleged to have boasted of laundering since 1994, of moving better than $400 million in the previous three years, and of being, among professional launderers, number one in the world.
Whether that boast is true is a question for a jury. Whether it is credible is a question for anyone who has watched a fraudster walk out of a courtroom and back into the same business with better tools. The AI did not create the demand for a cash-out lane. It just made the front door cheap enough to knock on thousands of times.
The Employee Who Wired It — The Only Person Who Gets Blamed Is the One Who Was Told
Somewhere in Missouri and California and Rhode Island there are people who pressed send. They are not named in the indictment and they will not be named in the retrial of their own reputation inside the building. They heard their chief executive. They heard the lawyer. They followed the escalation path the company itself designed, and they are the ones whose names sit in the incident report.
That is the human cost the loss figures miss. A hospital can absorb $4.8 million. The controller who approved the transfer absorbs it differently, in a career that never quite recovers from being the person who believed the voice. Every one of these schemes manufactures a second victim who did nothing wrong except trust a channel the company told her was trustworthy.
The Fix — Stop Treating a Voice as a Password
The security industry will spend the next quarter selling detection. The useful fixes are duller and cheaper. Callback verification has to run on a number pulled from the company directory, never one supplied by the requester. Wire instructions need two people who cannot see each other’s screens, plus a settlement delay long enough for a human to notice. Voice and video need to be reclassified as unverified media by default, which is a policy change, not a product. A named executive’s vocal signature used to be the last thing a fraudster could not fake. It is now the cheapest thing on the menu.
The AI-mekna here was not asked to reason, plan or write code. It was asked to sound like someone. That is the whole capability, and it was enough to move nine figures out of six companies before anyone picked up a phone that was not already compromised.
The next crew will read this indictment too. The only question is whether the finance department reads it first.
Sources: U.S. Attorney’s Office, Southern District of New York, The Associated Press, CBS News.