The Digital Security Digest, by Freedom of the Press Foundation (FPF), is a weekly newsletter with security tips that keep you, your sources, and your devices safe. If someone shared this newsletter with you, please subscribe here.

Three charged in scheme to defraud companies using AI voices and images

Three men — Jacob Soall, Sharon Hazan, and Guy Sheetrit — have been charged by the U.S. attorney for the Southern District of New York and the FBI for using AI to defraud companies around the world. According to a news release from the U.S. attorney’s office, between 2024 and 2026, the three men allegedly stole more than $129 million. The men typically began their scheme by requesting employees’ assistance on a “confidential financial transaction,” and used AI-generated voices and imagery of corporate executives and attorneys to add legitimacy to the hoax. Transactions targeted hospital systems, banks, financial technology firms, and more.

What you can do

Chances are you have seen a smaller-scale version of this: Someone might impersonate senior leadership at your organization in an email or text, often asking for help facilitating a transaction. Now, the use of AI for cloning voices or manipulating imagery and video to make more convincing lures is easier than ever.

Look out for the signs of scams. Attackers often try to instill a sense of urgency and convince you that their financial scheme needs to be handled quickly and quietly — huge red flags. In this case, the fraudsters convinced employees to assist with a “confidential” financial transaction. Chances are, this is not how your organization normally does things, and now your antennas should be raised. Likewise, think about whether it’s unusual to get outreach from someone in a position of leadership in your organization in the first place. Depending on your role, this may be pretty normal — say, if you are an executive assistant or in a small organization where everyone speaks regularly. But in many organizations, this may be a fairly unusual scenario. When in doubt, don’t be afraid to ask for a second opinion from colleagues.

Know the “source of truth” for identifying colleagues. We now know that impersonators can make extremely convincing voice and video calls with simple AI tools. It’s important for organizations to be clear about where colleagues can go to verify that they are talking to the right person, and to do their due diligence in setting up the right people with access to trusted internal channels. If you are a smaller organization, you may have a direct line with team leadership on trusted internal channels. Larger organizations may have larger teams tasked with facilitating such transactions. This is important not only for dealing with scams and fraudsters, but also phishing attacks that may take place over email, text, and, increasingly, voice and video calls.

Our team is always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.

Best,
Martin Shelton
Deputy Director of Digital Security
Freedom of the Press Foundation