Deepfake C.E.O. Fraud: Inside the $129 Million Indictment
On or about October 8, 2024, an employee of a large investment bank in New York, someone whose job included the power to approve wire transfers, received an envelope from an electronic-signature service (DocuSign, or one like it; the indictment says “such as DocuSign”). It had been sent in the name of the bank’s chief executive. “We need to loop you into a deal we’ve been working on,” it began. The companies involved required a nondisclosure agreement, attached. Once it was signed, would the employee please call the bank’s outside counsel at one of the largest law firms in the world; he would set up a compliance call for later that day and explain the rest. Whether the employee signed and called, the indictment does not say. What it says is that the employee was deceived into authorizing a transfer of roughly $2.85 million, and that the bank’s back office prevented the wire from being sent. Why, it does not explain. But in the indictment unsealed in Manhattan on Thursday, that is the one occasion on which a company’s money stayed home, and the reason is worth holding on to: somewhere in that bank there was a control that did not depend on the person who had been persuaded.
On Thursday, November 5, 2026, federal prosecutors for the Southern District of New York made public a superseding indictment (S3 26 Cr. 168) charging three men with running, from at least July, 2024, until at least February, 2026, a scheme that used artificial intelligence to impersonate the chief executives of companies around the world, and real lawyers at real law firms, in order to talk employees into wiring money to accounts the group controlled. The take, the government says, was at least a hundred and twenty-nine million dollars; the targets numbered in the thousands. Jacob Soall, forty-one, of Marbella and the United Kingdom, Sharon Hazan, fifty-four, of Israel, and Guy Sheetrit, forty-two, of Israel and the United Arab Emirates, were arrested, according to the prosecutors’ announcement, on June 17 and August 5 in Spain and on September 7 in Britain, and extradition requests for all three are pending. There are seven counts: conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, and three counts of money laundering. Added together in the American fashion, the statutory maxima come to a hundred and four years, a figure the prosecutors themselves present as arithmetic rather than forecast. The same announcement, in a flourish that will date quickly, refers to the technology throughout as “super intelligence.” None of it has been proved. What follows is the government’s account, drawn from the indictment and the prosecutors’ statements, and where I add a judgment or a guess of my own I say so. The facts are as of November 6, 2026.
The case deserves attention not because artificial intelligence appears in it. It deserves attention because it shows how little artificial intelligence is needed to make C.E.O. fraud work inside a bank, a hospital, and a mutual-fund company, and because the one thing that defeated it was a procedure that had taken no part in the conversation.
The Ones Who Paid
At the other companies, whatever was supposed to stop the wire did not. According to the indictment, in November, 2024, a hospital system in Missouri wired $4,829,580 and a bank in Rhode Island $2,684,580. In December, 2024, a hospital system in California sent $2,968,497. In March, 2025, a British fintech company lost $11,578,474; in April, a mutual-fund company in Massachusetts lost $4,639,981; in June, a pet-food company in Florida lost $5,242,747. These are the examples prosecutors chose to name. Thousands of companies were targeted, they say; the hundred and twenty-nine million dollars is the part they can document. (One figure differs by a transposition between the indictment and the press release; I use the indictment’s.)
There is one more thing in the indictment that anyone who has worked an investigation will spot at once. The Missouri hospital and the Rhode Island bank were handled by the same “lawyer” from the same firm. That firm reappears in the Florida case, and a second firm serves, in this fiction, both California and Massachusetts. Borrowed identities were used again and again. In the life of any cover story, that is usually the beginning of the end, because repetition is the thing investigators know how to find.
How the 2026 Version Works
The headlines are about A.I.: on the phone and video calls, the defendants are alleged to have used it to mimic the chief executive’s voice and, at times, his face. Read the whole indictment and the deepfake turns out to be the least interesting part. The architecture is older than the technology, and this version of C.E.O. fraud has four moving parts.
The first is a legitimate channel. The approach does not arrive as a suspicious e-mail from an unfamiliar domain; it arrives as an envelope from a real electronic-signature platform, which is to say as paperwork, the medium in which a finance department lives. The second is an act of commitment. Before anyone mentions money, the employee signs a confidentiality agreement. Whoever has signed is already inside, and has a reason not to talk to colleagues. The third is silence dressed as compliance. In the script, the purported lawyer explains that the company being acquired is publicly listed, that confidentiality is therefore a legal and regulatory matter, and that the rules on inside information forbid discussing the transaction with anyone. That is a lie wearing a bar card. The E.U.’s Market Abuse Regulation itself exempts disclosure made in the normal exercise of employment or duties, and nothing in American securities law stops a payments clerk from asking his own finance director whether a deal exists. The fourth is the closer, whose authority cannot be tested: a man introducing himself by the name of a real attorney at a firm that, prosecutors write, was often among the fifty largest in the world, and generally from one of its European offices.
The indictment does not say why Europe. This is my hypothesis, but the logic suggests itself. To an accountant in Missouri, a lawyer in London or Frankfurt is a name on a website, one time zone removed. Nobody calls a switchboard across the Atlantic to ask whether this man really rang. Of the things an employee could check, the name is real, the firm is real, the website checks out. The thing that is false, the telephone number, is the one thing nobody verifies.
Soall, prosecutors say, specialized in playing British lawyers, and kept a handwritten script titled “Lawyer Call.” Its most instructive passage concerns not what to say but what the victim is about to ask. The script anticipates the one defensive question, whether anyone else at the company has signed an N.D.A., and supplies the answer: not yet, that will probably change in the coming days, an internal memo is on its way. The instinct to verify is not evaded here. It is managed. Whoever wrote that script understood persuasion better than many corporate training departments do: authority (the C.E.O.), consistency (the signed agreement), isolation (the ban on talking to colleagues), and time pressure (a compliance call “later today”).
The roles, according to the charges, were divided. Soall talked. Hazan (who went by “Superman Cash,” “Impossible Mission,” “Fat Boy,” and, more modestly, “Ron”) and Sheetrit handled the money. Sheetrit, the Israeli news site Ynet reports, runs a digital-marketing agency that announced, in March of this year, a new division to help companies become visible in the answers generated by ChatGPT and Gemini.
The division of labor is not new. Writing about the fake investment ads that borrow celebrities’ faces, I traced that industry’s supply chain: organizers, affiliates, account brokers, separate subcontractors who produce the deepfakes, call centers, and, at the end, money mules, shell companies, and laundering through crypto exchanges (see A Face for Sale: Who Is Behind the Fake Celebrity Ads, and How Much Meta Makes on Them). In Poland alone, according to NASK, the national research institute, the likenesses of at least a hundred and twenty-one public figures were used in such scams in 2024. The group in the indictment is the same chain one floor up: instead of a celebrity’s face to sell a fake investment to a pensioner, a chief executive’s voice and a lawyer’s name to sell a fake acquisition to an accountant.
A Silicone Mask, a Telephone, and a Cloned Voice
In Europe, C.E.O. fraud has a date and a name. Around 2005, Gilbert Chikli, a citizen of France and Israel, telephoned large French companies as their own president and then, in a second act, as an officer of the intelligence services who needed a discreet transfer for the good of the state. A Paris court sentenced him in 2015, in absentia, to seven years in prison and a fine of a million euros; he had been living in Israel since 2009. Between 2015 and 2017, his group went further. On video calls with corporate chiefs, heads of state, and heads of institutions, a man appeared in a silicone mask of Jean-Yves Le Drian, then France’s Minister of Defense, behind a desk with flags, and the request was generally the same: money for a secret operation to free hostages. The Paris prosecutor’s office described the technique in a sentence: after a few minutes they would plead a bad connection, cut the picture, and switch to the telephone. There were more than a hundred and fifty targets, among them the Aga Khan, the President of Gabon, and the Archbishop of Paris, and the haul exceeded fifty million euros. Chikli was arrested in Ukraine in August, 2017, while preparing, prosecutors said, his next role, Prince Albert II of Monaco. In March, 2020, a Paris court gave him eleven years and a two-million-euro fine.
The silicone mask was a deepfake of the pre-digital age. The rest of the method survived intact: authority, secrecy, pressure, and a second person who closes. In 2019, the head of a British energy company reportedly wired two hundred and twenty thousand euros to a Hungarian “supplier” because the voice on the line was that of the chief executive of the German parent, down to the accent and the cadence. Early in 2024, an employee in the Hong Kong office of Arup, the British engineering firm, joined a video conference with the chief financial officer and several colleagues and then made fifteen transfers totaling two hundred million Hong Kong dollars, about $25.6 million; the firm reported the loss to the Hong Kong police in January. Every participant in that meeting, apart from him, had been generated. The same year, two attempts failed: staff at WPP, the advertising group, grew suspicious of a “chief executive” on a Teams meeting assembled from a voice clone and clips of YouTube footage, and an executive at Ferrari (I opened my March piece on the law of deepfakes with that call; see Deepfakes: Your Face Is Not Yours Anymore) asked the caller the title of the book the real chief executive had recommended to him days earlier. The caller hung up.
Italy has supplied the two freshest examples, and both are worth remembering. In February, 2025, someone with a clone of the voice of Guido Crosetto, the Minister of Defense, telephoned the Italian industrial élite, from Giorgio Armani to Marco Tronchetti Provera, asking for money to ransom Italian hostages. Massimo Moratti, the former owner of Inter Milan, paid about a million euros, some nine hundred and eighty thousand, which travelled through several accounts to one in the Netherlands; within days Milan prosecutors had found and seized it, and by the end of 2025, according to Adnkronos, it had been returned. It was the fake Le Drian’s legend exactly, minus the mask. Then, in February, 2026, the non-executive chairman of Fideuram, the private bank of the Intesa Sanpaolo group, received a WhatsApp message from the group’s “chief executive,” Carlo Messina, followed by a call from a “business lawyer” whose voice had been cloned, and asked his finance chief to send money through the bank’s treasury to China and Hong Kong. As the Corriere della Sera revealed in September, the sum was about ninety-five million euros. A Chinese bank blocked and returned some forty million; Milan prosecutors, working with Lisbon through Eurojust, had a further thirteen million seized in a Portuguese bank. At least thirty-six million are still missing, and investigators say they went through Malta, Luxembourg, the Netherlands, and a Canadian money-transfer platform into two bitcoin wallets. The chairman, who is not under investigation, resigned in March, citing personal reasons. The group has stressed that no computer system was hacked. None needed to be.
The scale is measurable. According to the F.B.I.’s Internet Crime Report for 2025, published in April, 2026, the Bureau’s complaint center received more than a million complaints, with reported losses of $20.9 billion, up twenty-six per cent on the year before. Business e-mail compromise, the category that covers impersonating bosses and suppliers in corporate correspondence, accounted for 24,768 complaints and $3.05 billion in losses, second only to investment fraud. Artificial intelligence was mentioned in 22,364 complaints, the first year the Bureau has broken it out. In Poland, the national computer-emergency team, CERT Polska, logged 658,320 reports and 260,783 distinct incidents in 2025, more than twice the previous year’s number, and the faked voice of a chief executive and the fabricated video call have already joined the catalogue of methods that the business press warns companies about. The New York case, in other words, is not exotic. It is the largest case of its kind I have seen put into a charging document, and a scaled-up version of something that happens every day.
One feature recurs in the cases that worked. The chief executive rarely closes alone. Nearly always there is a second person who takes over the conversation and issues the instruction: the intelligence officer in Chikli’s version, the “minister’s aide” in the fake Crosetto’s, the business lawyer at Fideuram, the big-firm attorney in New York. The chief executive gives the matter weight. The lawyer gives it procedure. And procedure is what calms an accountant.
The Laundromat: Nine Jurisdictions and a Wallet
According to the charges, the victims’ money went to accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia, and China, and from there was converted into cryptocurrency and divided among the group. Prosecutors attribute to Hazan the boast that he had been laundering money since 1994, that he had laundered more than four hundred million dollars in the previous three years alone, and that, among professional launderers, he was “number one all over the world.” Their statement notes that in 2008 he was convicted in Manhattan federal court of conspiracy to commit bank fraud. If the charges hold, what we are looking at is a laundering network of nineteen-nineties vintage that bought itself a twenty-twenties front end.
This matters for a practical reason. Whether money can be recovered after C.E.O. fraud is decided not by artificial intelligence but by the clock. A wire to a bank in China, Hong Kong, or the Netherlands can be stopped as long as the funds are still sitting in the account; that is why Moratti got nearly everything back and Fideuram got some fifty-three of its ninety-five million. Conversion into cryptocurrency does not make recovery impossible, but it changes its nature: a recall between banks, measured in hours, becomes tracing across blockchains, freezes at exchanges, and litigation, measured in years. Fideuram’s thirty-six million euros, by the time anyone was looking for them, were in two bitcoin wallets. I wrote, after the Binance theft, about why even the largest heist in the history of the exchanges allowed little beyond the stablecoins to be frozen (Elliptic puts them at ninety-four per cent of what was frozen); see Binance Lost $6.4 Billion in Twenty Minutes. Here Is How North Korea Launders It, and Why Only Half Could Be Frozen. The same mechanism operates here, at a smaller scale.
In Poland, two mechanisms matter most, and both are measured in hours. A bank that forms a reasonable suspicion that funds in an account derive from, or are connected with, a crime other than money laundering may, under Article 106a of the Banking Law (Prawo bankowe), block them for seventy-two hours and notify a prosecutor, who, if proceedings are opened, can hold the block for up to six months and extend it for six more. Where the suspicion is laundering, the bank’s notification goes to the General Inspector of Financial Information (GIIF, the country’s financial-intelligence unit), which may, under Article 86 of the Anti-Money-Laundering Act, order the transaction suspended or the account frozen for ninety-six hours, after which a prosecutor takes over on the same terms. Neither order reaches a foreign account by itself; abroad, the recipient bank and international coöperation do the work, as they did for Fideuram in China and Portugal. A defrauded company has, in those first hours, a short list: its own bank’s fraud desk (a recall request, and contact with the recipient bank), a criminal complaint, and its insurer, in that order, and not an internal inquiry into who was at fault. Money still sitting in the recipient’s account is the realistic chance. Whatever has moved into crypto is a matter of years.
Seven Counts, a Hundred and Four Years, and Names Borrowed from Lawyers
For a lawyer, the construction of the charges is more interesting than the story. Count One is conspiracy to commit wire fraud (18 U.S.C. § 1349); Count Two is the fraud itself (§ 1343). Counts Five, Six, and Seven concern money laundering: a conspiracy (§ 1956(h)), transactions designed to conceal the source of funds (§ 1956(a)(1)(B)(i)), and international transfers intended to keep the enterprise going (§ 1956(a)(2)(A)). Each of these five counts carries up to twenty years. On top of that, prosecutors seek forfeiture of everything derived from the offenses and, where that property cannot be found, of substitute assets up to its value.
The counts that matter most, though, are Three and Four: aggravated identity theft (18 U.S.C. § 1028A). Count Three concerns the identities of the chief executives, Count Four the identities of the lawyers. The statute has a peculiar construction in American law: for each count, the court must impose two years’ imprisonment, served after the sentence for the underlying felony rather than alongside it; the two identity-theft terms may, at the court’s discretion, run alongside each other. Hence the hundred and four years in the prosecutors’ arithmetic: five counts at twenty and two at two. For the lawyers involved, something else is at stake. Their names are not props in this case but “means of identification,” and using them knowingly, without authority, as the instrument of the fraud is a separate crime, whether or not the fraud succeeded; the Supreme Court held in Dubin v. United States, in 2023, that the misuse of the identity must be at the crux of what makes the conduct criminal, and a fake lawyer’s name is about as close to the crux as one can get. Count Four is built on the attorneys’ identities; their firms the indictment calls, without euphemism, “Victim Law Firms.”
There is a jurisdictional thread as well. The acts are alleged to have been committed in New York, Spain, Israel, “and elsewhere outside of the jurisdiction of any particular State,” and the indictment invokes the venue provision for offenses begun or committed outside any district (18 U.S.C. § 3238). Two of the defendants are Israeli citizens, but they were arrested outside Israel: Hazan in Spain, Sheetrit in Britain. That is not a detail. Had they been picked up at home, the road to a New York courtroom would have run through Israel’s Extradition Law, which, for a citizen who was also a resident when the offense was committed, conditions surrender on his return to serve any sentence in Israel, a condition he may waive; in my experience it is also a slower road. I have written about how that works in another context (see The Shelter That Isn’t). An arrest in Marbella or London means ordinary extradition under bilateral treaties, and Spain and Britain extradite to the United States on those treaties regularly.
What Polish Law Would Make of It
Had the same crew dialed a company in Warsaw, prosecutors would not have needed a single new statute. Fraud under Article 286 § 1 of the Criminal Code (Kodeks karny) carries six months to eight years; where the property is of “significant value,” meaning more than two hundred thousand złoty, one to ten years (Article 294 § 1); above five million złoty, three to twenty years; and above ten million, five to twenty-five (Article 294 §§ 3 and 4). Which tier applies turns on the value at the time of the act and on how many offenses the facts contain, not on a currency conversion of the whole indictment, but the British fintech’s loss alone would clear the top threshold. Impersonating the chief executive and the lawyer may be a separate offense under Article 190a § 2, the use of another person’s image, personal data, or other identifying data, thereby causing that person financial or personal harm, punishable by the same six months to eight years. A practical note: that offense is prosecuted only on the request of the injured person, and the injured person is the chief executive or the lawyer who was impersonated, not the company that lost the money. A firm whose lawyer’s name was used cannot file that request on his behalf; the lawyer must, and he must be able to point to harm of his own, which here would be to his reputation. Money laundering is Article 299: six months to eight years in the basic form, one to ten where the offender acts in concert with others or the benefit is substantial, and, under Article 306b, the same three-to-twenty and five-to-twenty-five tiers above five and ten million złoty; how that charge looks from the business owner’s side of the table is a subject of its own (see Money Laundering under Article 299 of the Polish Criminal Code). Where a structured group can be shown, participation in an organized criminal group (Article 258) comes on top.
What Polish law lacks is a stand-alone offense called “deepfake.” Nor is there a general E.U. crime of it; the Union’s 2024 directive on violence against women reaches non-consensual intimate deepfakes, not fake chief executives. The Artificial Intelligence Act has, since August 2, 2026, imposed transparency duties, including a duty on deployers to disclose deepfakes, and it does not exempt a deployer because his purpose is criminal. The practical problem is different: a fraudster cloning a chief executive’s voice will not label his recording, and a disclosure duty backed by an administrative fine is no substitute for a payments desk that checks. Poland’s own Artificial Intelligence Systems Act of July 3, 2026 (Journal of Laws 2026, item 1003), in force since August 11 and, in its supervisory and penalty chapters, since October 28, builds a market-supervision framework and a new body, the Commission for the Development and Safety of Artificial Intelligence; these are institutions for producers and deployers, not a shield for a chief financial officer. A members’ bill to amend the Criminal Code, filed in October, 2026 (Sejm print No. 3268), criminalizes deepfakes, but only the sexual kind. It is the same optic I saw in Minnesota, where the state is defending its ban on A.I. “nudification” in federal court with a 2019 study that found ninety-six per cent of deepfakes to be sexual; the newer incident tallies, running to early 2025, put fraud first, at thirty-one per cent (see The A.I. Nudification Ban on Trial: xAI v. Minnesota, and the President in the Pool). The legislative energy follows the older statistic; the money follows the newer one. For C.E.O. fraud, the general provisions remain, and in this case they are enough. The civil claims available to a person whose voice and face have been taken, including under copyright and the law of personal rights, I have set out separately (see Deepfakes: Your Face Is Not Yours Anymore).
Who Pays: the Company, the Bank, the Bookkeeper, or the Board
The question that is asked in a Polish company the following morning is different from the one asked at the prosecutor’s office: who absorbs the loss. The answer is uncomfortable, and worth knowing before the loss rather than after.
The bank, as a rule, will not give the money back. The Payment Services Act (ustawa o usługach płatniczych) obliges a bank to refund an unauthorized transaction, one to which the payer did not consent in the agreed manner. A transfer ordered by an authorized employee, even a deceived one, is an authorized transaction; the deception concerned the purpose of the payment, not the consent to it. How far a bank’s liability reaches in the opposite case I have discussed in connection with the Court of Justice’s judgment of October 15 (see The Bank Pays First: Case C-70/25 and the Refund of Unauthorised Payment Transactions). C.E.O. fraud lies on the other side of that line. A claim against the bank survives only on a different footing: that the bank breached duties of its own, for instance by letting a transfer through past its own anti-money-laundering alarms, and that is a harder case, not an impossible one; for business accounts the contract may also have narrowed the statutory protections, which the Act permits. Nor will the new E.U. Payment Services Regulation change the picture for companies. Agreed politically in November, 2025, with formal adoption still pending, it creates a refund right for a consumer deceived by someone impersonating the consumer’s own bank or its staff, not any other person; its broader fraud-prevention duties may, once in force, give a company arguments against a bank that ignored warning signs, but no refund as of right. A chief executive and an attorney are not bank employees, and a hospital is not a consumer. Nor will the verification-of-payee check being rolled out across the Union catch a transfer like these. It confirms that the beneficiary’s name matches the account number, not that the deal exists; if the account was opened for a shell company whose name is the one on the instruction, the names will match.
The employee will pay little. If the bookkeeper or the finance director is on an employment contract and was at fault through negligence, liability for the damage is, as a rule, capped at three months’ salary under Article 119 of the Labor Code (Kodeks pracy). The Code’s exception for property entrusted to an employee with a duty to account for it (Article 124) is argued in such cases, but it requires an actual entrustment, not merely a login to the banking system, and the courts examine the employee’s duties, the control he had, and the employer’s own contribution to the loss. Full liability without a cap arises for intentional fault, and a deceived employee is a victim, not an accomplice; the cases in which it is otherwise are the cases in which he was in on it. Against eleven million dollars, three months’ salary is a rounding error.
That leaves the company, and inside the company, the board. A management-board member is liable to the company for damage caused by acts or omissions contrary to the law or the articles, judged against the standard of care that follows from the professional character of the office (Article 293 of the Commercial Companies Code, Kodeks spółek handlowych, for a limited-liability company; Article 483 for a joint-stock company). Since 2022, a business-judgment rule protects him: he does not breach his duty of care if, acting loyally, he kept within the bounds of reasonable business risk, on the basis of the information, analyses, and opinions that a careful assessment required. The protection presupposes, in other words, that there was an assessment. A loss does not make a director liable, and a binder of procedures does not make him safe; but a board which, after this case, after Arup, after Fideuram, still has no procedure for approving transfers above a threshold will find it hard to show that it weighed anything at all. Insurance will not always fill the gap: market commentary suggests that cyber policies often cover social-engineering losses only up to a low sublimit, and some exclude them outright, which is a reason to read one’s own policy, its exclusions and its notification clauses, before the loss rather than after.
The Procedure That Was Not on the Call
In the entire indictment, only one attempt fails, and not because anyone recognized a deepfake. The investment bank’s wire failed because the decision to send it did not belong to the person who had spoken to the “chief executive” and the “lawyer”; it belonged to a unit that had spoken to nobody. Ferrari was saved by a question about a book. WPP was saved by staff who reported a doubt instead of swallowing it. In none of these cases did deepfake-detection technology do anything. What worked was a process built on the assumption that a conversation is not to be trusted. Minnesota, in its fight with xAI, is trying to put friction on the tool, by penalizing the provider for how easy the image is to make. A payments desk can put friction on the payment. Of the two kinds of friction, only the second is within a company’s control.
A few rules follow, and they require no detection software and little money. Voice and image are information, not authentication; a sentence that sounds like the chief executive is not the chief executive’s signature. Verification happens outside the channel the instruction came through: one calls back a number from one’s own directory, not the number in the message, and one checks a lawyer at an outside firm through the firm’s public switchboard, asking to be connected to the person of that name. The bar directory is no help here, because the name is genuine. A nondisclosure agreement signed with anyone at all does not suspend the internal path for approving payments; that sentence belongs in the procedure in so many words, because the whole fraud depends on the employee believing that the N.D.A. binds him even against his own finance department. Any transfer above an agreed amount, and any transfer to a new beneficiary, is approved by two people, at least one of whom had no part in the conversation. And, finally, the hardest rule, because it is cultural: it must be permissible, in a company, to tell the chief executive, “I’ll call you back on the number in the system.” The Ferrari executive could ask an awkward question. In a company where a subordinate dares not check an instruction from the boss, C.E.O. fraud is only a matter of time, deepfake or no deepfake.
What Follows
First, artificial intelligence did not invent C.E.O. fraud; it only lowered the cost of its final stage. Chikli’s silicone mask took a workshop and nerve. A voice clone takes a few minutes of audio from a trade conference. Everything before that final stage, the legend, the isolation, the pressure, the second person who closes, worked just as well in 2005.
Second, the weapon in this case was not an algorithm but the trust that attaches to the names of great law firms. The defendants borrowed the names of real lawyers because those names were what soothed finance directors. American law treated that as identity theft with a mandatory sentence; Polish law prosecutes it only on the request of the person impersonated, so the lawyer whose name was borrowed has to want it pursued.
Third, the loss stays with the company. The bank will, as a rule, not refund an authorized transfer, the employee answers, as a rule, for three months’ pay, and the new European rules will cover consumers impersonated by their bank, not companies impersonated by their boss. The only thing a company can do with this knowledge is write the procedure before it is needed and, in the first hours after a loss, call its bank, file the complaint, and notify its insurer, because the money is easiest to recover while it is still sitting in an account.
Fourth, and this is the sentence I would like to survive this article: every victim named in the New York indictment had an employee who believed. The only one that lost no money had a procedure that did not have to believe anything. Belief was never the control.
Related Reading
Deepfakes: Your Face Is Not Yours Anymore
The Bank Pays First: Case C-70/25 and the Refund of Unauthorised Payment Transactions
Money Laundering under Article 299 of the Polish Criminal Code
A Face for Sale: Who Is Behind the Fake Celebrity Ads, and How Much Meta Makes on Them
The A.I. Nudification Ban on Trial: xAI v. Minnesota, and the President in the Pool
Investment Fraud: Legal Help
In investment fraud cases the deadlines run separately in criminal, civil and insolvency proceedings, and the fraudsters' websites disappear together with the evidence. We build the victim's position on all three fronts, with no promises as to the outcome.
Robert Nogacki is a Polish attorney at law (radca prawny), the founder and managing partner of Kancelaria Prawna Skarbiec (Skarbiec Law Firm), which has operated continuously since 2006.
The law is equal for everyone, but the parties rarely are: on one side stands an organization with time, money, and lawyers, on the other a person with one business, one nest egg, and one life.
Clients rarely come to him with a legal problem. They come with a problem that also has a legal side: an audit that began with a single invoice, money entrusted to someone who has disappeared, a company that has to be passed on before it is too late. Most such matters are decided long before the first letter is written, in decisions made without asking and in deadlines nobody remembered. So he begins by asking how the client got here, not what the client should have done.
He advises entrepreneurs and families from more than a dozen countries, including those whose accounts the tax office has just seized and who do not know what to do tomorrow morning. He defends them in tax audits, customs and fiscal inspections, disputes with the tax authorities, and criminal tax proceedings. He represents victims of investment fraud and Ponzi schemes. He helps families set up family foundations and plan succession, so that a life’s work outlasts a single generation.
Not every case can be won. Every case can be run so that the client knows where they stand. Since 2006 he has represented the victims in the WGI case (Warszawska Grupa Inwestycyjna, the Warsaw Investment Group), one of the longest criminal cases in the history of the Polish financial market, because some things must not be left half finished, even when they take two decades. In the case of the collapsed cryptocurrency exchange Zonda (Zondacrypto, operated by BB Trade Estonia OÜ), he represents several hundred victims in the criminal investigation conducted by Poland’s National Prosecutor’s Office and in the Estonian bankruptcy proceedings.
Kancelaria Prawna Skarbiec is listed in the rankings of Poland’s largest tax advisory firms published by Dziennik Gazeta Prawna and Rzeczpospolita, and it is a four-time recipient (2015 to 2018) of the European Medal awarded by the Business Centre Club and the European Economic and Social Committee. Robert Nogacki publishes regularly, in the press and on the firm’s website, for people who have a problem rather than a law degree, because a legal opinion the client cannot understand protects only the lawyer.
He believes that the best legal advice is the kind that means the client never has to appear in court.
