Federal prosecutors say three men used AI to impersonate CEOs and lawyers, tricking accounting staff into wiring at least $129 million to criminal-controlled accounts.

 

What happened

On November 5, 2026, the Justice Department announced charges against Jacob Soall, Sharon Hazan, and Guy Sheetrit. According to court records, the trio and their co-conspirators targeted thousands of victims between July 2024 and February 2026. They allegedly used AI to copy the voices and images of CEOs and of lawyers at major international law firms.

Victims include a U.K.-based financial tech company, a Florida pet food company, a Missouri hospital system, a Massachusetts mutual fund company, a California hospital system, a New York investment company, and a Rhode Island bank.

Authorities arrested Soall in Spain on June 17, Hazan in Spain on August 5, and Sheetrit in the United Kingdom on September 7. The three face seven counts, including conspiracy to commit wire fraud, aggravated identity theft, and money laundering. The counts carry a maximum sentence of 104 years in prison.

 

Going deeper

Prosecutors outline a repeatable playbook:

  • The group targeted employees with enough authority to approve large wire transfers.
  • It began by targeting accounting staff, using deepfakes to pose as the CEO and ask for help with a financial transaction.
  • An email from an e-signature company said the CEO was working on a “confidential financial transaction.” The email required the employee to sign a non-disclosure agreement before contacting an attorney.
  • The group directed employees to contact attorneys, whom it also impersonated, to make the transaction look legitimate. Some posed as attorneys at the world’s 50 largest law firms.
  • Co-conspirators controlled the receiving bank accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia, and China. The group allegedly converted the money to cryptocurrency and split it among themselves.

Prosecutors say Soall mainly impersonated U.K. attorneys and read from a handwritten script. They say Hazan boasted of laundering money since 1994, including more than $400 million in the past three years. He was convicted in the Southern District of New York of conspiracy to commit bank fraud in 2008. Prosecutors say Sheetrit laundered funds from the scheme.

 

What was said

Jamie McDonald, U.S. attorney for the Southern District of New York, said in a statement that “there are some who seek to use this emerging technology to pursue criminal goals.” He added that super intelligence technology still offers tremendous potential.

James C. Barnacle Jr., assistant director in charge of the FBI New York field office, stated that the alleged scheme shows how criminals can exploit advanced technology for large-scale fraud. He also said “the FBI remains committed to rapidly adapting our capabilities” as criminals weaponize emerging technologies.

Sheetrit’s attorneys, Sharon Nahari and Shay Shorer, emailed CyberScoop a statement. They said their client “has no connection to this matter and has had no involvement in it whatsoever.” They described him as a businessman with cybersecurity and technology expertise who advises clients. They argued that this work cannot establish complicity in the alleged conduct, and that he is entitled to the presumption of innocence.

 

By the numbers

  • At least $129 million allegedly stolen
  • Thousands of targeted victims between July 2024 and February 2026
  • About $11.6 million lost by a U.K.-based financial tech company
  • $5.2 million lost by a Florida-based pet food company
  • $4.8 million lost by a Missouri-based hospital system
  • $4.6 million lost by a Massachusetts-based mutual fund company
  • Nearly $3 million lost by a California-based hospital system
  • $2.8 million lost by a New York-based investment company
  • Nearly $2.7 million lost by a Rhode Island-based bank
  • Nine countries received the wire transfers
  • Seven counts, with a maximum sentence of 104 years

 

Why it matters

This case shows attackers aiming at people instead of systems. The group chose employees who could authorize large wire transfers and built a convincing chain of trust around them. A familiar CEO came first, then an e-signature email and an NDA, and finally a call with a lawyer from a well-known firm. Each step made the request look more legitimate.

Healthcare organizations are among the named victims. A Missouri hospital system lost $4.8 million, and a California hospital system lost nearly $3 million. Money lost to fraud like this is money that cannot go toward patient care.

The case also shows how long a scheme like this can run, lasting about 19 months and reached thousands of targets before the arrests.

 

The bottom line

Deepfakes can make a fake executive or lawyer sound and look real, so a familiar voice or face is no longer proof of identity. Organizations should train finance and accounting staff to treat urgent, confidential payment requests with suspicion. They should also require verification through a separate, trusted channel before anyone moves money.

Related: How AI is arming phishing and deepfake attacks

 

FAQs

How is deepfake fraud different from traditional phishing?

Traditional phishing relies on deceptive emails or links, while deepfake fraud adds a convincing voice or face that can make the request feel more personal and trustworthy.

 

What are common warning signs of a deepfake call or video?

Warning signs include unusual delays, odd lip movement or audio quality, and requests that stress urgency or secrecy.

 

What is call-back verification?

Call-back verification requires the user to contact the requester using a phone number already on file to confirm a payment request, rather than using the phone number or contact details they provide in the request.