US Charges Three Men in $129 Million AI Deepfake CEO Fraud Scheme

The U.S. Department of Justice has unsealed an indictment charging three foreign nationals with orchestrating a sophisticated international fraud ring that utilized artificial intelligence to impersonate chief executives and lawyers. The operation allegedly stole approximately $129 million from companies across the globe.[1][2]

Running from July 2024 through February 2026, the scheme targeted thousands of businesses worldwide, exploiting the trusted communication channels of corporate accounting departments. By cloning the voices and sometimes the faces of real executives, the conspirators bypassed traditional verification methods that rely on human recognition.[1][4]

Federal prosecutors in the Southern District of New York charged Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42, with seven counts each. The charges include conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy, and two counts of money laundering.[1][4]

The three men were apprehended in Europe over the summer of 2026. Soall, who holds citizenship in Spain and the United Kingdom, was arrested in Marbella, Spain, on June 17. Hazan, an Israeli national, was arrested in Spain on August 5, while Sheetrit, who holds citizenship in Israel and the United Arab Emirates, was detained in the United Kingdom on September 7.[4][6]

The deepfake mechanism

The fraud typically began with a targeted email sent to a mid-level accounting employee who possessed the authority to initiate large wire transfers. Often routed through electronic signature services like DocuSign, the message purported to be from the company's chief executive officer, requesting urgent assistance with a highly confidential financial transaction.[4][5]

Once the employee engaged, the conspirators escalated the deception to a live phone or video call. During these interactions, the group deployed advanced AI technology—which the Justice Department refers to as "super intelligence"—to mimic the executive's voice and, in some instances, their visual appearance on screen.[1][4]

After establishing the premise of a secret deal, the cloned executive would instruct the employee to coordinate the actual transfer of funds with outside legal counsel. The employee was then connected to a fake attorney, with the conspirators frequently borrowing the identity of a real lawyer working in the European office of a major international law firm.[2][5]

Prosecutors allege that Soall primarily handled the attorney impersonations, adopting the persona of a United Kingdom-based lawyer. According to the indictment, Soall utilized a handwritten document titled "Lawyer Call," which provided a script designed to pressure victims into moving the money quickly while maintaining strict confidentiality within their own organizations.[2][4]

Catastrophic corporate losses

The deception proved highly effective against mid-sized institutions that relied on verbal approvals for wire transfers. The indictment details catastrophic losses at six specific companies, including a United Kingdom-based financial technology firm that wired $11.58 million to the scammers.[2][6]

American companies suffered similarly severe financial hits during the 18-month operation. A hospital system headquartered in Missouri lost $4.83 million, while a separate hospital system in California was defrauded of $2.97 million. A bank based in Rhode Island lost $2.68 million to the scheme.[2][6]

The financial damage extended across multiple sectors of the United States economy. A Massachusetts mutual fund company wired $4.64 million to the conspirators, and a Florida pet food manufacturer lost $5.24 million. None of these targets were small operations; they were established entities running routine wire approvals through trusted voices.[2][6]

Not every target fell for the scheme. The indictment notes that in October 2024, the group attempted to steal roughly $2.85 million from a major New York investment bank. Although an employee authorized the payment after interacting with the deepfaked executives, the bank's back-office compliance team flagged the transaction and stopped the wire.[4]

Laundering the proceeds

When transfers were successful, the funds were wired to bank accounts scattered across the globe. To obscure the money's origins and complicate recovery efforts, the conspirators rapidly converted the stolen fiat currency into cryptocurrency. The digital assets were then divided and distributed among the three defendants and other unnamed participants.[1][3]

The indictment highlights the extensive financial history of the accused. Hazan was previously convicted of conspiracy to commit bank fraud in the same Manhattan federal court in 2008. Furthermore, prosecutors allege that one of the defendants openly bragged about his laundering capabilities, claiming to have washed more than $400 million over the previous three years.[1][4]

Federal authorities framed the arrests as a critical step in combating next-generation financial crime. "As criminals continue to weaponize emerging technologies, the FBI remains committed to rapidly adapting our capabilities to identify, investigate, and disrupt those who seek to harm New Yorkers and businesses," stated FBI Assistant Director in Charge James C. Barnacle Jr.[4]

U.S. Attorney Jamie McDonald emphasized the dual nature of the technology involved. "SI technology offers tremendous potential. But the public should recognize that there are some who seek to use this emerging technology to pursue criminal goals," McDonald said, urging the business community to evaluate their defenses against AI-enabled deception.[2][5]

AI

A shifting threat landscape

The $129 million scheme is part of a broader surge in AI-driven corporate fraud. In recent years, deepfake technology has been linked to several high-profile thefts, including a $25 million loss by the British engineering firm Arup, where an employee was fooled by a video call featuring multiple AI-generated executives.[2]

The cryptocurrency sector has also been heavily targeted by impersonation tactics. In 2022, the Ronin network suffered a $625 million hack, which the FBI attributed to North Korean state actors, after a developer was targeted with a malware-laced job offer following several rounds of fake interviews.[4]

Cybersecurity experts note that the traditional standard of recognizing a voice on the phone is no longer a viable security control. To defend against AI cloning, companies are being urged to implement strict out-of-band verification protocols, such as requiring employees to hang up and call the executive back on a known, pre-established phone number.[2][5]

Beyond callbacks, security frameworks now emphasize multi-person approvals for all significant financial movements. Experts advise that executives must explicitly endorse these friction points in writing, ensuring that accounting staff feel empowered to halt urgent, confidential requests without fear of professional reprisal.[5][6]

Pending legal proceedings

The Justice Department stressed that the indictment contains only allegations. Soall, Hazan, and Sheetrit are presumed innocent unless and until proven guilty in a court of law. If convicted, the wire fraud and money laundering charges each carry maximum potential sentences of 20 years in federal prison.[1][4]

In response to the escalating threat, the Justice Department recently established a dedicated Super Intelligence Task Force. Led by senior officials, the unit is specifically designed to monitor and counter the misuse of advanced AI models by foreign state actors, transnational criminal syndicates, and individuals engaged in large-scale fraud.[1]

The rapid commercialization of generative AI has democratized capabilities that were once restricted to well-funded intelligence agencies. Voice cloning software now requires only a few seconds of clean audio—easily harvested from public speeches or corporate videos—to generate a convincing, real-time synthetic voice that can bypass human scrutiny.[2][4]

The case will proceed in the Southern District of New York once the extradition processes in Spain and the United Kingdom are completed. Meanwhile, the FBI has issued a public call for other companies that may have been victimized by the group's 18-month operation to come forward and assist with the ongoing investigation.[3][6]