Diwali Sale is live — Enjoy up to 60% off →

Three charged over $129 million scheme that used AI to fake CEOs and lawyers

Prosecutors say the fake executives and fake attorneys were on live calls, and the stolen money was moved into crypto after the wires landed.

8 November 2026 • 7 min read

Three charged over $129 million scheme that used AI to fake CEOs and lawyers

In October 2024, an employee at a major New York investment bank approved a payment of about $2.85 million for what he had been told was a confidential deal. The wire never left the building. Prosecutors said the bank's back office halted the wire before it was sent.

Federal prosecutors in Manhattan say the conspiracy behind that attempt ran from about July 2024 through February 2026.

Three men have been indicted in Manhattan on charges of stealing more than $129 million from companies worldwide by using artificial intelligence technology to impersonate corporate executives and attorneys. The US Attorney's Office for the Southern District of New York announced the case last Thursday. The defendants are Jacob Soall, 41, of Marbella, Spain, and the United Kingdom; Sharon Hazan, 54, of Israel; and Guy Sheetrit, 42, of Israel and the United Arab Emirates. Each faces seven counts: conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy, and two counts of money laundering. These are allegations, and all three are presumed innocent.

The fake CEO opens the door and the fake lawyer asks for the money

It was a two-stage con.

According to the indictment, the scheme typically began with an email from an e-signature company, wherein the impersonated CEO claimed they were working on a "confidential financial transaction" that required the victim employee to sign a non-disclosure agreement before contacting the purported attorney. Then came a live conversation: the defendants would coordinate a phone or video call and use AI to mimic the voice and sometimes the image of the CEO, according to the indictment. They often targeted the organizations' accounting departments.

At no point did the "CEO" ask for the money directly. The defendants would instead tell the employee to contact an attorney at a major law firm, whom the group was also ready to impersonate, according to court documents. They allegedly impersonated attorneys at some of the 50 largest law firms globally. The SDNY release says that a member of the conspiracy, impersonating one of those lawyers, would ultimately direct the employee to wire a large sum of money.

Prosecutors say Soall played the lawyers. He mainly impersonated attorneys from the UK and had a "handwritten script titled 'Lawyer Call' that he utilized to make himself seem like a real attorney when speaking with and defrauding victims," according to the U.S. attorney's office. One account of the indictment says the script leaned on confidentiality and insider-trading rules to stop employees from talking to colleagues.

As prosecutors describe it, the lawyer the "CEO" pointed the employee to was also played by a member of the conspiracy, so the two people on the calls were part of the same scheme. The NDA and the script's confidentiality warnings were meant to keep the employee from asking anyone else.

Who lost money

Some of the losses are named in the SDNY release. A hospital system headquartered in Missouri lost $4,829,580, and one headquartered in California lost $2,968,497. A bank headquartered in Rhode Island lost $2,684,580. Other outlets reporting from the release list a U.K.-based financial tech company that lost almost $11.6 million. They also name a Florida-based pet food company that lost $5.2 million and a Massachusetts-based mutual fund company that lost $4.6 million.

Together those six come to roughly $31.9 million, about a quarter of the total. The release doesn't say where the other $97 million or so came from. AP reported that the three targeted thousands of companies across the world.

At the conspirators' direction, the Victim Companies wired money to bank accounts controlled by conspirators all over the world, including in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia, and China. After that, prosecutors say, they converted it into cryptocurrency in an attempt to hide where the stolen proceeds came from and who owned and controlled them, and distributed it amongst themselves and their co-conspirators.

Hazan and Sheetrit are accused of laundering the money. Prosecutors say Hazan claimed he had been laundering money since 1994 and had moved more than $400 million in the past three years alone. Hazan was previously convicted in the Southern District of New York of conspiracy to commit bank fraud in 2008.

Soall was arrested in Spain on June 17, 2026, and Hazan was arrested there on August 5, 2026. Sheetrit was arrested in the United Kingdom on September 7, 2026. Extradition requests for all three are pending. They could face up to 20 years for wire fraud and money laundering charges, in addition to up to two years for aggravated identity theft charges, according to the release.

Several questions go unanswered in the release. It does not say how the voices and images were generated or how any victim company's bank flagged the transfers. Nor does it say how much of the $129 million has been recovered. Prosecutors call the technology "super intelligence," which tells readers nothing about which tools were used.

What stopped the one wire that failed

The employee approved the payment, but the bank's back office halted the wire before the money moved. Prosecutors have not said why the back office stopped it or whether anyone there recognized the calls as fake.

Controls that would have broken this particular con don't depend on spotting fake audio or video:

Treat any urgent payment request that comes with a confidentiality demand as a warning sign, however convincing the voice or face on the call.
Confirm by calling back on a number you already had, from the company directory or an old contract. Never use one that came in the email or calendar invite. A number offered on the call is no better.
Require a second approver for any new wire destination, and make sure that person wasn't part of the conversation.
If the person asking for money introduces a lawyer, find that law firm's main switchboard yourself and ask for the attorney by name.

Individuals face the same setup on a smaller scale: a cloned relative calls in a panic and hands the line to a "police officer" or "lawyer," who has the money sent as a wire or crypto transfer. Hanging up and calling back on a number you already know works there too.