Three Men Charged in $129 Million AI CEO Impersonation Scam

Prosecutors say three men used AI voice and video clones to pose as executives and attorneys, taking about $129 million from companies worldwide. Here is how the scheme worked.

By USA 24 Editorial TeamNovember 6, 20265 min read

Smartphone on marble table, blurred glowing waveform, folded reading glasses, dusk light from a window. — Illustration: USA 24

ShareX Facebook LinkedIn Reddit Email

Key takeaways

Prosecutors in Manhattan charged Jacob Soall, Sharon Hazan and Guy Sheetrit with wire fraud, aggravated identity theft and money laundering in a scheme that allegedly stole about $129 million.
The alleged method began with an email posing as a CEO, followed by a phone or video call in which AI mimicked the executive's voice and sometimes image.
The defendants allegedly told victims to contact an attorney at a major law firm, and the group was ready to impersonate that lawyer too.
Six FBI-reported victims named by ITPro total roughly $32 million, leaving about $97 million of the alleged theft without a named victim in the coverage so far.
Each charge except aggravated identity theft carries a maximum of 20 years, while aggravated identity theft carries two years, according to AP's reporting.

Prosecutors say three men used AI-generated voices and video to pose as corporate executives and lawyers, taking about $129 million from companies around the world. Prosecutors announced the indictment on Thursday, November 5, according to AP. It charges Jacob Soall, Sharon Hazan and Guy Sheetrit with wire fraud and aggravated identity theft.

How the AI CEO impersonation scheme allegedly worked

The alleged AI CEO impersonation scheme began with email. According to KTVU, the trio sent messages that appeared to come from a chief executive and asked for help with a confidential financial transaction. The defendants then set up a phone or video call in which they used AI to mimic the CEO's voice and, in some cases, the executive's image, according to the indictment as reported by SecurityWeek.

Over more than a year and a half, the group targeted thousands of companies across the world. The defendants, who went by nicknames including “Rocky Balboa,” “Superman Cash” and “Fat Boy,” often aimed at accounting departments. Accounting staff sit at the point where a payment request becomes money leaving the company.

The request did not stop with the executive. The defendants told victims to contact an attorney at a major law firm, and the group was prepared to impersonate that lawyer as well, according to court documents cited by CBS News. A second voice that sounds like counsel can turn a stalled transfer into what looks like a legal matter that needs immediate action.

The money moved through crypto. Based on court documents, AP reported that the funds were converted into cryptocurrency in an attempt to hide where they came from. They were then distributed to the three men and others involved.

Why this case matters for US payment teams

The mechanics are not new. Business email compromise, in which fraudsters pose as executives to redirect payments, has been a steady fraud type for years. Earlier cases depended on a convincing email. This one adds a convincing voice and, in some cases, a convincing face.

That changes the check most staff rely on. An employee trained to distrust a strange email may still trust a call that sounds exactly like the boss. Wire transfers still depend on people making judgment calls under time pressure, and attackers now have tools that make those calls easier to fool.

The people who bear the loss are the companies that sent the money. Individual consumers are less directly exposed, but the executives and lawyers whose identities were used are real people. AI-driven attacks are also showing up in other incidents, including the WorkOS breach that exposed customer conversations to AI-driven attackers, which shows attackers using AI against more than one kind of target.

Which victims are known so far

ITPro, citing FBI figures, lists six victims:

A Missouri hospital system, nearly $5 million
A Rhode Island bank, $2.7 million
A California hospital system, $3 million
A UK fintech, around $11.5 million
A Massachusetts mutual fund company, $4.6 million
A Florida pet food company, $5.2 million

Those six losses add up to roughly $32 million. That leaves about $97 million of the $129 million total without a named victim in the coverage available so far. The full victim list has not been published, and it is unclear whether any victims have recovered funds.

What the charges carry

The defendants face wire fraud, aggravated identity theft and money laundering charges. According to AP's reporting, citing the attorney's office, each charge carries a maximum sentence of 20 years, except aggravated identity theft, which carries two years. Those are maximums, not predictions, and any sentence would follow a conviction.

Soall is 41, Hazan is 54 and Sheetrit is 42, according to SecurityWeek. The three were arrested between June and September 2026. SecurityWeek also reported, citing the U.S. Attorney's Office, that Hazan was convicted in a New York court in 2008 of conspiracy to commit bank fraud. The sources do not say how that history will factor into the case.

Reports also differ on nationality. CBS lists Spain, the UK, Israel and the United Arab Emirates among the defendants' home countries, while NBC News says Soall is from Spain and the UK. Hazan's nationality was not confirmed in the sources reviewed.

Lawyers for Soall and Sheetrit did not immediately respond to requests for comment, and it was unclear whether Hazan had an attorney, ClickOrlando's AP report noted. An FBI statement said that “the FBI remains committed to rapidly adapting our capabilities.” The excerpt reviewed does not name the speaker, so that line should not be attributed to a specific official.

How to stop AI voice cloning wire fraud

Companies can blunt this kind of scheme without waiting for detection tools to improve. The steps below are general guidance, not findings from the court record.

Require a callback to a phone number already on file before any wire or payment change, even when the request appears to come from an executive on a video call.
Set dual approval for large transfers so that no single person can release money based on a voice or video request.
Verify new payment instructions through a separate channel, not the one that delivered the request.
Train accounting, finance and treasury staff to assume that voices and faces can be cloned, and make clear that pausing a transfer to check is expected.
Treat urgent requests involving money or confidential deals as suspicious by default.

The same logic applies outside finance. If a boss, relative or colleague asks for money through an urgent call, hang up and confirm through a number you already have.

What happens next in the case

The indictment is not a conviction, and all three defendants are presumed innocent unless proven guilty. The docket was still listed as sealed in online court records on Thursday evening, so filings that name defense lawyers or additional victims could be the next signals.

Three questions will shape the story. First, will prosecutors publish a fuller victim list, or will the remaining roughly $97 million be traced? Second, will any victims recover money through the crypto trail? Third, do co-conspirators remain at large? The coverage so far does not answer any of them.

For finance teams, the lesson does not have to wait for a trial. A callback policy costs little to set up, and the next urgent request may come from a voice that sounds exactly like the boss.

Frequently asked questions

How did the AI CEO impersonation scheme work?

According to the indictment as reported by SecurityWeek, the group first sent emails that appeared to come from a chief executive asking for help with a confidential transaction. They then held a phone or video call in which AI mimicked the CEO's voice and, in some cases, image. The defendants also told victims to contact an attorney at a major law firm, whom the group was ready to impersonate.

Who were the three people charged in the $129 million case?

Prosecutors charged Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42, according to SecurityWeek. They were arrested between June and September 2026. The indictment is an allegation, and all three are presumed innocent unless proven guilty.

What penalties do the charges carry?

According to AP's reporting, each wire fraud and money laundering charge carries a maximum sentence of 20 years. Aggravated identity theft carries a maximum of two years. These are maximum penalties that would apply only after a conviction.

How can a company protect itself from AI voice cloning wire fraud?

Require a callback to a phone number already on file before any payment change, even if the request appears to come from an executive on video. Set dual approval for large transfers and verify new payment instructions through a separate channel. Train staff to treat urgent requests involving money as suspicious by default.

Has any of the stolen money been recovered?

The coverage reviewed does not say whether any victims have recovered funds. About $32 million of the $129 million total is tied to six victims named by ITPro, citing FBI figures, while the remaining roughly $97 million is not itemized in the sources reviewed.

Sources

#Deepfake Fraud #Business Email Compromise #Wire Fraud #AI Scams #Cybercrime

About this article. Reported and produced by the USA 24 newsroom using the sources cited above. Read our editorial policy. Spotted an error? Tell us and we will correct it.