Three men have been charged in an alleged scheme that used artificial intelligence to impersonate executives and lawyers, persuading company employees to transfer more than $129 million to accounts controlled by conspirators. The U.S. Attorney’s Office for the Southern District of New York announced the indictment’s unsealing on November 5, describing fraudulent payment requests reinforced by calls that mimicked a chief executive’s voice or image.
The alleged scheme ran between 2024 and 2026 and reached companies across the United States and abroad. Accounting employees were frequent targets, SecurityWeek reported, with victims spanning healthcare, banking, financial technology, investment management and pet food. The defendants are presumed innocent unless proven guilty.
Jacob Soall, 41, was arrested in Spain on June 17, 2026; Sharon Hazan, 54, was arrested there on August 5; and Guy Sheetrit, 42, was arrested in the United Kingdom on September 7. Prosecutors said extradition requests for all three remained pending.
A confidential transaction, then a supposed lawyer
The indictment describes a sequence built around two impersonations. An employee would receive a request supposedly from their CEO seeking help with a confidential financial transaction. SecurityWeek’s account says the approach began by email, followed by a phone or video call using AI to mimic the executive’s voice and, sometimes, appearance.
The purported CEO would then direct the employee to a lawyer at a major international law firm who was supposedly handling the transaction. Another conspirator would impersonate that lawyer and instruct the employee to wire a large payment to a designated bank account.
The Justice Department calls the technology “super intelligence,” or “SI,” in its announcement. Its account describes the alleged use of technology to imitate voices and images, without identifying a particular product or model.
Soall primarily impersonated UK attorneys, prosecutors allege. They said he kept a handwritten script titled “Lawyer Call,” including language intended to persuade employees not to discuss the communications with colleagues. The secrecy request was therefore part of the alleged deception, alongside the executive and legal identities.
SecurityWeek reported that thousands of companies were targeted over more than a year and a half. That describes the reach of the attempts, rather than a count of companies that lost money.
Losses across several industries
Prosecutors listed six examples of alleged losses within the worldwide total of more than $129 million:
- A Missouri-headquartered hospital system: $4,829,580.
- A Rhode Island-headquartered bank: $2,684,580.
- A California-headquartered hospital system: $2,968,497.
- A UK-headquartered financial technology company: $11,578,474.
- A Massachusetts-headquartered mutual fund company: $4,639,918.
- A Florida-headquartered pet food company: $5,242,747.
Employees allegedly sent funds to conspirator-controlled accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China. Prosecutors say the recipients then converted the money into cryptocurrency to try to conceal its source, ownership and control, before distributing it among the defendants and other participants.
Hazan and Sheetrit allegedly helped launder the proceeds—move and disguise the stolen funds. Prosecutors also cited Hazan’s boasts that he had laundered money since 1994 and more than $400 million in the preceding three years. Those statements were attributed to Hazan and concern broader claimed activity, separate from the losses alleged in this case. Hazan was previously convicted of conspiracy to commit bank fraud in the Southern District of New York in 2008.
Arrests and reporting suspected losses
The announcement identifies Soall as being of Marbella, Spain, and the United Kingdom; Hazan as being of Israel; and Sheetrit as being of Israel and the United Arab Emirates. Prosecutors credited Spain’s Policía Nacional with helping apprehend Soall and Hazan, and the UK’s National Crime Agency with helping apprehend Sheetrit.
Each defendant faces seven counts: conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy and two counts of money laundering. Each fraud and money laundering count carries a maximum sentence of 20 years; each aggravated identity theft count carries a maximum of two years. Any sentence would be determined by the judge.
For companies reviewing suspicious transfers, the alleged sequence is concrete: a confidential executive request, a call imitating that executive, and a supposed outside lawyer directing payment. The Justice Department asks anyone who believes they were a victim, or has information about the alleged perpetrators, to submit it through the FBI’s online tips page at tips.fbi.gov.
