Three men face U.S. charges over an alleged artificial-intelligence impersonation scheme that used synthetic voices and images of corporate executives and lawyers to induce companies to wire more than $129 million to accounts controlled by the conspiracy.
The U.S. Attorney’s Office for the Southern District of New York said it unsealed an indictment on November 5 charging Jacob Soall, Sharon Hazan and Guy Sheetrit with conspiracy to commit wire fraud, wire fraud, aggravated identity theft and money-laundering offenses. Prosecutors allege the activity ran from 2024 through 2026 and targeted thousands of companies in the United States and elsewhere.
According to the indictment, the conspirators typically posed as a victim company’s chief executive and used AI to mimic the executive’s voice or image during calls with an employee. The purported executive would describe a confidential financial transaction and direct the employee to contact lawyers at a major international firm. A second impersonator would then pose as one of those attorneys and instruct the employee to send funds to a designated bank account.
The alleged proceeds moved through accounts in multiple countries, including the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China. Prosecutors say conspirators converted transferred money into cryptocurrency to obscure its source and ownership. The listed victims included hospital systems, a Rhode Island bank, a U.K. financial-technology company, a Massachusetts mutual-fund company and a Florida pet-food company.
Soall was arrested in Spain on June 17, Hazan in Spain on August 5, and Sheetrit in the United Kingdom on September 7. Extradition requests are pending, and each defendant faces charges carrying maximum individual penalties of up to 20 years for several wire-fraud and money-laundering counts, as well as two-year aggravated-identity-theft counts. The Justice Department stressed that the indictment contains allegations and that the defendants are presumed innocent unless proven guilty.
The case illustrates why payment controls cannot rely on voice recognition, caller identity or apparent executive authority alone. Companies should require independent, out-of-band confirmation for urgent or confidential transfers, enforce dual approval and callback procedures, and treat secrecy demands or last-minute changes to payment instructions as fraud indicators. No software vulnerability or CVE is identified in the government’s charging materials; the alleged attack instead exploited trust, business processes and increasingly convincing AI-generated identities.
