Prosecutors say AI-faked CEOs and lawyers stole $129 million from companies; three charged

Federal prosecutors in Manhattan unsealed an indictment on November 5 charging three men with running a scheme that used artificial intelligence to impersonate company executives and law-firm attorneys, and that took about $129 million from companies. The U.S. Attorney's Office for the Southern District of New York announced the case. These are allegations. The defendants are presumed innocent unless proven guilty, and none has been convicted.

Who is charged, and with what

The indictment names Jacob Soall, 41, of Marbella, Spain, and the United Kingdom; Sharon Hazan, 54, of Israel; and Guy Sheetrit, 42, of Israel and the United Arab Emirates, according to the SDNY release. CBS News and SecurityWeek, both carrying Associated Press copy, report charges of conspiracy to commit wire fraud, wire fraud, aggravated identity theft, money laundering conspiracy and money laundering. Wire fraud and money laundering carry a maximum of 20 years each, and aggravated identity theft carries a maximum of 2 years. IBTimes UK reports seven counts for each defendant.

Soall was arrested in Spain on June 17, 2026, Hazan in Spain on August 5, and Sheetrit in the United Kingdom on September 7. Extradition requests for all three are pending. AP reported that lawyers for Soall and Sheetrit did not immediately respond to requests for comment, and that it was unclear whether Hazan had an attorney.

How the scheme allegedly worked

Prosecutors say the conduct ran from 2024 into 2026 and targeted thousands of companies worldwide over more than a year and a half. Per AP, the group often went after accounting departments. The sequence described in the coverage:

1. An email that appeared to come from the CEO asked an employee for help with a confidential financial transaction.
2. A phone or video call followed in which AI mimicked the CEO's voice and sometimes image.
3. The employee was told to contact an attorney at a major law firm. Co-conspirators allegedly played those lawyers too. Soall mainly posed as UK attorneys, using a handwritten script titled "Lawyer Call."
4. The fake attorney instructed the employee to wire large payments. The SDNY release lists receiving accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China.
5. The money was allegedly converted to cryptocurrency to hide its origin and then split among the defendants and others.

Nothing was hacked. As Ynetnews put it, the employees made the transfers themselves. That is the point for any business: the attack targeted a payment process, not a firewall.

The numbers behind the $129 million

Court documents, as reported by IBTimes UK and Ynetnews, name six victims. Together they account for roughly a quarter of the total; the rest is not itemized in the coverage we reviewed.

The sum is our arithmetic from those figures; the California amount is reported as approximate. The average among the six is about $5.3 million, which shows these were not small invoice tricks. Ynetnews also reports one attempt in October 2024, a $2.85 million transfer authorized by an employee at a New York investment firm, that the firm's operations department stopped at the last moment. A second person in the chain was the difference between a loss and a near miss.

Victims ranged from a hospital system to a pet food maker to a bank. No industry was safe: the common factor was an employee with authority to move money and a story that sounded urgent and confidential. The AP quoted FBI Assistant Director in Charge James C. Barnacle Jr. saying criminals continue to "weaponize emerging technologies" and that the FBI is committed to rapidly adapting. Ynetnews reports the FBI is asking businesses that suspect they were targeted to come forward.

What businesses should take from it

The case describes familiar business email compromise tactics upgraded with synthetic voice and video. We are drawing the following controls from the pattern in the indictment, not from any prosecutor's recommendation:

• A familiar voice or face is no longer proof. If a payment request relies on a call or video from an executive, treat that as unverified until confirmed another way.
• Call back on a number you already hold, from your own directory, never one supplied in the email or on the call.
• Two approvers for new payees and large wires, with the second person reaching the requester independently. The near miss above shows what a second check can do.
• Treat "keep this confidential" as a red flag. The Soall script reportedly discouraged employees from discussing the contact with colleagues. Legitimate deals can survive a verification call.
• Verify outside lawyers through the firm's main number, since the scheme allegedly relied on fake attorneys to carry out the instruction.
• Know your recall steps. If a wire goes wrong, call your bank immediately and report to the FBI; speed matters in recovering funds, and the money here allegedly moved on to crypto.

Accounting staff and small finance teams are the most exposed because one person often holds both the knowledge and the authority to pay. A company with nine employees may not have a second approver, which makes the callback rule the cheapest control available. For more on AI-era attacks, see our coverage of a phone-spoofing incident disclosed in an 8-K and the G7's plan for AI cyberattack drills at banks.

What we could not confirm

The coverage does not name the AI tools used. The SDNY release describes "super intelligence" technology, and we have not seen the indictment itself, which was still listed as sealed on the docket when SecurityWeek reported. Totals are described as "about" or "more than" $129 million depending on the outlet. One outlet reported additional victim details we could not confirm elsewhere, and we have left them out. The case will turn on evidence the public has not yet seen.

Sources: U.S. Attorney's Office, SDNY; Associated Press via CBS News and SecurityWeek; IBTimes UK; Ynetnews. Allegations are not proof of guilt. This is information, not legal or investment advice.