Federal prosecutors in Manhattan say three men used artificial intelligence to pose as company CEOs and as lawyers at big international law firms, and talked finance staff into wiring roughly $129 million to accounts the group controlled. That is the short version of an indictment unsealed on November 5. The three are charged, not convicted, and they are presumed innocent. But the playbook described in the charging papers is worth every business owner’s attention, because nothing about it required hacking a single computer.
What the indictment alleges
The defendants are Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42. According to the indictment, filed in the Southern District of New York, the scheme ran from about July 2024 to February 2026 and targeted thousands of companies worldwide. Each man faces seven counts, including conspiracy to commit wire fraud, wire fraud, aggravated identity theft, and money laundering conspiracy, ABC News reported.
Prosecutors say they arrested Soall in Spain in June, Hazan in Spain in August, and Sheetrit in the United Kingdom in September. Extradition requests for all three are pending. The U.S. Attorney’s Office also noted that Hazan was convicted in 2008 of conspiracy to commit bank fraud in the same federal district.
How the con worked, step by step
The pattern in the court papers is simple, which is exactly why it worked so often.
- The email. An employee with authority over large payments, usually someone in accounting, received an email that appeared to come from the company’s chief executive, asking for help with a confidential financial transaction.
- The call. The group then set up a phone or video call on which, prosecutors say, AI was used to mimic the CEO’s voice and sometimes his or her image.
- The “lawyer.” The fake CEO told the employee to contact an attorney at a major international law firm who was supposedly handling the deal. That attorney was also an impersonation. Prosecutors say Soall mostly played British lawyers and kept a handwritten script titled “Lawyer Call.”
- The wire. The bogus lawyer gave instructions to wire large payments to bank accounts around the world. The money was then converted into cryptocurrency to hide its source and divided among the defendants and others, according to the indictment.
Prosecutors describe Hazan and Sheetrit as the ones mainly responsible for laundering the proceeds. In messages cited by the government, Hazan allegedly bragged that he had been laundering money since 1994, including more than $400 million in the previous three years. That is the government’s characterization of his own words; it has not been tested in court.
Who lost money
The indictment does not name the victim companies, but it describes them. According to CyberScoop’s summary of the charges, the alleged losses include:
- A UK financial technology company: nearly $11.6 million
- A Florida pet food company: $5.2 million
- A Missouri hospital system: about $4.8 million
- A Massachusetts mutual fund company: about $4.6 million
- A California hospital system: nearly $3 million
- A New York investment company: $2.8 million
- A Rhode Island bank: nearly $2.7 million
Look at that list for a second. A bank. A mutual fund. Hospital systems with compliance departments. These are not careless mom-and-pop shops. They have payment controls, and the controls still failed because the request looked and sounded like it came from the boss, and then a “lawyer” confirmed it.
Why AI deepfake CEO fraud is different from the old wire-fraud email
Business email compromise is not new. The FBI has warned about fake-CEO wire requests for more than a decade, and most finance teams have been trained to be suspicious of an email that says “urgent, confidential, wire today.” The standard advice has been to pick up the phone and confirm.
That is what makes this case uncomfortable. The phone call was part of the con. If the voice on the line sounds like your CEO, and the CEO hands you off to an outside lawyer who sounds like a senior partner, the “call to verify” step has been absorbed into the fraud. The FBI’s New York office said the case shows how advanced technology can be exploited to commit large-scale fraud, and it is hard to argue with that.
For a small business, this lands differently than it does for a hospital chain. You probably don’t have a dedicated treasury team. You might be the person who approves wires. Which means the question isn’t whether your staff would fall for it. It’s whether you would. Bruce Dugan made a related point about AI and judgment: you cannot verify what you do not know. If the only check in your process is “does this sound like the person,” that check is now broken.
What I’d change on Monday morning
None of this requires buying software. It requires deciding, in advance and in writing, that certain things never happen on the strength of a call or an email alone.
- Call back on a number you already have. Never on a number, link, or contact supplied in the request itself. If the CEO is “traveling,” call their assistant or their personal phone, which you already have on file.
- Two people for every wire over a threshold. Pick a dollar figure that would hurt. Above it, a second person approves, and that person has to verify independently.
- A code word for money moves. Old-fashioned, cheap, and surprisingly effective against cloned voices. A deepfake can copy how someone sounds; it can’t know a phrase that was never written down.
- “Confidential” is a red flag, not a reason. Almost every version of this scam asks the employee to keep the deal quiet. Make it policy that secrecy requests about payments get escalated, not obeyed.
- Verify the law firm separately. Look up the firm’s main number yourself and ask for the attorney by name.
What others are saying
Coverage has focused on the scale and on the AI angle. The Associated Press reported that lawyers for Soall and Sheetrit did not immediately respond to requests for comment, and that it was not clear whether Hazan had an attorney. Security trade outlets such as Help Net Security have zeroed in on the same weak point I did: the verification call itself.
I covered a very different kind of fraud aimed at people who had already lost money in how to spot stock loss recovery scams, and the through-line is the same. The scam doesn’t beat your defenses. It borrows the trust your defenses rely on.
The verdict
The court will decide whether these three men did what the government says. That will take time, starting with extradition. But the method described in the indictment is already out there, and it does not depend on these particular defendants. If your payment process ends with “and then I confirmed it on a call,” it’s time to add one more step that a cloned voice can’t fake.
All defendants named in this article are charged, not convicted, and are presumed innocent unless and until proven guilty.
