US prosecutors have charged three foreign nationals in an alleged international scheme that used advanced artificial intelligence to impersonate corporate executives and lawyers and defraud companies of more than $129 million. The indictment, unsealed on November 5 by the US Attorney’s Office for the Southern District of New York, describes a fraud operation that allegedly ran from 2024 through 2026. The defendants are accused of using synthetic voices and images to make employees believe they were receiving instructions from senior leaders or legal advisers.
According to the indictment, the operation typically began with a message or call from someone posing as a company chief executive. The impersonator allegedly described a confidential financial transaction and directed an employee to coordinate with lawyers at a major law firm. Other members of the group then allegedly impersonated those lawyers, reinforcing the appearance that the transaction was legitimate. Employees were ultimately instructed to transfer large sums to bank accounts controlled by members of the conspiracy. The sequence combined familiar business procedures with fabricated identities, making the request harder to distinguish from a genuine deal process.
The Justice Department says the scheme affected victim companies across the United States and other countries. Its release identifies alleged losses at a hospital system in Missouri, a bank in Rhode Island, a hospital system in California, a UK financial technology company, a Massachusetts mutual fund company and a Florida pet-food business. The listed amounts are examples within the larger alleged total, not a complete accounting of every victim. The indictment also describes transfers through bank accounts in multiple jurisdictions before proceeds were converted into cryptocurrency.
The indictment details alleged cross-border transfers and charges
The defendants named in the case are Jacob Soall, Sharon Hazan and Guy Sheetrit. The department says Soall was arrested in Spain in June, Hazan in Spain in August and Sheetrit in the United Kingdom in September. Extradition requests are pending. The defendants face charges including conspiracy to commit wire fraud, wire fraud, aggravated identity theft and money-laundering offences. The potential statutory maximums listed by prosecutors are not predictions of sentences; any punishment would depend on the outcome of the case and a judge’s decision.
The case shows how synthetic media can be used as one component in a broader social-engineering operation. A convincing voice clone or video does not need to defeat a company’s entire security system if it can persuade one employee to bypass normal approval steps. The alleged criminals reportedly used confidential language, urgent requests and apparent legal coordination to create pressure and credibility. That combination exploits organisational trust and process gaps rather than a single technical vulnerability. It also shows why deepfake detection software alone cannot be treated as a complete defence.
Companies can reduce exposure by separating identity verification from the communication channel that carries a request. A voice call, video meeting or email should not be the only proof that an executive authorised a transfer. High-value payments should require independent confirmation through a previously established number or authenticated workflow, with dual approval and documented beneficiary checks. Finance teams should be trained to treat secrecy, urgency and requests to avoid normal procedures as warning signs. These controls are useful even when the impersonation is created without AI, because the underlying fraud pattern predates synthetic media.
Payment controls must verify identity outside the communication channel
The allegations also create a difficult question for businesses using generative AI internally. The same tools that help employees summarise meetings, generate content or automate customer service can be repurposed to imitate trusted people. Organisations So need policies that cover identity assurance, employee training, incident reporting and the handling of suspicious audio or video. Security teams should rehearse a scenario in which an apparent executive asks for an urgent transfer, then test whether staff can verify the request without relying on the supplied contact details.