Three Men Indicted in AI Deepfake Impersonation Scheme Defrauding Companies of $129 Million

The industrialization of synthetic voice and video fraud has breached tier-one institutional finance, establishing that audiovisual confirmation alone is no longer an acceptable control for corporate treasury operations.

• The federal indictment: On November 6, 2026, the U.S. Attorney's Office for the Southern District of New York unsealed charges against Jacob Soall, Sharon Hazan, and Guy Sheetrit for orchestrating an AI-enabled fraud network that extracted approximately $129 million between July 2024 and February 2026.
• The synthetic playbook: The group targeted accounting staff by combining executive emails with AI-generated voice and video calls mimicking corporate CEOs, followed by directives from synthetic legal counsel at prominent international law firms to mandate rapid wire transfers for purported confidential acquisitions.
• The cross-border takedown: European and British police arrested Soall in Spain in June 2026, Hazan in Spain in August 2026, and Sheetrit in the United Kingdom in September 2026, with U.S. authorities now seeking their formal extradition on seven criminal counts including wire fraud, aggravated identity theft, and money laundering.

• The technological inflection: Accessible voice-cloning engines and real-time facial synthesis tools matured from theoretical risks into low-cost execution vectors between early 2020 and 2024, enabling bad actors to replicate cadences and likenesses with minimal reference audio.
• The structural vulnerability: Enterprise shifts toward hybrid and distributed work environments normalized high-stakes corporate approvals over remote video channels, dismantling legacy in-person validation steps for multi-million-dollar transactions.
• The laundering infrastructure: Siphoned capital was converted into cryptocurrency across multiple international jurisdictions—including footprints touching the United States, the United Kingdom, Spain, Israel, and the United Arab Emirates—limiting trace velocity for victim institutions.

The mechanics of this $129 million operation expose how artificial intelligence transforms standard social engineering into an institutional-grade exploit. Rather than breaching enterprise firewalls or cracking cryptographic keys, the perpetrators manipulated the human layer of corporate treasury by weaponizing executive authority.

The attack sequence relied on a two-tier verification trap. An initial communication arrived via an email purporting to be from the target company’s chief executive officer, outlining an urgent, confidential transaction. To prevent standard internal cross-checks, the communication enforced secrecy. When corporate accounting personnel sought standard confirmation, the conspirators deployed AI-generated voice and video calls that replicated the CEO’s voice and physical appearance in real time.

Once executive intent was established in the employee's mind, the operation introduced third-party authority. The synthetic CEO instructed internal staff to take direct wire execution commands from an outside attorney at a recognized international law firm. The conspirators then contacted the employee while impersonating those external legal partners, supplying destination routing numbers controlled by the network. By pairing an internal hierarchical command with external professional validation, the attackers systematically neutralized standard corporate skepticism.

The targets spanned U.S. hospitals, banks, mutual funds, and a U.K. fintech firm, demonstrating that the exploit was sector-agnostic. Over an 18-month deployment window, the syndicate targeted thousands of entities worldwide. The financial outcome was consistent: multi-million-dollar transfers were authorized under the impression of executive compliance, after which funds were converted into cryptocurrency across dispersed jurisdictions to frustrate recovery.

For international corporate hubs, the implications are operational and structural. Guy Sheetrit’s reported ties to the United Arab Emirates underline how these cross-border networks interface with global financial jurisdictions. As cross-border financial centers accelerate transaction speeds and remote deal-making, reliance on digital video interfaces without out-of-band cryptographic validation creates systemic exposure. Organizations are discovering that audiovisual cues—traditionally treated as definitive proof of identity—now carry negative verification value.

• Corporate Treasury and Accounts Payable Teams: Finance controllers face immediate liability for wire disbursements executed on visual or auditory executive instructions, forcing an end to informal approval paths.
• Mid-to-Large Healthcare and Financial Institutions: Hospitals, mutual funds, and regional banks operating on legacy accounting systems become priority vectors due to high liquidity volumes and distributed leadership.
• International Law and Advisory Firms: Partners at major global legal practices face brand dilution and client exposure as external actors clone their identities to authenticate fraudulent cross-border settlements.
• Dubai and London Corporate Operators: Financial hubs with high concentrations of multinational leadership and remote decision-makers must absorb higher compliance overhead to verify international capital calls.

• Corporate Mandates for Cryptographic Signatures: Watch for corporate boards instituting hardware-token approvals or out-of-band cryptographic key signing for capital allocations exceeding defined thresholds, replacing verbal and video sign-offs.
• Extradition Timelines and Cross-Border Asset Recovery: Track the proceedings transferring Soall, Hazan, and Sheetrit to the Southern District of New York, which will establish precedents for cross-border cooperation in AI-assisted financial theft.
• Enterprise Demand for Audio/Video Watermarking: Observe institutional adoption of real-time synthetic media detection systems inside enterprise video conferencing software used by executive suites.