Three Men Charged Over $129 Million AI CEO Impersonation Fraud as US Justice Department Unseals Indictment

Three foreign nationals have been charged in the United States with using artificial intelligence to impersonate chief executives and lawyers in a fraud that prosecutors say stole more than $129 million from companies around the world, according to an indictment unsealed by the Department of Justice on Thursday.

Jacob Soall, Sharon Hazan and Guy Sheetrit are accused of using AI to copy the voices and faces of senior executives and attorneys at major law firms, then persuading employees at the targeted companies to wire large sums of money to bank accounts controlled by the alleged conspirators, according to the United States Attorney’s Office for the Southern District of New York.

The case, announced on 5 November 2026, is one of the largest AI-enabled fraud prosecutions ever brought in the United States, and it arrives on the same day the Justice Department formally launched a new task force dedicated to crimes committed with what the Trump administration now calls “super intelligence”.

“SI technology offers tremendous potential. But the public should recognize that there are some who seek to use this emerging technology to pursue criminal goals,” U.S. Attorney Jamie McDonald said in a statement. “As alleged, Jacob Soall, Sharon Hazan, and Guy Sheetrit abused groundbreaking super intelligence technology to impersonate real people and deceive corporate executives into sending them and their co-conspirators approximately $129 million.”

All three men were arrested in Europe over the summer and are awaiting extradition to the United States. Soall, 41, of Marbella, Spain, and the United Kingdom, was arrested in Spain on 17 June 2026. Hazan, 54, of Israel, was arrested in Spain on 5 August 2026. Sheetrit, 42, of Israel and the United Arab Emirates, was arrested in the United Kingdom on 7 September 2026. Extradition requests for all three are pending, according to the Justice Department.

The charges contained in the indictment are merely accusations, and the defendants are presumed innocent unless and until proven guilty, the department said.

How the scheme allegedly worked

According to the indictment, the scheme ran between July 2024 and February 2026, a period of about a year and a half, and targeted thousands of companies, including banks, financial technology firms and hospitals, across the United States and around the world.

Prosecutors say the conspirators typically began by targeting an employee at a victim company and pretending to be that company’s chief executive officer. They would explain that they needed the employee’s help with a confidential financial transaction and would use AI to mimic the chief executive’s voice or image in calls with the employee.

While pretending to be the chief executive, they would direct the employee to contact lawyers at large international law firms who they said were also working on the supposed transaction. They would then impersonate those lawyers as well, to make the employee believe the transaction was real. A member of the conspiracy, impersonating one of those lawyers, would ultimately direct the employee to wire a large sum of money to a particular bank account, which was in fact controlled by members of the conspiracy, according to the indictment.

It was a two-stage deception, and that structure is part of what made it effective. The first impersonation created the urgency and the authority: a message, apparently from the boss, asking for help with something secret and time-sensitive. The second impersonation supplied the verification: when the employee, quite sensibly, wanted to check the transaction with an outside lawyer, the “lawyer” who answered was part of the same operation.

Prosecutors say the conspirators also took care to close off the obvious escape routes. Soall primarily acted to impersonate attorneys from the United Kingdom, according to the Justice Department, and he kept a handwritten script titled “Lawyer Call” that he used to make himself sound like a real attorney when speaking with victims. The script included language designed to convince victim employees not to discuss their communications with fellow employees, the department said.

That detail matters. In many corporate frauds, the moment a second person is consulted is the moment the scheme collapses. A colleague asks an awkward question, a finance director checks a bank detail, and the whole edifice falls. The “Lawyer Call” script was, according to prosecutors, an attempt to seal that gap: keep the victim isolated, keep the conversation confidential, and keep the money moving.

Once a victim company’s money had been wired, the conspirators converted it into cryptocurrency in an attempt to conceal the source, ownership and control of the stolen proceeds, and distributed it amongst themselves and their co-conspirators, according to the Justice Department. The money was directed to bank accounts controlled by the conspirators in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China.

The victims: hospitals, banks and a pet food company

The fraud scheme ultimately stole more than $129 million from victim companies all over the United States and the world, according to the Justice Department. The indictment names six victims by sector and amount, among others.

A hospital system headquartered in Missouri lost $4,829,580. A bank headquartered in Rhode Island lost $2,684,580. A hospital system headquartered in California lost $2,968,497. A financial technology company headquartered in the United Kingdom lost $11,578,474, the largest single named loss. A mutual fund company headquartered in Massachusetts lost $4,639,918. And a pet food company headquartered in Florida lost $5,242,747.

The list is striking for its variety. Two hospital systems, a bank, a fintech, a mutual fund and a pet food company have almost nothing in common except that each employs people who handle money, each has a chief executive whose voice and image exist in public, and each was reachable by phone and email. The breadth of the list is itself a message: this was not a scheme aimed at one industry or one kind of company. It was aimed at any organisation where a confident voice claiming to be the boss could reach a finance employee.

The inclusion of two hospital systems is particularly notable. Hospitals run on thin margins and handle life-or-death work; a loss of nearly $5 million from a hospital system is money that cannot be spent on staff, equipment or patient care. The indictment does not name the hospitals, and the Justice Department has not identified any of the victim companies by name.

Prosecutors say the conspirators targeted thousands of companies in total. The $129 million figure covers the losses the indictment attributes to the scheme; the six named victims account for about $35 million of it, which means the great majority of the money came from other companies that have not been publicly identified.

The three men and their alleged roles

Each of the three defendants is accused of playing a distinct part in the operation, according to the Justice Department.

Soall, who also used the names “Seba Clarke” and “Rocky Balboa”, is alleged to have been the impersonator-in-chief on the legal side of the fraud, posing as attorneys from the United Kingdom and working from the handwritten “Lawyer Call” script. Hazan, also known as “Superman Cash”, “Impossible Mission”, “Fat Boy” and “Ron”, is accused of laundering the proceeds. Prosecutors say Hazan boasted that he had been laundering money since 1994, that he had laundered more than $400 million in just the past three years, and that, among professional money launderers, he was “number one all over the world”. Sheetrit is also accused of laundering funds from the scheme.

Hazan was previously convicted in the Southern District of New York in 2008 of conspiracy to commit bank fraud, according to the Justice Department. That earlier conviction means he was not a newcomer to American federal court, and it may also matter at sentencing if he is convicted: a prior fraud conviction is the kind of history judges weigh heavily.

The colourful aliases — “Rocky Balboa”, “Superman Cash”, “Fat Boy” — sit oddly beside the scale of the alleged crime, and they may prove to be more than colour. In fraud prosecutions, nicknames and boasting often become evidence: they appear in messages, in recordings and in the testimony of co-conspirators, and they help prosecutors show that a defendant understood exactly what he was doing. A man who calls himself “Superman Cash” and claims to be the world’s best money launderer will find it difficult to argue later that he did not understand the nature of the enterprise.

Each defendant faces seven counts: conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, conspiracy to commit money laundering, and two counts of money laundering. Each wire fraud and money laundering count carries a maximum sentence of 20 years in federal prison, while each aggravated identity theft count carries a maximum of two years. Taken together, the seven counts carry a combined maximum potential sentence of 104 years, according to reporting on the indictment. The maximum sentences are prescribed by Congress and provided for informational purposes only, the Justice Department said, as any sentence will be determined by a judge.

The case is being handled by the Southern District of New York’s Complex Frauds and Cybercrime Unit, with Assistant U.S. Attorneys Kevin Mead, Brandon C. Thompson and Jackie Delligatti in charge of the prosecution. The Justice Department thanked the FBI, Spain and its Policía Nacional for their assistance in apprehending Soall and Hazan, and the United Kingdom and its National Crime Agency for their assistance in apprehending Sheetrit. The department’s Office of International Affairs provided significant assistance in securing the arrests in Spain and the United Kingdom.

“The alleged scheme orchestrated by Soall, Hazan, and Sheetrit demonstrates how the use of advanced technology can be exploited to commit large scale fraud,” said FBI Assistant Director in Charge James C. Barnacle, Jr. “As criminals continue to weaponize emerging technologies, the FBI remains committed to rapidly adapting our capabilities to identify, investigate, and disrupt those who seek to harm New Yorkers and businesses operating in our communities.”

A task force launched on the same day

The indictment was unsealed on the same day the Justice Department announced the formation of its Super Intelligence Task Force, known as DOJ-SITF, a unit designed to safeguard the department against the malicious use of AI and to coordinate criminal and civil enforcement against AI misuse.

The task force will be co-chaired by Associate Attorney General Stanley Woodward and Associate Deputy Attorney General Stephen Weiss. According to Attorney General Todd Blanche, writing in a memorandum dated 13 October, the task force will ensure that America’s leadership in super intelligence “is not compromised by the misuse of SI by foreign state and state-sponsored actors, transnational criminal organizations, and individual or corporate actors engaged in fraud or other unlawful conduct”.

The timing was plainly deliberate. A department announcing a new unit to fight AI crime on the same day it unseals a $129 million AI fraud indictment is making a statement about its priorities, and the indictment gives the task force an immediate, concrete example of the threat it exists to confront.

The language itself is part of the story. “Super intelligence” is the term the executive branch now uses in place of “artificial intelligence”, under Executive Order 14434, signed by President Donald Trump on 29 September 2026 and titled “Inaugurating the Era of Super Intelligence”. The order directs federal agencies to use “super intelligence” instead of “artificial intelligence” in new, non-statutory official materials. It borrows the existing federal legal definition of AI for now, but sets a deadline of 28 November for the White House science adviser to propose formal legislative language defining the term.

The rename has attracted scepticism. The term “superintelligence” already had an established meaning in philosophy — an intellect that greatly exceeds human cognitive performance in virtually all domains of interest — and critics note that the executive order changes a label without creating any new offence or any new legal category for prosecutors to charge under. The indictment against Soall, Hazan and Sheetrit was brought under existing wire fraud, identity theft and money laundering statutes, not under any new AI law. The task force, likewise, creates no new offence.

That is worth stating plainly, because it cuts against one easy reading of this week’s announcements. The government has not invented a new crime of “AI fraud”. It has taken old crimes — lying to people to steal their money — and applied them to a new method of lying. The technology is new; the crime is not. And that is, in a sense, reassuring: it means prosecutors do not need to wait for new laws to act. It also means the defence available to the accused is the familiar one — that the allegations are unproven — rather than a technical argument about whether a statute covers AI.

The DOJ task force will also serve as the department’s main point of contact with the White House Super Intelligence Force, a separate body chaired by Director of National Intelligence Jay Clayton, which coordinates the government’s engagement with AI companies. That force agreed at its first meeting on 15 October to develop protocols for AI companies to provide early warnings about breaches, hacks and jailbreaks. The DOJ task force absorbs an AI Litigation Task Force created in January under former Attorney General Pam Bondi, whose assignment was to challenge state AI laws seen as conflicting with federal policy — a responsibility the new task force now takes over.

The wider pattern: a crime category that barely existed a few years ago

The $129 million case is the largest of its kind to reach a federal courtroom, but it is not an isolated incident. It sits at the sharp end of a trend that law enforcement and cybersecurity researchers have been documenting for several years: the industrialisation of impersonation.

Business email compromise — fraud carried out by impersonating a trusted business contact to induce an unauthorised transfer — was already one of the costliest cybercrimes in the world before AI entered the picture. The FBI’s Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025, with roughly $3.05 billion in reported losses, up from $2.77 billion across 21,442 complaints in 2024. Total reported business email compromise losses between October 2013 and December 2023 exceeded $55 billion.

What is new is the AI component. For the first time, the FBI’s 2025 Internet Crime Report, released in April 2026, tracked AI-related complaints as their own category: 22,364 complaints with $893 million in reported losses. Within that, business email compromise scams with a confirmed AI link accounted for more than $30 million across 135 complaints — a category that barely existed in official reporting a few years ago. The true figure is almost certainly higher, because most victims never learn that AI was involved in the fraud against them.

The best-known previous case is that of Arup, the British engineering firm. In early 2024, a finance employee at Arup’s Hong Kong office received an email that appeared to come from the company’s UK office asking for a confidential transaction. He suspected phishing, so he joined a video call to confirm the request with the chief financial officer and several colleagues he recognised. Every face and every voice on that call was a deepfake, built from publicly available footage of the real executives. He authorised 15 wire transfers totalling about $25.6 million before the fraud was discovered. Hong Kong police later confirmed the details, and Arup’s chief information officer described it as technology-enhanced social engineering.

The Arup case was a warning, and it was widely reported at the time. The $129 million indictment suggests the warning was not heeded widely enough — or, more precisely, that the criminals learned faster than their targets. The Arup fraud relied on a single video call and a single victim. The scheme alleged in the Southern District indictment ran for a year and a half, targeted thousands of companies, and combined voice cloning with face cloning, fake lawyers and cryptocurrency laundering into something closer to an assembly line.

The FBI has been warning about this trajectory for some time. In May 2025, the bureau warned in a public service announcement that criminals were sending text messages and AI-generated voice messages impersonating senior US officials, often urging recipients to move the conversation to another messaging platform. In July 2026, it warned of AI-generated videos of FBI leaders promoting fake complaint sites. The warnings have now been followed by the largest prosecution of the kind, and by a dedicated task force.

There is a further, uncomfortable dimension. The tools used in these frauds are the same tools, or close cousins of the same tools, that legitimate businesses now use every day: voice cloning for customer service, video generation for marketing, AI agents that can hold a phone conversation. The line between a helpful AI voice assistant and a fraudulent AI voice is not a technical line. It is a line drawn by intent, and intent is invisible on a phone call.

Analysis: Why It Matters

The indictment matters not only because of the money — though $129 million is a great deal of money — but because of what it reveals about where fraud is heading, and about how unprepared most organisations still are for it. Five points stand out.

1. The verification call no longer verifies anything

For decades, the standard advice against impersonation fraud has been simple: if you get an unusual payment request, verify it through another channel. Call the person back. Get on a video call. Check with a colleague. That advice was sound when a phone call or a video call was hard to fake. It is now dangerously incomplete.

In the scheme alleged here, the conspirators anticipated the verification step and impersonated the verifiers. The employee who wanted to check with the lawyers was put through to the “lawyers”. The Arup employee who insisted on a video call got a video call — with people who did not exist. The lesson is not that verification is useless, but that verification must now be verification of the channel itself, not just of the person on it. A call back only helps if it goes to a number you already have, from a directory you trust, not a number supplied in the message you are checking. A video call only helps if the meeting was arranged through a system you control.

This is a profound shift, and it will take years for organisational habits to catch up. Most companies’ payment procedures were written in a world where a voice was a reliable identifier. They now operate in a world where a voice is a file that can be copied. The procedures have not changed; the world has. That gap is where the $129 million went.

2. Scale is the story, not just the sum

A single fraud of $129 million is dramatic, but the more important number in the indictment may be the thousands of companies targeted. This was not a bespoke con aimed at one rich victim. It was a campaign.

That matters because it changes who is at risk. A campaign that targets thousands of companies will eventually reach a hospital, a school, a charity, a small manufacturer — organisations without a chief information security officer, without a fraud team, without the budget for the defences that a bank or a multinational can afford. The six named victims include two hospital systems, and that is unlikely to be a coincidence: hospitals are large, complex, cash-moving organisations with many employees authorised to make payments, and they are exactly the kind of target a high-volume campaign will sweep up.

It also matters because scale changes the economics of crime. Voice cloning that once required a studio and a specialist can now be done with a few minutes of public audio — an earnings call, a conference speech, a television interview. A chief executive’s voice is, in most cases, already public. The barrier to entry for this kind of fraud has collapsed, and the indictment is evidence that organised criminals have noticed.

3. The laundering infrastructure is as significant as the fraud

Less attention is paid to the money laundering counts than to the deepfake impersonation, but they may be the more consequential part of the case. The indictment describes money wired to accounts in nine jurisdictions and then converted into cryptocurrency, and it quotes Hazan boasting of having laundered more than $400 million in three years and of being “number one all over the world” among professional money launderers.

If that boast is even approximately true, it suggests the defendants were not a self-contained gang but part of a larger service economy: people who specialise in moving stolen money, serving many different fraud operations. Prosecutors who dismantle one fraud ring leave the laundering network intact unless they follow the money all the way through. The seven counts against each defendant include three money laundering counts, and the involvement of authorities in Spain, the United Kingdom and the United States — plus the Justice Department’s Office of International Affairs — suggests this case was built as an international operation from the start. Whether it leads further up the chain is one of the most important questions to watch.

4. The government’s response is real, but it is also branding

The launch of the Super Intelligence Task Force on the same day as the indictment is good news and, at the same time, a reminder to keep expectations modest. The task force coordinates existing enforcement; it creates no new offence, and it has announced no caseload beyond this indictment. Its co-chairs are senior officials, its mandate is broad, and its real test will be what it does in the next year, not what it announced in its first week.

The “super intelligence” rebranding deserves similar caution. Renaming artificial intelligence does not change what the technology can do, and it does not change the law that governs its misuse. The executive order’s own text borrows the existing legal definition of AI. What the rename does change is the political framing: it presents AI as a national project, and AI crime as a national security matter, which may help justify resources and coordination. That is a legitimate purpose, but it is a communications purpose, not a legal one. The indictment itself proves the point — it was brought under wire fraud and money laundering statutes that predate the technology by decades.

None of this diminishes the case. It simply means the measure of the government’s response will be prosecutions and recoveries, not press releases and acronyms.

5. The victims will not get their money back — and that is the point

There is a hard truth at the end of almost every fraud case of this size: most of the money is gone. Cryptocurrency conversion, distribution among co-conspirators, accounts in nine countries — the architecture of the scheme was designed to make recovery difficult, and it probably succeeded. Some funds may be seized, some may be traced, but a full recovery of $129 million would be extraordinary.

That is why the indictment matters as a warning more than as a remedy. For any organisation that moves money on the basis of a voice on the phone, the question is no longer whether AI impersonation fraud is real — the Justice Department has now put a $129 million figure on it, with names, dates and a court filing. The question is what has changed in your own payment procedures since you last thought about it. The honest answer, for most organisations, is nothing. The indictment is an invitation to change that answer while it is still cheap to do so.

What to Watch Next

1. Extradition: All three defendants are awaiting extradition to the United States from Spain and the United Kingdom. Extradition proceedings can take months, and any challenge — on health, human rights or procedural grounds — will be closely watched. The first court appearances in New York will set the timetable for the trial.
2. Whether the money is recovered: Prosecutors will seek forfeiture of the proceeds, but the cryptocurrency conversion and the nine-country account network make recovery uncertain. Any seizures or restitution orders will indicate how much of the $129 million can actually be traced.
3. Whether more defendants are charged: The indictment refers repeatedly to unnamed co-conspirators. The laundering network described in the case may support further charges, and the task force’s first caseload will show whether this indictment was a one-off or the start of a campaign.
4. The Super Intelligence Task Force’s first year: The task force has announced no cases beyond this indictment and no new enforcement priorities in detail. Its first annual picture — how many cases, what kinds, what results — will be the real test of whether the new structure changes outcomes.
5. Corporate defences: Expect new guidance from regulators, insurers and auditors on payment verification — out-of-band confirmation, pre-agreed code words, and limits on single-employee authorisation of large wires. The Arup case produced such guidance in 2024; a $129 million case is likely to produce more, and more urgent, versions of it.

Sources

• U.S. Department of Justice, Southern District of New York — “Three Foreign Nationals Arrested And Charged With Scheme To Use Super Intelligence To Defraud Companies Of $129 Million” (press release, 5 November 2026)
• ABC News — “Trio used AI to impersonate corporate execs, defrauding companies of nearly $130 million: DOJ” (5 November 2026)
• Inc. — “FBI Warns Businesses After a $129 Million Fake-CEO Scheme. The Caller Wasn’t the Only Impostor” (6 November 2026)
• Nextgov — “Department of Justice forms AI task force” (5 November 2026)
• PYMNTS — “DOJ Launches Super Intelligence Task Force to Combat AI Fraud and Hacks” (5 November 2026)
• Guard.io — “AI Invoice Fraud: Business Email Compromise Explained” (FBI IC3 business email compromise figures and the Arup deepfake case)