- Prosecutors allege a ring used AI to imitate chief executives and attorneys at major law firms from 2024 to 2026, inducing employees to wire more than $129 million.
- Victims named in the charges include hospital systems, a bank, a mutual fund company, a fintech, and a pet food company, with single losses up to $11.6 million.
- The script asked for an urgent, confidential deal and told employees not to discuss it with colleagues. The secrecy, not the voice, was the warning sign.
- Treat any payment instruction that arrives by phone or video as unverified until it is confirmed through a channel the caller does not control.
What prosecutors allege
On November 5, 2026, the U.S. Attorney’s Office for the Southern District of New York and the FBI’s New York Field Office announced the unsealing of an indictment against three foreign nationals: Jacob Soall, 41, of Marbella, Spain, and the United Kingdom; Sharon Hazan, 54, of Israel; and Guy Sheetrit, 42, of Israel and the United Arab Emirates. Prosecutors allege that between 2024 and 2026 the men used what they call super intelligence (“SI”), AI that imitates a person’s voice or image, to impersonate chief executives at numerous companies and attorneys at major law firms.
According to the indictment, the scheme followed a script:
- The “CEO” calls. The conspirators targeted an employee and, posing as the company’s chief executive with an AI copy of the CEO’s voice or image, asked for help with a confidential financial transaction.
- The “lawyers” take over. The fake CEO told the employee to contact lawyers at large international law firms said to be working on the deal. The conspirators impersonated those lawyers too.
- The wire. One of the fake lawyers directed the employee to wire a large sum to a bank account the conspiracy controlled.
Prosecutors say Soall acted mainly as the impersonated attorney and kept a handwritten script titled “Lawyer Call,” which included language meant to keep employees from discussing the calls with colleagues. The money went to accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia, and China, and was converted into cryptocurrency. Hazan, who prosecutors say laundered funds for the scheme, had a 2008 conviction in the same district for conspiracy to commit bank fraud.
Who lost money
The indictment puts total losses at more than $129 million, from victims in the United States and abroad. The examples it names show that no sector is exempt:
| Victim named in the charges (by type and headquarters) | Loss |
|---|---|
| Financial technology company, United Kingdom | $11,578,474 |
| Pet food company, Florida | $5,242,747 |
| Hospital system, Missouri | $4,829,580 |
| Mutual fund company, Massachusetts | $4,639,918 |
| Hospital system, California | $2,968,497 |
| Bank, Rhode Island | $2,684,580 |
The defendants face seven counts: conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy, and two counts of money laundering. Soall and Hazan were arrested in Spain in June and August 2026, and Sheetrit in the United Kingdom in September; extradition requests are pending. The charges are accusations, and the defendants are presumed innocent unless and until proven guilty.
Why it worked
Nothing in the scheme, as charged, required breaking into a computer system. The calls asked employees to do something that happens in every company: help with an urgent, confidential transaction that the chief executive had approved, guided by the company’s outside lawyers. The only evidence of that approval was a voice on the line, and in some cases a face on a video call.
- The voice was the credential. A copied voice removes the hesitation an unfamiliar caller would cause, and voice-copying tools are now cheap and widely available.
- The lawyers made it routine. A second set of trusted callers, from well-known law firms, explained both the urgency and the secrecy.
- The phone sits outside the controls. Email security never sees a phone call, and caller ID can be spoofed. The FBI reports that impersonators routinely spoof the authentic numbers of the organizations they imitate.
Secrecy was the tell. The “Lawyer Call” script, as prosecutors describe it, worked to keep employees from talking to colleagues. A rule that any confidential payment request must be confirmed by someone the caller never spoke to defeats the script, however real the voice sounds.
What finance and security teams should change
The lesson for leadership is not to detect a fake voice. It is to stop treating any voice, number, or face as proof of authority to move money:
- Verify through a channel the caller does not control. Call back on a number already on file, never on one the caller gives, and confirm the request in a system of record.
- Make urgency and secrecy a trigger, not a reason. Requests marked confidential, time-critical, or “do not discuss with anyone” should require a second approver by policy.
- Agree a verification step with outside counsel. In this case the lawyers were impersonated as well as the executives; settle in advance how a payment instruction from counsel is confirmed.
- Watch your own numbers. If your executives’ or main numbers appear in calls you did not make, the people most likely to be targeted should hear about it first.
The same playbook runs through helpdesk vishing and callback phishing: the phone call carries the deception, and the damage appears later in systems that never saw the call.
Questions to answer now
Finance and security leaders should be able to answer the following with confidence:
| # | Question for your leadership team | When |
|---|---|---|
| 1 | Could one person on our team wire a large amount on the strength of a phone or video call? | Now |
| 2 | Does every urgent or confidential payment request require a call back to a number already on file? | Now |
| 3 | Have we agreed with outside counsel how their payment instructions are confirmed? | This quarter |
| 4 | Would we know if our executives’ or main numbers were being spoofed in calls to employees or partners? | This quarter |
Answering the last question takes visibility into the phone channel. The VoiceAlerts team can show you how your numbers and brand are used across the U.S. voice network in a free voice-channel threat briefing.
Key dates
| Date | Milestone |
|---|---|
| 2024 to 2026 | Period of the alleged scheme. |
| Jun 17, 2026 | Jacob Soall arrested in Spain. |
| Aug 5, 2026 | Sharon Hazan arrested in Spain. |
| Sep 7, 2026 | Guy Sheetrit arrested in the United Kingdom. |
| Nov 5, 2026 | Indictment unsealed in the Southern District of New York; extradition requests pending. |
How VoiceAlerts helps
VoiceAlerts monitors how your company's numbers and brand are used across the U.S. voice network, so your finance and security teams learn when your executives' or your main numbers appear in calls you did not make.
- Spoofing of your executives' and main numbers
- Call patterns that signal an impersonation campaign
- Verification steps your payment teams can adopt now
Common questions
What are the defendants in the $129 million AI impersonation case accused of?
Prosecutors in the Southern District of New York allege that from 2024 to 2026 the three men used AI to impersonate the voices and images of chief executives and attorneys at major law firms, directed employees to wire more than $129 million to accounts worldwide, and converted the proceeds to cryptocurrency. The seven counts are conspiracy to commit wire fraud, wire fraud, aggravated identity theft, money laundering conspiracy, and money laundering. They are accusations, and the defendants are presumed innocent unless proven guilty.
How can a company verify that a call from an executive is real?
Do not rely on the voice, the caller ID, or a video image. Confirm any payment or credential request through a separate channel the caller does not control, such as a call back to a number already on file, and require a second approver for urgent or confidential transfers.
Does caller ID prove that a call comes from the person it shows?
No. Caller ID can be spoofed, and the FBI reports that impersonators routinely spoof the authentic numbers of the organizations they imitate. A familiar number and a familiar voice can both be fake.
How can VoiceAlerts help against executive impersonation calls?
VoiceAlerts monitors how a company's numbers and brand are used across the U.S. voice network, so finance and security teams learn when their executives' or main numbers appear in calls the company did not make, and can warn the people most likely to be targeted.
Sources
- justice.govU.S. Attorney's Office, Southern District of New York: Three Foreign Nationals Arrested and Charged with Scheme to Use "Super Intelligence" to Defraud Companies of $129 MillionNovember 5, 2026
- ic3.govFBI Internet Crime Complaint Center: Scammers Impersonating Law Enforcement and Government Officials in Fraud Schemes (I-091726-PSA)Spoofing of authentic numbers; AI on video calls
This article is for general information and is not legal advice. Proposed rules can change before adoption; check the FCC record for the final text.
