US Charges Three in $129M Deepfake CEO and Lawyer Fraud Scheme

Federal prosecutors in the Southern District of New York have unsealed an indictment against three men accused of running a sprawling fraud operation that used artificial intelligence to impersonate corporate chief executives and international law firm attorneys, extracting roughly $129 million from hospitals, banks, investment funds and other businesses across the United States and Europe. The charges, announced on November 5, describe an 18-month campaign that turned a familiar email scam into something far more convincing — and far more lucrative.

• Scale of the alleged theft: Prosecutors attribute about $129 million in losses to the scheme, which targeted thousands of companies between July 2024 and February 2026.
• How it worked: The conspirators allegedly posed as CEOs in emails and AI-generated calls, then impersonated real lawyers at major international firms to reinforce the illusion of a confidential transaction.
• Who is charged: Jacob Soall, 41; Sharon Hazan, 54; and Guy Sheetrit, 42, face wire fraud, aggravated identity theft and money laundering counts. All three were arrested overseas and are awaiting extradition.

A multi-layered impersonation playbook

According to the indictment, the operation began with reconnaissance. The conspirators identified accounting and finance employees with the authority to approve large wire transfers, then sent messages through an electronic signature service such as DocuSign purporting to come from the company’s CEO. The messages described confidential corporate transactions — often acquisitions — and instructed employees to sign nondisclosure agreements.

What followed was the critical escalation. The conspirators arranged phone or video calls using AI to reproduce the CEO’s voice and, in some instances, their likeness. Once the employee accepted the executive’s identity, the supposed CEO directed them to an attorney at an international law firm who was said to be managing the deal. That attorney was another impersonation, generally built on the identity of a real lawyer working in the European office of a major firm.

Prosecutors say the fake attorney reinforced the need for secrecy and then instructed the employee to wire funds into accounts controlled by the conspirators. Soall, who allegedly handled many of the attorney impersonations from the United Kingdom, kept a handwritten script titled “Lawyer Call” that included lines designed to discourage employees from discussing the supposed transaction with colleagues, invoking regulatory terms and insider-trading risks as justification for silence.

Victims, losses and a stopped transfer

The indictment identifies six successful thefts that together account for roughly $32 million of the alleged total. A British fintech company lost about $11.58 million; a Florida pet food company lost $5.24 million; a Missouri hospital system lost $4.83 million; a Massachusetts mutual fund company lost $4.64 million; a California hospital system lost $2.97 million; and a Rhode Island bank lost $2.68 million.

One attempted theft illustrates how far the deception could travel before being interrupted. In October 2024, conspirators targeted a major New York investment bank, impersonating its CEO and an attorney to induce a transfer of approximately $2.85 million. The employee authorized the payment, but the bank’s back office stopped the transfer before the funds were released.

Stolen proceeds were routed through bank accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China before being converted into cryptocurrency to conceal their origin and ownership, prosecutors said. Hazan and Sheetrit allegedly handled the laundering. Hazan, who prosecutors say had already been convicted of conspiracy to commit bank fraud in the same court in 2008, reportedly boasted of laundering more than $400 million over the past three years.

“The alleged scheme orchestrated by Soall, Hazan, and Sheetrit demonstrates how the use of advanced technology can be exploited to commit large scale fraud,” said FBI Assistant Director in Charge James C. Barnacle, Jr.

Why this case matters beyond the courtroom

The defendants face seven counts, including conspiracy to commit wire fraud, wire fraud, aggravated identity theft and money laundering. Five of the counts carry maximum sentences of 20 years in prison, while the two identity theft charges carry two years each. All three are presumed innocent unless proven guilty. Sheetrit’s attorneys have said their client had no involvement in the scheme and that his cybersecurity experience did not establish criminal responsibility.

The case lands amid growing alarm over the use of synthetic media in financial crime. A 2024 warning from FinCEN flagged the rising use of AI-generated deepfakes in identity fraud, and Gartner research cited in coverage of the indictment found that 41% of CISOs reported at least one social engineering incident involving a deepfake during an employee audio call in the past 12 months, with 36% reporting the same for video calls.

Security experts note that the technical barrier has collapsed. Hany Farid, a computer science professor at Dartmouth College and chief scientific officer at GetReal Security, said that a few years ago mimicking a voice required hours of recording, while today less than a minute of audio and a single photograph can be enough to create a convincing avatar. He also warned that human ability to spot fakes is only slightly better than random guessing.

The broader lesson is that identity verification can no longer rest on recognizing a face or a voice. The investment bank that stopped a $2.85 million transfer did so through independent financial controls, not through the employee’s judgment about who was on the call. As synthetic media becomes cheaper and more convincing, organizations will need out-of-band verification, pre-agreed code words and strict payment approval processes — because the technology itself is not going away.