Three charged over $129M AI scheme that faked CEOs and lawyers

According to the indictment filed in a US District Court in New York, the three targeted thousands of companies worldwide. Court records cited by CyberScoop put the period between July 2024 and February 2026.

The Justice Department says the group impersonated both chief executives and lawyers at major international law firms. Prosecutors say some of those firms were among the 50 largest in the world.

By the numbers:

• Losses: at least $129 million, per prosecutors.
• Targets: thousands of companies across the world.
• Duration: more than a year and a half.
• Charges: seven counts, with a combined maximum of 104 years in prison.

The charges are allegations. The defendants are presumed innocent until a court decides otherwise. The case docket was still sealed in online court records on Thursday evening, so no defense statements were available.

Prosecutors describe a repeatable script, aimed at accounting staff with enough authority to approve big wire transfers.

1. The email. Staff got a message, often via an e-signature service, from a supposed CEO. It said they were working on a "confidential financial transaction" and needed the employee to sign a non-disclosure agreement.
2. The CEO call. A phone or video call followed. The defendants allegedly used AI to copy the CEO's voice and sometimes the CEO's image.
3. The lawyer. The fake CEO told the employee to contact an attorney at a major law firm. That attorney was also played by the group.
4. The wire. The "attorney" told the employee to send large payments to bank accounts around the world.

In real life Imagine your boss emails a secret deal, then calls and sounds exactly like them. Next, a lawyer from a famous firm walks you through the paperwork. Every step feels normal, and that is the point.

Soall mainly played UK attorneys. Prosecutors say he kept a handwritten script titled "Lawyer Call" to sound like a real attorney.

Prosecutors named several victims. The list covers very different industries, which tells you the target was a job title, not a sector.

Why it matters: two hospital systems are on the list. Money that disappears from a hospital is money that is not going to patient care, even if the exact effect was not detailed.

A CEO asking for a payment is something an accountant may question. A CEO who says the deal is confidential and sends you to a lawyer changes the picture. The employee is no longer the one deciding. They are following a process, with an NDA signed and an attorney on the line.

That is why prosecutors stress the impersonated law firms. Posing as lawyers at some of the 50 largest firms in the world gave the calls borrowed authority. The group also picked employees who had enough authority to authorize large wires, so nobody had to be pressured for long.

For companies, the lesson is about process, not about spotting a bad voice. The indictment describes calls where the voice and sometimes the image of the real CEO were copied, so listening harder is not a control. A rule that every large wire needs a second approver, and a callback to a known number, works even when the fake is perfect.

Prosecutors say the wires went to accounts controlled by co-conspirators in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China.

The funds were then converted to cryptocurrency, in an attempt to hide where they came from, and shared among the trio and others involved. Splitting a payment across many countries makes it harder for a bank to freeze it in time.

The indictment gives each one a different role, according to prosecutors.

• Jacob Soall, 41: from Marbella, Spain. Arrested in Spain on June 17. Allegedly mainly impersonated UK attorneys.
• Sharon Hazan, 54: from Israel. Arrested in Spain on August 5. Prosecutors say he boasted of laundering money since 1994, including more than $400 million in the past three years. He was convicted in New York in 2008 of conspiracy to commit bank fraud.
• Guy Sheetrit, 42: from Israel and the United Arab Emirates. Arrested in the United Kingdom on September 7. Allegedly laundered funds from the scheme.

Court documents say the three used nicknames including "Rocky Balboa," "Superman Cash" and "Fat Boy."

FBI Assistant Director in Charge James C. Barnacle Jr. said the case shows how advanced technology can be used for large-scale fraud. "As criminals continue to weaponize emerging technologies, the FBI remains committed to rapidly adapting our capabilities to identify, investigate, and disrupt those who seek to harm New Yorkers and businesses operating in our communities," he said.

Jamie McDonald, the US attorney for the Southern District of New York, said: "Super intelligence technology offers tremendous potential, but the public should recognize that there are some who seek to use this emerging technology to pursue criminal goals."

The trick itself is old. The "CEO fraud" email has been around for years, and the FBI's Internet Crime Complaint Center tracks it as business email compromise. The FBI reported $2.77 billion in losses from 21,442 such incidents in 2024 alone.

What changes with AI is the proof. An email is easy to doubt. A familiar voice on the phone is harder to doubt.

The best-known earlier case is the engineering firm Arup. It confirmed to CNN in 2024 that a Hong Kong finance employee joined a video call with what looked like the chief financial officer and colleagues, all deepfakes. He sent about $25.6 million across 15 transactions.

The big picture: the Arup case was a single target. The new indictment describes a repeatable operation aimed at thousands, with a lawyer layer added to calm any doubts.

The three face charges of conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy and two counts of money laundering. Each count carries up to 20 years, except aggravated identity theft at two years.

The prosecutors' office did not immediately comment on trial dates or on whether more people will be charged. The indictment refers to co-conspirators, so further cases are possible, but nothing has been announced.

• Do not trust a voice alone: a familiar voice or face on a call is no longer proof of who is calling. Call back on a number you already have.
• Use two approvers: require a second person to sign off on any wire above a set amount, whoever asks.
• Be wary of secrecy: a "confidential deal" that cannot be discussed with colleagues is the oldest warning sign in the book.
• Check unknown lawyers: if a law firm contact appears mid-request, look the firm up yourself and call its main line.