Three men accused of stealing $129 million by using AI to impersonate CEOs

It usually starts with an email to the accounting department, sent in the CEO's name: they need help with a confidential financial transaction. A call follows: on the line is the CEO's voice, sometimes their image. The employee is then put in touch with a lawyer from a major international law firm, supposedly handling the matter. Then comes the request for a wire transfer. According to federal prosecutors in Manhattan, neither the executive nor the lawyer was real: their voices and images were imitated using artificial intelligence.

According to NBC News and The Record, which reported on it on November 6, the U.S. Attorney's Office for the Southern District of New York is prosecuting three men for this scheme. According to NBC News, it allegedly brought in more than $129 million between July 2024 and February 2026. According to The Record, Jacob Soall, 41, is a Spanish national, while Sharon Hazan, 54, and Guy Sheetrit, 42, are Israeli. All three are presumed innocent.

A fake CEO, then a fake lawyer

The scenario follows the "CEO fraud" (fraude au président) well known to French companies, adding a second character. After the fake executive, a fake lawyer reassures the target and gives the instructions. According to NBC News, Jacob Soall played this role and relied on a script titled "Lawyer Call." Prosecutors believe the defendants and their accomplices thus impersonated executives at numerous companies and lawyers at major law firms.

The defendants used AI to "pose as real people and deceive corporate executives," says U.S. Attorney Jamie McDonald, quoted by The Record. A sign of the times, his press release does not mention AI but "SI," for superintelligence, the term the White House now prefers, NBC News notes.

Hospitals, banks and a pet food maker

The victims named make for a mixed list. According to The Record, a Missouri hospital system allegedly lost nearly $5 million, another in California $2.9 million, a Rhode Island bank $2.6 million, a Massachusetts financial firm $4.6 million and a Florida pet food manufacturer $5.2 million. The largest reported loss hit a British technology company: $11.5 million. A New York investment bank was also targeted in October 2024, but according to the indictment, its back office blocked the transfer of about $2.85 million before it left.

The money went to accounts in the United States, Europe, the United Arab Emirates and China, before being converted into cryptocurrencies to hide its origin. Sharon Hazan, previously convicted in 2008 of conspiracy to commit bank fraud, was allegedly in charge of the laundering. According to the prosecution, he boasted of having laundered more than $400 million over the past three years. According to NBC News, Jacob Soall was arrested in Spain in June, Sharon Hazan in Spain in August and Guy Sheetrit in the United Kingdom in September. Extradition requests are under way. They face up to 104 years in prison: a maximum of 20 years for each of the seven counts, except the two counts of aggravated identity theft, which carry two years.

How not to be the next victim

The fraud described relies on no technical vulnerability, only on employees' trust. ANSSI (France's national cybersecurity agency) had already observed that most data thefts need no technical flaw at all. The defenses are therefore primarily a matter of procedure:

• no unusual transfer without calling the requester back on an already known number, never the one given during the exchange;
• dual approval by two people above a certain amount, with no exception for transactions described as "confidential";
• verify a lawyer's identity by calling their firm's switchboard;
• agree on control questions that only the real executive can answer;
• remind accounting teams that a voice or a video no longer proves someone's identity.

The FBI is urging companies that believe they were targeted to come forward. The list of victims could therefore grow before the trial.