Three men charged in alleged $129 million deepfake CEO fraud scheme
Three men have been charged in connection with an alleged scheme that used artificial intelligence-generated impersonations of company executives and law firm attorneys to persuade employees to transfer more than $129 million, according to the U.S. Department of Justice. The alleged fraud ran from 2024 through 2026 and targeted organizations in several sectors.
The indictment identifies the defendants as Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42. Prosecutors allege that participants posed as executives on calls, using AI to imitate their voices or images. They then directed employees to contact lawyers at prominent international firms, whose identities were also allegedly impersonated to make purported financial transactions appear legitimate.
In the final stage of the approach, someone posing as a lawyer allegedly instructed an employee to wire a substantial payment to a specified bank account controlled by members of the group. The Justice Department says the transfers were tied to sham transactions. The indictment describes Soall as frequently taking the role of UK attorneys. He allegedly kept a handwritten script called “Lawyer Call,” including language intended to discourage victims from discussing the calls with colleagues.
Victims and alleged movement of funds
The organizations named in the indictment include two U.S. hospital systems, a Rhode Island bank, a UK financial technology company and a Florida pet food company. The two hospital systems, in Missouri and California, reportedly lost nearly $7.8 million combined. The Rhode Island bank transferred $2.7 million, while the UK fintech company suffered the largest single loss listed, at $11.6 million. The Florida company reportedly lost $5.2 million.
Funds were sent to accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China, according to the allegations. Prosecutors say the group converted received funds into cryptocurrency to obscure their origin and control, then divided the proceeds among conspirators. Hazan and Sheetrit allegedly took part in laundering the money.
The indictment says Hazan claimed to have been laundering money since 1994 and to have moved more than $400 million over the preceding three years. Those statements are allegations described in the case, not independent findings. Hazan was previously convicted of conspiracy to commit bank fraud in the Southern District of New York in 2008, according to the Justice Department.
Charges and enterprise implications
Each defendant faces seven counts, including conspiracy to commit wire fraud, wire fraud, aggravated identity theft and money laundering. Five counts carry maximum prison sentences of 20 years, while the two aggravated identity theft counts carry two years each. These are statutory maximums; the charges are allegations, and the defendants are presumed innocent unless proven guilty.
The case illustrates how impersonation fraud can combine synthetic audio or video with familiar business processes. The alleged use of a purported CEO, followed by supposed outside counsel and a time-sensitive payment request, sought to make the transaction appear to have multiple independent points of validation. For organizations, the scenario underscores the importance of verifying unusual payment instructions through a separate, established channel rather than relying on the caller’s identity or the apparent presence of senior staff on a call.
Controls that require independent approval for large or unusual transfers, confirmation using trusted contact details, and a clear escalation path for employees can help reduce reliance on a single conversation. Organizations can also prepare staff to treat requests for secrecy or pressure to bypass normal procedures as reasons to pause and verify. These measures are relevant to impersonation attempts whether or not a deepfake is involved.
The Justice Department cited Gartner findings that 41% of CISOs surveyed reported at least one social engineering incident involving a deepfake during an employee audio call in the prior 12 months; 36% reported one involving a video call. The source of those figures did not specify in the supplied material the survey’s sample size or other methodology, so they should be read in that context.
FBI Assistant Director in Charge James C. Barnacle, Jr. said the alleged scheme showed how advanced technology could be used to commit large-scale fraud. U.S. Attorney Jamie McDonald also cautioned that criminals may use emerging technology for illicit purposes and urged businesses and individuals to consider protective measures. The investigation’s central lesson for finance and security teams is to validate the transaction itself—not just the identity presented during a call.
