A federal indictment unsealed by the U.S. Attorney’s Office for the Southern District of New York charges three foreign nationals with stealing approximately $129 million from companies worldwide using AI-generated impersonation. Prosecutors allege the scheme ran from approximately July 2024 through February 2026 and targeted thousands of companies, including health systems, financial institutions, and investment firms.
How the Attack Chain Worked
Prosecutors allege the fraud moved in sequence, beginning with an AI-generated executive voice and ending with a wire transfer directed by an impersonated attorney.
According to the indictment, the fraud began with a communication posing as a company’s chief executive, often framing the request as a confidential financial transaction. Prosecutors allege the defendants used AI to replicate that executive’s voice and, in some instances, their image.
The purported CEO then directed an employee to contact an attorney at a major law firm for confirmation. Prosecutors allege that members of the group impersonated those attorneys and instructed employees to wire large sums to accounts controlled by the conspiracy.
After funds were transferred, the conspirators allegedly converted them into cryptocurrency to conceal the money’s source and ownership.
The Defendants and Their Alleged Roles
Three foreign nationals face charges that prosecutors say reflect distinct roles within the scheme, from impersonation to laundering.
Jacob Soall, 41, allegedly acted primarily as an impersonated attorney from the United Kingdom. Prosecutors say he maintained a handwritten script titled “Lawyer Call” to make himself appear to be a genuine attorney during calls with victims.
Sharon Hazan, 54, and Guy Sheetrit, 42, face charges that include involvement in laundering the proceeds. Prosecutors note that Hazan had previously been convicted in the Southern District of New York of conspiracy to commit bank fraud. The indictment identifies aliases associated with the defendants, including “Rocky Balboa,” “Superman Cash,” and “Fat Boy.”
Soall was arrested in Spain in June 2026, Hazan in Spain in August 2026, and Sheetrit in the United Kingdom in September 2026, according to prosecutors. Extradition requests for all three defendants were pending at the time the charges were announced.
Who Was Hit and for How Much
The indictment names specific victims across multiple industries, with individual losses reaching into the millions.
Prosecutors describe specific alleged losses: a Missouri hospital system lost approximately $4.83 million, a Rhode Island bank lost approximately $2.68 million, and a California hospital system lost approximately $2.97 million. A U.K. financial-technology company allegedly lost approximately $11.58 million, a Massachusetts mutual-fund company lost approximately $4.64 million, and a Florida pet-food company lost approximately $5.24 million.
Prosecutors allege the conspiracy moved wire transfers directed through bank accounts spanning the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia, and China.
Charges and Legal Standing
The U.S. Attorney’s Office for the Southern District of New York has filed charges carrying potential sentences of up to 20 years on most counts.
The defendants face charges including conspiracy to commit wire fraud, aggravated identity theft, and money laundering. The wire-fraud conspiracy and money-laundering counts each carry maximum sentences of up to 20 years; aggravated identity theft carries a mandatory additional two-year term, though any sentence would depend on the counts of conviction and applicable sentencing rules.
The charges are allegations. All three defendants are presumed innocent unless and until proven guilty.
The Broader Warning for Businesses
The case illustrates how AI-assisted impersonation raises the stakes of a long-familiar fraud pattern.
This scheme did not create a new category of fraud; it made an existing one harder to detect. Prosecutors allege the defendants layered synthetic voice and image technology onto a conventional social-engineering method, exploiting workplace trust in senior executives and outside legal counsel to authorize transfers that might otherwise have drawn scrutiny.
The practical implication is direct: a realistic voice or face on a call is not sufficient proof of identity. Independent verification through a known contact and established payment controls remain the primary safeguards prosecutors allege this scheme was designed to bypass.
