US prosecutors charged Jacob Soall, Sharon Hazan and Guy Sheetrit in an indictment unsealed in federal court in Manhattan on 5 November 2026, Ynet News reported. Prosecutors allege the three used AI-generated voices and images to impersonate executives and lawyers, persuading company employees to transfer more than $129 million. The charges concern an alleged international scheme in which employees authorised payments after receiving instructions they believed came from their own chief executives.
Key points
- Prosecutors allege the defendants used synthetic voices and, in some cases, images to pose as chief executives before directing employees to impostor lawyers.
- The alleged victims include hospital systems, a bank, a financial technology company, a mutual fund company and a pet food manufacturer.
- Each defendant faces seven federal charges. All three have been arrested abroad, and US extradition requests remain pending.
The alleged CEO and lawyer calls
Soall, 41, Hazan, 54, and Sheetrit, 42, targeted thousands of companies over more than a year and a half, according to the indictment as reported by the Free Press Journal. The alleged approach began with an email that appeared to come from a chief executive seeking help with a confidential financial transaction. Prosecutors say the group then arranged a telephone or video call, using AI to imitate the executive’s voice and sometimes their image.
The employee would be told to speak to a lawyer at a major firm about the supposed transaction. Prosecutors allege that the lawyer was another member of the scheme, who instructed the employee to wire company money to an account controlled by the network. The approach put the instruction to transfer funds in the hands of someone with authority to make the payment, rather than requiring the defendants to gain access to a company’s bank account.
Prosecutors say Soall, who used the nickname “Rocky Balboa”, chiefly posed as a British lawyer. Investigators found a handwritten script called “Lawyer Call” that, according to the allegations, gave him responses intended to keep an employee from consulting colleagues. It supplied an explanation for why a proposed acquisition had to remain confidential and why other staff might not know about it. Those details mattered to the alleged deception: the employee was being asked to send a substantial payment while treating ordinary checks with colleagues as a risk to the supposed deal.
At a New York investment firm in October 2024, an employee authorised a $2.85 million transfer after receiving instructions about a supposed confidential transaction, Ynet News reported. The firm’s operations department stopped the payment. Prosecutors allege the message attributed to the chief executive and the lawyer the employee was directed to contact were both part of the impersonation.
Alleged losses in Missouri and Britain
The alleged victims span several industries. Prosecutors say a Missouri hospital system lost approximately $4.83 million, a Rhode Island bank lost $2.68 million and a California hospital system lost nearly $3 million. They also identify losses of $11.58 million at a British financial technology company, $4.64 million at a Massachusetts mutual fund company and $5.24 million at a Florida pet food manufacturer. The figures describe alleged payments by particular victims, rather than the number of companies the group is accused of approaching.
Prosecutors allege the money went to bank accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China. They say it was then converted into cryptocurrency to obscure its origins and distribute the proceeds among members of the network. Hazan, who allegedly used aliases including “Superman Cash” and “Fat Boy”, claimed to have laundered more than $400 million over the previous three years, according to the indictment. That was Hazan’s boast, not a sum established by the charges in this case.
Hazan was convicted of conspiracy to commit bank fraud in 2008. The Free Press Journal described the conviction as having been in a New York court; Ynet News described it as having been in federal court in New York.
Seven charges and extradition requests
Each defendant faces seven federal charges, including wire fraud, aggravated identity theft and money laundering offences. Most of the charges carry maximum prison sentences of 20 years, while aggravated identity theft carries a maximum of two years, according to the US attorney’s office as reported by the Free Press Journal. The charges are allegations, and the three defendants are presumed innocent unless proven guilty.
Soall was arrested in Spain in June, Hazan in Spain in August and Sheetrit in the United Kingdom in September. US authorities have requested the extradition of all three, and those requests remain pending. Investigators are trying to identify more victims and have asked businesses that believe they were targeted to reach the FBI.
