DOJ charges three in $129M AI deepfake CEO-fraud scheme
SDNY charged three men over a scheme that used AI deepfakes of CEOs and outside counsel to redirect corporate payments, defrauding seven companies of about $129 million.
The Justice Department has charged three men over a scheme that used AI to impersonate the voices and images of CEOs and lawyers, redirecting corporate payments and defrauding companies of about $129 million. The case was brought by the U.S. Attorney's Office for the Southern District of New York, with the FBI's New York field office. The details below are allegations in a charging document, not proven facts.
Who is charged
Per reporting at CyberScoop and Recorded Future News:
- Jacob Soall, 41, of Marbella, Spain — arrested in Spain on June 17.
- Sharon Hazan, 54, of Israel — arrested in Spain on August 5.
- Guy Sheetrit, 42, of Israel and the UAE — arrested in the UK on September 7. His attorneys say he "has no connection to this matter."
U.S. Attorney Jamie McDonald's office says the alleged targeting ran from July 2024 to February 2026. The seven counts — wire-fraud conspiracy, wire fraud, two counts of aggravated identity theft, money-laundering conspiracy and two money-laundering counts — carry a statutory maximum of 104 years.
How the scheme worked
Prosecutors describe a layered social-engineering play, not a technical intrusion. Deepfakes posing as a target company's CEO allegedly directed accounting staff to deal with an impersonated outside attorney, lending the request internal authority. The approach opened with an email from an e-signature service asking the victim to sign a non-disclosure agreement for a "confidential financial transaction" — a frame that discouraged the victim from checking with anyone else.
The losses
The companies are described by sector, not named:
- A UK-based fintech — nearly $11.6 million.
- A Florida pet-food company — $5.2 million.
- A Missouri hospital system — $4.8 million.
- A Massachusetts mutual-fund firm — $4.6 million.
- A California hospital system — nearly $3 million.
- A New York investment company — $2.8 million.
- A Rhode Island bank — nearly $2.7 million.
Action checklist
- Verify every payment-setup or account-change request out of band, on a number or channel you already hold — never one supplied in the request thread.
- Treat a familiar voice or face as worthless for authentication. Synthetic audio and video of named executives are now cheap; identity is the control, likeness is not.
- Flag the specific lure: an NDA-gated "confidential transaction," routed through impersonated outside counsel, that isolates one employee from normal approvals.
- Enforce dual control and a callback step on any wire-instruction change, regardless of who appears to be asking.
Context
The dollar figure is the story. Deepfake-enabled business-email compromise has moved from one-off six-figure losses to a nine-figure, multi-victim indictment, and the technique on display requires no malware — just a convincing executive and a process that trusts seeing and hearing over verifying.