Cloned CEO voices, fake law-firm partners, $129 million: what the SDNY deepfake fraud case teaches finance teams

US federal prosecutors in Manhattan have charged three men over what they describe as a 2024–2026 scheme that used AI-cloned voices, and sometimes faces, of real CEOs and law-firm attorneys to talk company employees into wiring money; the US Attorney puts the take at about $129 million. The playbook is classic business email compromise — a "confidential deal", a fake lawyer, an urgent wire — with synthetic voice and video added to get past the one check many finance teams still rely on: hearing the boss. The lesson for defenders is that a call or video meeting no longer confirms identity, so payment controls have to verify through channels the requester does not control.

The short version

Most companies have been warned about "CEO fraud" for a decade: an email that looks like it comes from the chief executive asks someone in accounting to quietly pay for a secret acquisition. The usual advice was "if in doubt, call them". According to the US Attorney's Office for the Southern District of New York (SDNY), this crew planned for that advice. After the email, the employee got a phone or video call in which AI mimicked the CEO's voice "and/or image". The employee was then passed to a supposed attorney at a large international law firm, who was also fake, and who gave the wiring instructions. One defendant allegedly kept a handwritten script called "Lawyer Call" that included lines meant to stop employees talking to colleagues.

The money went to bank accounts in nine countries, was converted to cryptocurrency, and was shared out. The six example victims that prosecutors list include two hospital systems and a bank, and together lost about $31.9 million. The rest of the alleged $129 million comes from victims who are not named. All three men were arrested in Europe between June and September 2026 and are fighting or awaiting extradition. These are allegations, and the defendants are presumed innocent.

Timeline

• 2024 — the alleged scheme begins, per SDNY ("between 2024 and 2026"). The Associated Press, via CBS News, describes it as running "more than a year and a half".
• December 3, 2024 — the FBI's IC3 warns that criminals use generative AI for "real time video chats with alleged company executives" and voice cloning to get payments (PSA I-120324-PSA).
• June 17, 2026 — Jacob Soall arrested in Spain.
• August 5, 2026 — Sharon Hazan arrested in Spain.
• September 7, 2026 — Guy Sheetrit arrested in the United Kingdom.
• November 5, 2026 — SDNY announces the indictment (press release 26-317, updated November 6).
• November 6, 2026 — Sheetrit's lawyers deny any involvement, per CyberScoop.
• November 9, 2026 — the SDNY release still lists extradition requests for all three as pending.

What we know

The charges. According to the SDNY press release, each of the three men faces seven counts: conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy and two counts of money laundering. The fraud and laundering counts carry up to 20 years each and each identity-theft count two years. The case is handled by SDNY's Complex Frauds and Cybercrime Unit. The FBI New York Field Office investigated, with Spain's Policía Nacional and the UK National Crime Agency making the arrests. Extradition requests for all three are pending.

The defendants, per SDNY. Jacob Soall, 41, of Marbella, Spain, and the United Kingdom, allegedly impersonated UK attorneys. Sharon Hazan, 54, of Israel, allegedly laundered proceeds; SDNY notes a 2008 conviction in the same district for conspiracy to commit bank fraud. Guy Sheetrit, 42, of Israel and the United Arab Emirates, also allegedly laundered funds.

How the scheme worked, as alleged. SDNY says the conspirators posed as CEOs and told employees that a confidential financial transaction needed their help. They "would use SI to mimic the CEO's voice and/or image in calls with the employee", then sent the employee to lawyers at large international law firms, who were impersonated too. A fake lawyer then told the employee to wire a large sum to an account the group controlled. SDNY says Soall "kept a handwritten script titled 'Lawyer Call'", with "language designed to convince victim employees not to discuss their communications with fellow employees."

(SDNY's release uses "SI", for super intelligence, where most people would say AI. US agencies now use that term in official documents. It does not mean anything more advanced than off-the-shelf voice and face synthesis is alleged here.)

The victims. SDNY lists six examples and says the list is not complete:

• a hospital system in Missouri — $4,829,580
• a bank in Rhode Island — $2,684,580
• a hospital system in California — $2,968,497
• a UK financial technology company — $11,578,474
• a Massachusetts mutual fund company — $4,639,918
• a Florida pet food company — $5,242,747

The AP report carried by CBS News says the group targeted "thousands of companies across the world". The SDNY text we read does not give that figure. AP also reports that the first emails usually went to accounting departments.

The money. SDNY says payments went to accounts in the US, Spain, Portugal, Greece, the UAE, Singapore, Austria, Slovakia and China, and were converted to cryptocurrency "to conceal" their source and ownership. SDNY says Hazan "boasted that he had been laundering money since 1994; that he had laundered over $400 million" in the past three years.

Officials. US Attorney Jamie McDonald: "SI technology offers tremendous potential. But the public should recognize that there are some who seek to use this emerging technology to pursue criminal goals." He urged businesses to protect themselves "from the emerging threat of SI-enabled crime." FBI Assistant Director in Charge James C. Barnacle, Jr. said the FBI is adapting "as criminals continue to weaponize emerging technologies".

The defence. CyberScoop updated its story on November 6 with a statement from Sheetrit's attorneys, Sharon Nahari and Shay Shorer, saying he "has no connection to this matter and has had no involvement in it whatsoever" and "maintains his complete innocence." CBS/AP reported that lawyers for Soall and Sheetrit had not immediately responded and that it was unclear whether Hazan had an attorney.

Technical analysis

Our assessment: nothing in this case is technically new. That is what makes it important. It shows deepfake-assisted payment fraud working as a routine, scaled, scripted criminal operation against ordinary mid-sized organisations — hospitals, a regional bank, a pet food company — rather than as a one-off headline.

The attack chain is BEC with an added layer for each check it has to pass. Business email compromise has always been a social-engineering chain, not a technical exploit. Each step answers a control the victim might use:

1. Pretext email "from the CEO" → answers "is this request coming from authority?"
2. Voice or video call with the "CEO" → answers "I'll call to confirm," the check that awareness training has taught for years.
3. Hand-off to an outside "attorney" at a well-known firm → answers "why is this unusual, and why can't I tell anyone?" Mergers, acquisitions and legal holds are real reasons for secrecy, and a lawyer's voice makes the secrecy feel official.
4. Script that discourages talking to colleagues → stops the second pair of eyes, which is the control most likely to catch the fraud.
5. Wires to many countries, then crypto → beats the recall window. Most banks can only claw back a wire in the first hours or days.

The AI angle sits mainly in step 2. CyberScoop says the indictment also describes an opening email from an e-signature company asking the employee to sign a non-disclosure agreement before contacting the "attorney". We could not read the indictment PDF ourselves (it is an image scan with no text layer), so that detail rests on CyberScoop's reading. If accurate, it shows the same design idea: borrow the look of trusted business tools to make secrecy seem like procedure.

Why the controls failed. Three weak points line up here.

• Out-of-band verification that isn't out of band. "Call to confirm" only works if the employee dials a number they already know. If the confirming call or video link comes from the requester, or the "CEO" calls first, the attacker owns the channel. The FBI's 2024 PSA said this plainly: verify "by hanging up the phone" and calling back on a number you found yourself. Voice cloning makes the difference between those two kinds of call decisive.
• Authority plus secrecy beats process. Payment controls often have an informal exception for "the CEO said so, and it's confidential". Each layer of this scheme exists to trigger that exception.
• Single-person release. SDNY's account turns on individual employees being persuaded to send the money. Where one person can both receive the instruction and release a seven-figure wire, a convincing voice is enough.

What is new about the AI part. Earlier voice-impersonation fraud needed a skilled impersonator or relied on bad phone lines. Synthetic voice and face tools remove that limit. With public interview clips of a CEO and a partner from a large law firm, one operator can play both people in turn, consistently, with many victims at once. The "Lawyer Call" script points to industrialisation: a repeatable playbook that can be handed to whoever is making calls. Prosecutors also describe a separate laundering role, which is typical of organised fraud and explains how the money moved through nine jurisdictions.

Our assessment: detection-first defences — training staff to spot lag, odd lip movement or a flat voice, as the 2024 PSA suggested — will help less and less over time. They are worth keeping, but a control that depends on a human noticing a flaw in a synthetic voice is a control that has an expiry date. Durable defences do not care how real the caller sounds.

What remains unclear

• The total. SDNY's own release says both "more than $100 million" (in its opening) and "approximately $129 million" (in McDonald's quote and the headline). The six named victims account for about $31.9 million. How the remaining total breaks down is not public.
• "Thousands of companies." This figure comes from AP's report. We did not find it in the SDNY release, and it is not clear whether it counts attempts or successful frauds.
• Which AI tools. No source names the voice or face synthesis tools, or says whether live real-time video or pre-recorded clips were used. SDNY's wording ("voice and/or image") suggests many calls were voice-only.
• Nationalities. SDNY calls all three "foreign nationals" and gives residences. Outlets differ: The Record calls Soall Spanish; IT Pro calls him a UK citizen. We use SDNY's residence wording.
• Recovery. Nothing public says how much money was frozen or recovered, or whether any victims got funds back through bank recalls.
• Co-conspirators. SDNY and The Record refer to unnamed co-conspirators. How large the group was, and whether the scheme continued after the arrests, is unknown.
• The indictment itself. The attached PDF is an image scan; we have relied on the press release and on outlets that read the filing. Details such as the e-signature/NDA step should be treated as reported, not confirmed by us.
• Sheetrit's denial. His lawyers say he had no involvement. The allegations will be tested in court, if extradition succeeds.

Lessons and what to do

For finance and treasury teams (and the security teams that support them):

• Make verification independent of the request. Any new payee, changed bank details or "confidential" transfer over a set threshold is confirmed by calling back on a number from your own records — never a number, meeting link or contact supplied in the request. A video call the requester set up is not verification.
• Require two people to release large wires, with the second approver checking the request independently. This is the control the "don't tell your colleagues" script is built to defeat; write a rule that secrecy requests raise scrutiny instead of bypassing it.
• Verify outside lawyers through the firm, not the person. If a "partner at a major firm" gives payment instructions, call the firm's main switchboard from its public website and confirm with your own general counsel's office. Real deals have legal teams on both sides who know each other.
• Pre-agree a challenge for executives. The FBI's suggestion of a shared code word is aimed at families, but the idea scales: a phrase or callback routine executives and finance staff agree in person and never put in email.
• Know your bank's recall path. Have your bank's fraud-recall contact ready and practise the first hour after a suspect wire. Speed matters most once funds are heading to multiple countries and into crypto.

For security and awareness programmes:

• Update training from "spot the fake" to "follow the procedure even when it sounds real". Show staff that a familiar voice or face is no longer proof.
• Reduce easy source material where reasonable: long, clean recordings of executives' voices are useful to attackers. This is a trade-off with communications needs, not a fix.
• Monitor for lookalike domains of your own company and of the law firms you use, and for impersonations of e-signature notifications.

For AI builders: voice and face synthesis services should assume this use case. Consent checks for cloning a named person's voice, watermarking or provenance signals, and abuse reporting channels that law enforcement can use all help to raise the cost — though none stop determined operators using open tools.

For leadership: treat this as a payments-governance issue, not an IT issue. Ask finance: "If someone who sounds exactly like me calls tomorrow and asks for an urgent, confidential $5 million wire, what stops it?" If the answer depends on the employee noticing the voice is fake, the control needs to change.

Sources

• US Attorney's Office, Southern District of New York — Three Foreign Nationals Arrested And Charged In Scheme To Use Super Intelligence To Defraud Companies (press release 26-317, November 5, 2026; updated November 6). Indictment attachment: s3 – all defendants (PDF, image scan).
• FBI / IC3 — Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (I-120324-PSA, December 3, 2024).

Coverage:

• CyberScoop (Matt Kapko) — Authorities accuse trio of using AI deepfakes to defraud $129M from businesses (November 6, 2026; updated with Sheetrit's lawyers' statement).
• The Record (Jonathan Greig) — CEO-spoofing scammers used AI to help steal more than $100 million, feds say (November 6, 2026).
• CBS News / AP — 3 allegedly used AI to steal some $129 million from companies by impersonating executives and lawyers (November 6, 2026).
• IT Pro (Emma Woollacott) — Three charged after impersonating CEOs and attorneys in $129 million deepfake fraud scheme (November 6, 2026).
• Ynetnews (Daniel Edelson) — Fake CEOs, stolen millions: two Israelis charged in $129 million AI fraud scheme (November 6, 2026).
• Related on AI Cyber Brief — FBI and CISA: AI-written phishing and deepfakes target US election officials before the midterms (October 19, 2026); Microsoft takes down EvilTokens, the phishing service that used AI to mine stolen inboxes (September 29, 2026).