Deepfake CEO Fraud: How the $129M Wire Scheme Worked

By Jaspal Singh November 8, 2026 Updated: November 8, 2026

Federal prosecutors in Manhattan say three men used AI-cloned voices and faces of real CEOs and law-firm partners to talk finance staff into wiring roughly $129 million to accounts they controlled. The scheme did not break any system. It broke the habit of trusting a familiar voice, and the fix is a payment process that never relies on one.

What Happened

On November 5, 2026, the U.S. Attorney's Office for the Southern District of New York announced the unsealing of a seven-count indictment against Jacob Soall, 41, of Marbella, Spain, and the United Kingdom; Sharon Hazan, 54, of Israel; and Guy Sheetrit, 42, of Israel and the United Arab Emirates. According to the Justice Department's press release, Soall was arrested in Spain on June 17, 2026, Hazan in Spain on August 5, and Sheetrit in the United Kingdom on September 7. Extradition requests for all three are pending.

Prosecutors allege that between 2024 and 2026 the group impersonated the voices and, in some cases, the images of corporate executives and of attorneys at major law firms. The release lists six completed thefts: $4,829,580 from a Missouri hospital system, $2,684,580 from a Rhode Island bank, $2,968,497 from a California hospital system, $11,578,474 from a UK financial technology company, $4,639,918 from a Massachusetts mutual fund company and $5,242,747 from a Florida pet food company. The total across all victims is put at more than $129 million. None of the companies is named.

The release uses an unusual label for the tools involved: "super intelligence," abbreviated "SI." In practice the conduct it describes is what most people call deepfakes, meaning synthetic audio and video that copy a specific person. Gizmodo, which read the indictment, reported that it also describes an attempt to take about $2.85 million from a major New York investment bank in October 2024 that failed because the bank's back office stopped the wire.

Each defendant faces conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy and two counts of money laundering. The wire fraud and money laundering counts carry a maximum of 20 years each, and each identity theft count carries two years. The charges are allegations, and the three men are presumed innocent unless proven guilty.

Why It Matters

Most of the victims are not the kind of organisations that make headlines for weak security. Two are hospital systems, one is a bank and one is a fund manager. These are regulated businesses with audits, payment controls and compliance teams. The scheme still worked because it did not target their networks at all. It targeted one employee with authority to send money, and it gave that employee every reason to believe the request was genuine.

That is the shift worth understanding. For years, business email compromise (BEC) relied on a spoofed or hijacked email account and a sense of urgency. Training taught staff to "pick up the phone and check." This case shows what happens when the phone call is the attack. If the voice on the line sounds exactly like your CEO, a callback to the number the caller supplies proves nothing.

The amounts also matter. Individual losses ran from about $2.7 million to $11.6 million. These were not small invoices slipped through on a Friday afternoon. They were large, one-off transfers that a finance employee was persuaded to treat as legitimate, secret and urgent. Any company where one person can release a seven-figure wire after a phone call carries the same exposure.

Finally, the case shows that the money trail can still be followed. The release says funds went to accounts in the United States, Spain, Portugal, Greece, the UAE, Singapore, Austria, Slovakia and China before being converted to cryptocurrency, and arrests still followed in two countries. Speed of reporting is the variable victims control.

How It Works

The indictment, as summarised by prosecutors and reporters, describes a script with distinct stages. Each one is designed to remove a doubt the employee might have.

Stage 1: Pick the right person

The targets were employees, typically in accounting or treasury, who could approve or release large wires. Their names and the names of their executives are usually easy to find on company websites, LinkedIn and annual reports. Public interviews, earnings calls and conference talks supply hours of an executive's voice, which is all modern voice-cloning tools need.

Stage 2: Open with the boss

According to the DOJ, the conspirators began by posing as the victim company's chief executive and asking for help with a confidential financial transaction. Gizmodo reported that the indictment describes an opening email routed through an e-signature service such as DocuSign, carrying a nondisclosure agreement. Calls followed in which a cloned voice, and sometimes a synthetic face, played the CEO.

Stage 3: Hand off to a "lawyer"

The fake CEO then told the employee to contact lawyers at a large international law firm who were supposedly working on the deal. The group impersonated those lawyers too, often borrowing the identity of a real attorney. Prosecutors say Soall mainly played UK attorneys and kept a handwritten script titled "Lawyer Call." This hand-off is the clever part. A second, independent-seeming authority figure confirms the first one, and the employee feels they have verified the request.

Stage 4: Seal it with secrecy

The DOJ says the script included language meant to stop victims discussing the matter with colleagues. Framing the deal as an acquisition covered by confidentiality and insider-trading rules turns the normal safety net, asking a manager, into something that feels like a breach.

Stage 5: Move and convert the money

The "lawyer" supplied wire instructions for an account controlled by the group. Once the money landed, it was moved and converted into cryptocurrency to hide its source and then split up. Prosecutors say Hazan and Sheetrit handled laundering, and that Hazan boasted of laundering more than $400 million in the previous three years.

Why the old advice failed

The FBI's Internet Crime Complaint Center warned about an early version of this in a 2022 public service announcement on BEC through virtual meeting platforms. Back then criminals showed a still photo of a CEO with no audio or "deep fake" audio and claimed their camera was broken. The same notice recommended verifying requests through secondary channels. That advice still holds, but the channel has to be one the attacker cannot control. A practical control set looks like this:

Call back on a number you already hold. Use the internal directory or a number on file, never one in the email, the invite or the call.
Require two people for large or unusual wires. Dual approval makes "keep this between us" impossible by design.
Verify new beneficiaries separately. A first-time account abroad for a large sum should trigger a hold, whoever asked.
Agree a challenge phrase for executives. A rotating code word or a question only insiders know is cheap to set up.
Make secrecy a red flag. Staff should know that any request to bypass normal approvals is, by policy, a reason to escalate.
Report fast. The IC3 notice says victims should contact their bank immediately to request a recall and file a complaint at ic3.gov.

What's Still Unknown

The victim companies are unnamed, so it is not clear what controls each had in place or how many approvals each wire passed through. The release does not say which AI tools the group used, whether they ran live voice conversion or pre-generated clips, or how convincing the video portions were. It also leaves open how much of the $129 million has been recovered, how many other people were involved (the release repeatedly refers to "co-conspirators"), and whether some victims have yet to come forward. Extradition from Spain and the UK can take months, so a trial date is some way off. Finally, the release's use of "super intelligence" for what is effectively deepfake technology is unusual, and it is not yet clear whether prosecutors intend the term to carry any legal weight.

Frequently Asked Questions

What is a deepfake CEO scam?

It is a form of business email compromise in which criminals use AI to copy a real executive's voice, and sometimes face, then call or video-chat an employee to request an urgent payment. Because the voice sounds familiar, the employee treats the request as genuine. In the Manhattan case, prosecutors say fake lawyers then confirmed the story and supplied wire instructions for accounts the group controlled.

How much money was stolen in this case?

Prosecutors say the scheme stole more than $129 million from companies around the world. Six named examples total about $31.9 million, including $11.58 million from a UK fintech company and $5.24 million from a Florida pet food company. The rest of the losses, and how much has been recovered, have not been broken down publicly.

Who has been charged and where?

Jacob Soall, Sharon Hazan and Guy Sheetrit were charged in an indictment unsealed in the Southern District of New York on November 5, 2026. Soall and Hazan were arrested in Spain and Sheetrit in the United Kingdom. The United States has asked for all three to be extradited, and each is presumed innocent.

Why did employees believe the fake CEO?

The scheme layered several kinds of proof. An email or e-signature request came first, then a call in the CEO's cloned voice, then a second call with a supposed lawyer from a real law firm. Confidentiality and insider-trading warnings discouraged the employee from checking with colleagues, so each step seemed to confirm the one before it.

Can voice cloning really fool someone who knows the executive?

Yes, especially on a phone line or a short video call where audio quality is already compressed. Modern tools need only a few minutes of clean speech, and executives often have hours of public recordings online. Listeners also fill gaps with expectation. If the context fits and the request is urgent, small oddities in tone are easy to overlook.

What is the best single defence for a company?

Remove the ability for one person to send a large wire on the strength of a conversation. Require a second approver and an out-of-band callback to a number already on file for any new beneficiary or unusual amount. That way, even a perfect deepfake still has to beat a process, not just a person.

What should a business do if it has already sent the money?

Contact your bank immediately and ask it to recall the wire, because speed matters before funds move again. Then file a complaint with the FBI's Internet Crime Complaint Center at ic3.gov, preserve every email, invite and call log, and notify your insurer. The FBI also takes tips about this specific case through its online tips page.