DOJ charges three men over AI deepfake scheme that stole $129 million

Federal prosecutors charged three foreign nationals with using artificial intelligence to alter and impersonate the voices and images of corporate executives and attorneys in a scheme that stole more than $129 million from companies worldwide.

The Guardian disclosed the case on November 6, 2026, reporting that Soall and Hazan were arrested in Spain over the summer while Sheetrit was arrested in the United Kingdom in September.

What happened

Jacob Soall, Sharon Hazan and Guy Sheetrit were arrested for using AI to alter and impersonate the voices and images of executives and attorneys at various companies in order to convince employees to send over large payments.

The alleged fraud took place between 2024 and 2026.

After posing as an executive, the men would then instruct the employees to get in touch with lawyers at a large international law firm who were also part of the scheme.

Impact

The men ultimately stole more than $129m from companies all over the world including in the US, according to the DoJ.

The men allegedly stole nearly $5m from a hospital system headquartered in Missouri, about $2.7m from a Rhode Island bank and about $3m from a California hospital system.

The men also stole over $11m from a UK tech company.

Response

After the money had been wired, the men would covert the money into cryptocurrency.

The men have been charged with conspiracy to commit wire fraud, various counts of money-laundering conspiracy and aggravated identity theft.

The FBI said that as criminals continue to weaponize emerging technologies, the FBI remains committed to rapidly adapting our capabilities to identify, investigate, and disrupt those who seek to harm New Yorkers and businesses operating in our communities.

Lessons for security leaders

The scheme described in the case did not rely on a single spoofed call but layered an AI-cloned executive voice with a second, fabricated outside-counsel contact to push transactions through normal finance workflows. Security teams should treat any urgent wire instruction that arrives by voice or video alone as unverified until confirmed through a separate, pre-established channel, even when the caller references real deal details and introduces a seemingly credible referral. Finance and accounting staff who approve wire transfers are the most exposed population and benefit from documented callback procedures that do not rely on contact information supplied during the same call. Because the funds in this case were moved into cryptocurrency shortly after transfer, organizations should also build rapid-notification paths to their banks and to law enforcement so that transfers can be frozen before conversion.