DOJ Charges 3 in $129M AI Impersonation Scheme

Key takeaways

• Federal prosecutors announced on November 5, 2026, that three people were charged in an alleged AI-enabled impersonation scheme that diverted more than $129 million from companies.

• The indictment says the operation impersonated both company executives and outside attorneys, targeting employees who could authorize large payments.

• Finance teams should verify urgent transfer requests through a known, independent channel and keep payment approvals separate from the communication requesting the money.

Federal prosecutors in New York say three defendants used AI-generated voice and/or image impersonations of corporate executives and lawyers to persuade employees to send money to accounts controlled by an alleged fraud network. The indictment, unsealed on November 5, 2026, alleges losses of more than $129 million from companies in the United States and abroad.

The case is a practical warning for finance, accounts-payable, treasury and executive-support teams: a familiar voice or convincing video call is not proof that a payment request is genuine.

What happened in the $129 million AI fraud case?

The U.S. Attorney's Office for the Southern District of New York announced on November 5, 2026, that an indictment charged Jacob Soall, Sharon Hazan and Guy Sheetrit. Prosecutors allege that the defendants and their co-conspirators used what the release calls “super intelligence,” or SI, to impersonate executives at victim companies and attorneys at major law firms.

According to the Justice Department's press release listing, the announcement said the alleged scheme typically involved impersonating executives and attorneys to defraud companies. A person posing as a CEO would contact an employee and use AI to mimic the executive's voice and/or image during calls.

The impersonated executive would then direct the employee to contact lawyers supposedly handling the transaction. Prosecutors say the alleged perpetrators impersonated those lawyers too. A person posing as an attorney would ultimately instruct the employee to wire a large payment to a bank account controlled by members of the alleged conspiracy.

The indictment describes more than $129 million in losses. Named examples include $4,829,580 from a Missouri hospital system, $2,684,580 from a Rhode Island bank, $2,968,497 from a California hospital system, $4,639,918 from a Massachusetts mutual fund company and $5,242,747 from a Florida pet food company. A United Kingdom financial technology company was allegedly defrauded of $11,578,474.

The Justice Department says the alleged operation moved money through bank accounts in several countries and converted funds into cryptocurrency in an attempt to conceal their source, ownership and control. The indictment covers conduct between 2024 and 2026.

The defendants were arrested in Europe in 2026: Soall in Spain on June 17, Hazan in Spain on August 5, and Sheetrit in the United Kingdom on September 7. The Justice Department said extradition requests were pending when it announced the charges.

Independent reporting by the Associated Press and CyberScoop also described the alleged CEO-and-lawyer impersonation method. CyberScoop reported that attorneys for Sheetrit denied that he had any connection to the matter. The charges are allegations; all three defendants are presumed innocent unless and until proven guilty.

Why this matters to companies

Analysis: The striking part of the alleged scheme is not simply that AI can imitate a voice or image. It is that the impersonation was reportedly paired with a familiar business process: a confidential deal, a senior executive's request, a second professional authority figure and a wire transfer.

That sequence can exploit normal workplace habits. Employees are often expected to respond quickly to senior leaders, protect sensitive transactions and avoid discussing confidential matters widely. A convincing call can make an unusual request feel routine, especially when a second supposed authority confirms it.

The case also shows why organizations should not treat video or voice as a substitute for payment controls. A realistic voice, a live-looking image or a familiar caller ID can support a false identity. None independently confirms that the person is authorized to change payment instructions.

The practical risk reaches beyond large corporations. The indictment identifies losses at healthcare organizations, a regional bank, a mutual fund company and a pet-food business. Any organization that can send large payments may have a process that criminals try to manipulate.

Big Zero has also covered AI and security research in the story on an AI pipeline finding Linux kernel exploits. This case is a different side of the same operational challenge: businesses need controls for how AI is used by attackers, not only how they deploy AI themselves.

What finance and operations teams should do now

Organizations do not need to identify every AI tool used in an impersonation attempt to reduce the risk. They need payment procedures that remain effective when a request sounds and looks authentic.

• Verify through a known channel. If a payment request arrives by phone, video, email or messaging app, call the executive or attorney back using a number already held in the company directory. Do not use contact details supplied in the request.

• Require independent approval. Keep dual authorization for high-value transfers and changes to beneficiary details. The second approver should review the payment independently, not simply confirm that the first requester sounds familiar.

• Treat secrecy and urgency as warning signs. A demand to keep a transaction from colleagues, bypass normal review or send funds immediately should trigger escalation.

• Separate identity checks from payment approval. Even after confirming who made a request, verify the business purpose, destination account and supporting documentation under the normal finance process.

• Protect vendor and bank-detail changes. Confirm new or changed payment instructions with an established supplier contact through a separate, previously verified channel.

• Give employees a safe escalation route. Staff should be able to pause a transfer and contact finance leadership or security without being penalized for delaying an unusual request.

• Practice the scenario. Run short exercises for accounts payable, treasury, executive assistants and finance managers using realistic voice or video impersonation attempts.

A useful control is a written rule that no executive, attorney or vendor can waive payment verification through a phone or video call. Make the rule apply even when the request appears to come from the CEO.

What is still unknown and what to watch next

The public announcement does not explain which AI systems or services were allegedly used, how the impersonations were generated, or whether any particular platform was involved. It also does not provide a complete list of affected companies or a full account of how the alleged network selected targets.

The next developments to watch are the extradition proceedings, court filings and any further details prosecutors may release about the alleged operation. The Justice Department's November 5, 2026, announcement says extradition requests for all three defendants were pending at that time.

The case is at the charging stage. The indictment sets out prosecutors' allegations, not findings reached after a trial. Any assessment of the defendants' guilt must wait for the legal process.

FAQ

Did AI-generated voices and images help steal the money?

Prosecutors allege that the defendants and co-conspirators used AI to imitate the voices and/or images of corporate executives and attorneys. The indictment says those impersonations were used to persuade employees to send large payments to accounts controlled by the alleged conspiracy.

How much money was allegedly taken?

The Justice Department says the alleged scheme diverted more than $129 million from companies. Its announcement lists several specific losses, including more than $11.5 million from a United Kingdom financial technology company.

Were the three defendants convicted?

No conviction is established by the announcement. The three people were charged, and the Justice Department states that the charges are accusations and that the defendants are presumed innocent unless and until proven guilty.

Can a company stop this kind of fraud?

No single check eliminates the risk, but independent callback verification, dual approval for large transfers, strict controls on bank-detail changes and a clear escalation process can make it harder for an impersonation to bypass normal procedures.

Should employees trust a video call from their CEO?

They should treat a video call as a communication, not as proof of identity or payment authority. For any unusual transfer, employees should follow the company's established verification and approval process using independently sourced contact details.

Bottom line

The $129 million case is an indictment, not a conviction, but the alleged method is a concrete warning for any organization that moves money. Put one rule in writing now: no urgent payment or bank-detail change is approved solely because a familiar executive or lawyer appears on a call; verify independently and follow the normal approval chain.