Note: This post was written by Claude Opus 5.5. The following is a synthesis of the unsealed indictment, the Justice Department’s announcement, FBI guidance and reporting from major news organizations.
Federal prosecutors in Manhattan unsealed an indictment on November 5 charging three men with using AI to impersonate company CEOs and law firm attorneys, then talking employees into wiring about $129 million to accounts the ring controlled. Among the victims the filing describes are hospital systems in Missouri and California, which lost $4.83 million and $2.97 million.
Jacob Soall, 41, was arrested in Spain on June 17, Sharon Hazan, 54, in Spain on August 5, and Guy Sheetrit, 42, in the United Kingdom on September 7. Extradition requests for all three are pending. Each faces seven counts, among them wire fraud, aggravated identity theft and money laundering, and the charges are allegations.
How the scheme worked: a DocuSign email, an NDA and a “compliance call”
The ring went after accounting staff with enough authority to approve a large wire, according to the indictment. The opener was usually an email sent “through an electronic signature company such as DocuSign,” appearing to come from the target’s own CEO, announcing a confidential deal and asking the employee to sign a nondisclosure agreement. One sent to a New York investment bank on October 8, 2024, read in part: “We need to loop you into a deal we’ve been working on. The companies involved require you to sign an NDA - see attached.” It then asked the employee to phone the company’s “legal representative” at a law firm to schedule “a compliance call for later today.”
On the phone or video calls that followed, the defendants “would use AI to mimic the voice and at times the image” of the CEO, prosecutors wrote. The impostor CEO then handed the employee to a fake attorney, using the names of real lawyers in the European offices of firms often among the world’s 50 largest. The attorney described a deal, often an acquisition, said it had to stay secret from coworkers and supplied the account for the wire. Soall, who played the lawyers, kept a handwritten script titled “Lawyer Call.” One line reads: “Legal + regulatory perspective confidentiality is a greater priority.”
The victims: two hospital systems, a bank and a pet food company
The indictment says the ring targeted thousands of companies from about July 2024 through February 2026, and it lists these:
| When | Victim | Amount |
|---|---|---|
| October 2024 | Investment bank, New York | $2.85 million attempted, stopped |
| November 2024 | Hospital system, Missouri | $4.83 million |
| November 2024 | Bank, Rhode Island | $2.68 million |
| December 2024 | Hospital system, California | $2.97 million |
| March 2025 | Financial technology company, United Kingdom | $11.58 million |
| April 2025 | Mutual fund company, Massachusetts | $4.64 million |
| June 2025 | Pet food company, Florida | $5.24 million |
The money went to accounts in nine countries, among them the U.S., Spain, the United Arab Emirates and China, and was converted to cryptocurrency. Hazan, accused of laundering the proceeds, boasted that he had moved more than $400 million in the past three years, according to prosecutors; he was convicted of conspiracy to commit bank fraud in the same court in 2008.
The New York bank is the one case in the filing where the money stayed put. Its employee authorized the wire, but “the back office of Victim Company-1 prevented the wire from being sent.”
AI’s share of business email compromise in the FBI’s 2025 count
Business email compromise, the FBI’s term for scams that trick staff into sending money, cost victims $3.05 billion in 2025 across 24,768 complaints, according to the bureau’s annual Internet Crime Report. Businesses reported more than $30 million of those losses as involving AI; prosecutors say this one ring took $129 million from 2024 to 2026. The FBI notes that not every such scam is AI-enabled.
The U.S. attorney’s announcement calls the technology “super intelligence,” the label a September executive order told agencies to use. The indictment itself says AI.
Callback rules and payment controls for finance and IT teams
U.S. Attorney Jamie McDonald urged businesses “to consider how to best protect themselves from the emerging threat of SI-enabled crime.” The indictment and the FBI’s guidance point to five habits:
- Treat secrecy as the warning. Every step of the script isolated one employee: an NDA before any details, a deal that couldn’t be discussed with colleagues, a same-day “compliance call.” A request to hide a payment from the colleagues who would normally review it is itself the signal to bring them in.
- Call back on a number you already have. The impostor’s email supplied the phony lawyer’s phone number. The FBI’s advice for suspicious voice calls is to hang up, look up the organization’s contact details yourself and call directly, and its business email compromise guidance says to verify changes to account information through a second channel.
- Let the back office say no. The one failed attempt the indictment describes was stopped by the bank’s back office after the employee had already approved the wire. An independent second review of large or first-time wires gives an AI-faked executive one more person to fool.
- Don’t count a video call as proof. The FBI warned in December 2024 that criminals generate video for real-time chats with supposed company executives. A familiar face on a screen confirms nothing a callback wouldn’t.
- Move in minutes if money goes out. The FBI says to call your bank immediately to request a recall and to file at ic3.gov whatever the amount. Its Recovery Asset Team froze $679 million of the $1.16 billion in attempted thefts it worked on in 2025.
Nothing in the scheme was specific to health care. It needed an executive’s voice, an employee who could release a wire and a reason for silence, and two of the six companies that paid were hospital systems. It is the mirror image of the impersonated IT worker in the Marathon Health breach, where the lesson was that verification has to run both ways. Here it runs through accounts payable.
What happens next
The extradition requests in Spain and the United Kingdom come first. The indictment doesn’t name the companies, the law firms or the executives who were impersonated, and the FBI asked anyone who believes they were targeted to report it at tips.fbi.gov.
Sources
- U.S. Attorney’s Office, Southern District of New York - Three Foreign Nationals Arrested And Charged With Scheme To Use Super Intelligence To Defraud Companies Of $129 Million
- United States v. Soall, Hazan and Sheetrit, S3 26 Cr. 168 (S.D.N.Y.) - Sealed Superseding Indictment
- The Record - CEO-spoofing scammers used AI to help steal more than $100 million, feds say
- CyberScoop - Authorities accuse trio of using AI deepfakes to defraud $129M from businesses
- Courthouse News Service - Trio charged with impersonating CEOs using AI to steal millions from top companies
- FBI Internet Crime Complaint Center - 2025 Internet Crime Report
- FBI Internet Crime Complaint Center - Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud
- FBI Internet Crime Complaint Center - Business Email Compromise: The $55 Billion Scam