Technology · November 7, 2026

AI CEO Impersonation Scam: DOJ Alleges $129M Theft

Federal prosecutors say a cross-border operation used synthetic executive and lawyer identities to persuade employees to wire corporate money. Here is what the indictment alleges, what remains unproven, and the practical verification lessons.

By NewsTrendus Editorial Desk · November 7, 2026 · Source-linked desk reporting · Representative photograph

This is a source-linked desk explainer, not first-hand reporting. Research and drafting may use AI-assisted tools. Follow the cited source links and read our editorial and corrections policy.

This is an AI-assisted, source-linked desk explainer, not first-hand investigation. Charges are allegations, not findings of guilt. Read the editorial and corrections policy.

Representative licensed photograph of an office worker on a telephone beside a laptop, not a defendant or victim in the alleged fraud

Representative licensed office photograph; not an image of the alleged defendants, victims or investigative evidence. Photo: Vitaly Gariev / Pexels.

Quick answer: In a November 5, 2026 indictment announcement, the U.S. Justice Department said three men were charged in an alleged scheme that took approximately $129 million from companies by impersonating executives and attorneys with AI-generated voices or images. The defendants are presumed innocent unless proven guilty.

Who was charged in the alleged $129 million impersonation fraud?

The U.S. Attorney's Office for the Southern District of New York named Jacob Soall, Sharon Hazan and Guy Sheetrit in an indictment unsealed on November 5. Prosecutors said Soall and Hazan had been arrested in Spain in June and August respectively, and Sheetrit in the United Kingdom in September; extradition requests were pending as of the announcement. These are charges, not convictions.

The Justice Department's release calls the technology “super intelligence,” while Associated Press reporting describes AI-generated voice and sometimes video impersonations. The available public allegations do not establish which particular commercial AI model or software generated the fakes.

How did the fake CEO and attorney calls allegedly work?

Prosecutors describe a multi-stage payment diversion, rather than a simple spam message. First, an employee received a supposedly confidential request from a senior executive. A call with a convincing imitation of that executive's voice or image reinforced the request. The employee was then referred to a purported lawyer working on the transaction. According to the indictment summary, conspirators also impersonated that lawyer and provided instructions to transfer money to accounts they controlled.

The alleged use of a second trusted role is central to the case: the purported attorney made the unusual transfer appear to have legal oversight. Prosecutors also say the money was subsequently moved through international accounts and converted into cryptocurrency to obscure its trail. These claims remain subject to proof in court.

Which US organizations did prosecutors say lost money?

The Justice Department identified examples by organization type and headquarters location, rather than publishing the companies' names in its announcement. The reported examples include a Missouri hospital system ($4.83 million), a California hospital system ($2.97 million), a Rhode Island bank ($2.68 million), a Massachusetts mutual fund firm ($4.64 million) and a Florida pet-food company ($5.24 million). The release also lists a UK financial-technology company ($11.58 million). These figures are individual examples, not a complete accounting of the alleged $129 million total.

The U.S. locations show why the story matters beyond one sector: hospitals, banking, asset management and ordinary suppliers can all be targets when employees are authorized to approve large payments. The identities and experiences of other potential victims should not be guessed from the published indictment summary.

What can a finance team do before sending an urgent wire?

The alleged sequence suggests several practical controls that do not depend on detecting a synthetic voice perfectly:

Independently call back: verify a sensitive request using a phone number from an existing internal directory, not a number in the suspicious message or call.
Require two-person approval: separate initiation and authorization for unusually large transfers, including those claimed to be confidential.
Confirm bank-detail changes out of band: use an established vendor or legal contact channel before sending funds to a new account.
Escalate secrecy and urgency: a demand not to consult colleagues is a reason for stronger verification, not a waiver of controls.
Preserve records: retain messages, call information and transfer instructions if fraud is suspected, and contact the bank promptly.

These are general operational precautions, not guarantees of preventing fraud or a substitute for an organization's legal and security procedures.

What happens next in the criminal case?

The November 5 announcement lists wire-fraud, identity-theft and money-laundering charges. Maximum statutory penalties in the release are not predictions of sentencing. The defendants' extradition proceedings and any subsequent court hearings will determine the next procedural steps. A charging document states prosecutors' case; it is not a judicial finding that the allegations occurred exactly as described.

Readers tracking the broader US technology and business landscape can also see our existing Technology coverage and Business coverage.

Original sources and verification

Verified November 7, 2026. The reported losses and conduct are allegations; the presumption of innocence applies throughout the proceedings.