DOJ Charges Trio in $129 Million AI Deepfake CEO Fraud

Three men now face trial in New York over a fraud operation built almost entirely out of synthetic voices and borrowed faces. Prosecutors say Jacob Soall, Sharon Hazan, and Guy Sheetrit spent roughly a year and a half convincing employees at companies around the world that they were speaking to their own CEOs and outside lawyers — except none of those people were actually on the call.

How the scheme worked

According to the US Attorney's Office for the Southern District of New York, the trio ran the operation from July 2024 through February 2026, using AI-generated voice and video to impersonate corporate executives and attorneys at major international law firms. Soall allegedly specialized in posing as UK-based lawyers, while Hazan and Sheetrit are accused of laundering the proceeds once the stolen money landed in accounts the group controlled. Employees who believed they were following instructions from a real boss, or real legal counsel, wired the funds themselves — no hacking required, just a convincing enough voice on the other end of the line.

A deepfake, for anyone who hasn't run into the term, is AI-generated audio or video built to look or sound like a real person saying something they never actually said. The technology has improved to the point where voice alone — long treated as a decent stand-in for identity over the phone — can no longer be trusted on its own.

The three face seven counts, including conspiracy to commit wire fraud (fraud carried out through phone calls, emails, or electronic money transfers), aggravated identity theft, and money laundering. Soall was arrested in Spain in June, Hazan in Spain in August, and Sheetrit in the UK in September. All three are now awaiting extradition — the legal process of handing a suspect over to face charges in another country — and have not yet entered pleas.

This isn't just a Silicon Valley problem

Indian regulators have been watching the same pattern show up closer to home. In July, the Securities and Exchange Board of India (SEBI) formally cautioned listed companies and regulated entities about a rising fraud pattern nicknamed the "Boss Scam" — cybercriminals using AI voice cloning and manipulated video calls on WhatsApp and Teams to impersonate a company's own CEO or managing director, usually to pressure a finance employee into an urgent wire transfer. The warning followed an advisory from India's Cyber Crime Coordination Centre (I4C), which has tracked a steady rise in these impersonation attempts against Indian finance teams through 2026.

That makes this US case less of a foreign curiosity and more of a preview. The tools involved — voice cloning, face-swapping video — are the same ones available to anyone with a laptop and a subscription, and Indian companies have already lost real money to lower-tech versions of this trick, as Code24 has covered with the digital arrest scam, where fraudsters pose as police or regulators on video calls to frighten victims into paying up.

A familiar face on a video call and a familiar voice on the phone used to be enough to trust a request for money. After a case like this, neither one is.

What actually helps

Security teams and finance departments are converging on a fairly simple playbook, even though it means slowing down exactly the kind of urgent request these scams are designed to exploit:

• Verify any money-transfer request through a second, independent channel — call back on a number you already had on file, not one given during the suspicious call.
• Treat urgency itself as a red flag. Real CEOs rarely demand a same-hour wire transfer over video chat.
• Train finance and operations staff specifically on voice and video impersonation, not just email phishing — the two require very different instincts to catch.
• In India, report suspected incidents quickly through the 1930 cybercrime helpline or cybercrime.gov.in; faster reporting meaningfully improves the odds of freezing stolen funds before they move further.

None of this requires exotic defenses — just a willingness to treat a voice or a face on a screen as something that can be faked, because now it demonstrably can be. The companies that build that assumption into their payment processes before they get targeted are the ones that won't end up as a line in someone else's indictment.