Three foreign nationals — Jacob Soall, Sharon Hazan, and Guy Sheetrit — have been charged in a federal indictment unsealed by the Southern District of New York with using AI to impersonate corporate CEOs and attorneys at major law firms. The scheme, which ran from 2024 to 2026, netted more than $129 million stolen from companies, hospitals, and financial institutions across the United States, the United Kingdom, and beyond. The arrests occurred in Spain and the UK. The mechanics were precise and deeply social-engineered. The men would contact employees at target companies using AI-altered voices and images to pose as a senior executive — a CEO or equivalent. The fake executive would tell the employee they needed help with a sensitive financial transaction, then instruct them to contact a lawyer at a major international law firm. The men would then impersonate that lawyer, completing a two-layer trust chain that made the wire transfer request seem legitimate. The victim list is striking for its diversity. A Missouri hospital system lost nearly $5 million. A Rhode Island bank lost $2.7 million. A California hospital system lost $3 million. A Massachusetts mutual fund lost over $4.6 million. A Florida pet food company lost $5 million. A UK technology company lost over $11 million. These are not gullible targets — they are organizations with compliance departments and financial controls, overwhelmed by a social engineering attack that exploited a new trust vulnerability. Once the money landed in accounts across nine countries — the US, Spain, Portugal, Greece, the UAE, Singapore, Austria, Slovakia, and China — the men converted it to cryptocurrency to obscure ownership. Soall operated under aliases including "Seba Clarke" and "Rocky Balboa." Hazan went by "Superman Cash," "Fat Boy," and "Ron." The aliases suggest these were not first-time operators. The core structural problem this case illuminates is that AI voice and video cloning has crossed the threshold where corporate verification protocols — designed for a world where seeing a face or hearing a voice meant something — now fail by default. Every organization in the victim list presumably had approval chains for large wire transfers. Those chains assumed that a call from the CEO was, in fact, the CEO. That assumption is now broken, and almost no organization has updated its procedures to account for it. The FBI's statement acknowledges the problem in characteristically bureaucratic terms: "criminals continue to weaponize emerging technologies." What it doesn't say is that the defensive tooling — voice authentication, deepfake detection, multi-channel verification mandates — lags years behind the offensive capability. The cost of generating a convincing CEO deepfake is measured in hundreds of dollars. The cost of the fraud it enables is measured in millions. That asymmetry is the story. The men face charges of conspiracy to commit wire fraud, money-laundering conspiracy, and aggravated identity theft. The legal framework exists to prosecute this. What doesn't exist, at scale, is the institutional immune system to prevent it. The $129 million is gone. Cryptocurrency conversion makes recovery uncertain at best. The indictment is a law enforcement success, but it's a governance failure that the attack surface was this wide open for two years.
