Federal prosecutors in Manhattan have unsealed an indictment charging three foreign nationals with running an impersonation scheme that used AI to mimic the voices and images of corporate executives and attorneys, tricking employees at companies around the world into wiring more than $129 million to accounts controlled by the conspirators.
The US Attorney’s Office for the Southern District of New York announced the charges alongside the FBI’s New York field office. Jacob Soall, 41, of Marbella, Spain and the UK — who prosecutors say used the alias “Rocky Balboa” — was arrested in Spain on 17 June. Sharon Hazan, 54, of Israel, was arrested in Spain on 5 August. Guy Sheetrit, 42, of Israel and the UAE, was arrested in the UK on 7 September. All three are awaiting extradition and face up to 20 years per count on wire fraud, money laundering and conspiracy charges, plus two-year aggravated identity theft counts.
How the alleged scheme worked
According to the indictment, between 2024 and 2026 the trio targeted employees — often in accounting departments — with emails purporting to be from their own CEO, asking for help with a confidential financial transaction. The target would then be routed onto a phone or video call where AI was used to mimic the CEO’s voice or image, per ABC News’ report on the unsealed indictment.
The second layer is what makes the alleged operation unusual: when employees were told to verify the transaction with lawyers at a major law firm, the defendants allegedly impersonated those lawyers too — closing the verification loop the fraud-prevention playbook tells companies to use. Soall, prosecutors say, worked mainly from a handwritten script titled “Lawyer Call” while posing as UK-based attorneys. Once a company wired the money, funds were allegedly converted to cryptocurrency to conceal their source and distributed through accounts in the US, Spain, Portugal, Greece, the UAE, Singapore, Austria, Slovakia and China.
The alleged victims read like a cross-section of the economy rather than a list of careless startups, according to the AP’s reporting carried by WRAL: a Missouri hospital system ($4.83 million), a California hospital system ($2.97 million), a Rhode Island bank ($2.68 million), a UK financial technology company ($11.58 million), a Massachusetts mutual fund company ($4.64 million) and a Florida pet food company ($5.24 million), among others.
All of this is alleged in an unsealed indictment — the defendants have not been tried, and extradition requests are pending. Hazan was previously convicted in the same Manhattan courthouse of conspiracy to commit bank fraud in 2008, and the indictment quotes him boasting of laundering over $400 million in the past three years and being “number one all over the world” among professional money launderers.
The verification step was eaten too
Voice-cloning fraud is not new to this site — the FBI logged $893 million in AI-linked scam losses in 2025, and we have covered cloned voices used against families, including a Senate hearing on AI deception aimed at older adults. What is different in this indictment is the professionalisation: prosecutors describe a crew that didn’t just clone a CEO’s voice, but staffed the callback — the lawyer who “verifies” the transaction — making the standard advice, verify the request through a second channel, into part of the trap when both channels lead back to the same performers.
That has an obvious implication for any company’s wire-transfer controls. Callback procedures assume the person on the other end of the second call is independent of the first. When consumer-grade voice cloning needs only seconds of audio, and a fake law firm can be conjured on the same laptop as the fake CEO, the second channel has to be verified itself — a published switchboard number dialed by the employee, not one supplied during the call.
For New Zealand companies, the lesson lands without any local prosecutions needing to happen first. Our banking sector already warns about CEO-fraud emails, and NZ Parliament has moved on criminalising deepfakes in other contexts. But this indictment suggests the target isn’t the technology budget — it’s the assumption, still written into most finance-department procedures, that a familiar voice plus a plausible lawyer equals a real transaction. The DOJ’s message in branding the scheme as “super intelligence” fraud is that the defence budget may need to buy fewer dashboards and more rehearsals of the moment an employee hangs up on their own CEO.
Sources: US DOJ, SDNY press release, ABC News, AP via WRAL
