The $129 Million AI CEO-Spoofing Indictment: The Wire That Did Not Go Out
The $129 Million AI CEO-Spoofing Indictment and the Wire That Did Not Go Out
Federal prosecutors in the Southern District of New York on Thursday, November 5, 2026, unsealed a seven-count indictment charging Jacob Soall, Sharon Hazan and Guy Sheetrit with using AI to impersonate CEOs and law-firm attorneys and persuade employees to wire money. U.S. Attorney Jamie McDonald said the defendants deceived corporate executives into sending them and their co-conspirators "approximately $129 million," as The Record reported. Soall was arrested in Spain on June 17, 2026, Hazan in Spain on August 5, 2026, and Sheetrit in the United Kingdom on September 7, 2026, and extradition requests for all three are pending, according to the SDNY announcement.
But here is the detail sitting deep in the charging story. According to Gizmodo's account of the indictment, an employee at an unnamed major New York investment bank authorized a roughly $2.85 million payment in an October 2024 attempt, and the bank's back office stopped the wire before it was sent. The employee had already been persuaded. The control that held sat on the payment process, not in the employee's judgment.
These are allegations. The defendants are presumed innocent, and lawyers for Sheetrit told The Record that he denies the charges.
Two Impersonations, Not One: Identity Checks Versus Payment Checks
As prosecutors describe it, the scheme did not rely on a single fake voice. Conspirators typically contacted an employee as the CEO, asked for help with a confidential financial transaction, and used AI to mimic the CEO's voice and sometimes image on a call. The fake CEO then directed the employee to a lawyer at a large international law firm, and a conspirator impersonating that lawyer gave the wiring instructions. Gizmodo reports the borrowed identities were often real attorneys in the European office of one of the world's 50 largest law firms.
That is the distinction that matters. Identity verification asks whether the person on the call is who they claim to be. Payment verification asks whether this payment, to this account, matches an approved instruction from a source the company already controls. The alleged scheme was built to pass the first test twice, once as the CEO and once as outside counsel. The October 2024 wire was stopped by the bank's back office.
The pressure was scripted. Soall kept a handwritten script titled "Lawyer Call" that included language designed to convince victim employees not to discuss their communications with fellow employees, according to the SDNY release text published by Townhall. Gizmodo reports the script invoked confidentiality and insider-trading concerns.
Payments Rail Risk: Financial Firms Were on the Victim List
The itemized losses include financial businesses, not only hospitals and consumer brands. According to Gizmodo's summary of the indictment:
- A Rhode Island bank lost about $2.68 million in November 2024.
- A United Kingdom financial technology company lost about $11.58 million in March 2025.
- A Massachusetts mutual fund company lost approximately $4.64 million in April 2025.
- Hospital systems in Missouri and California and a Florida pet food company lost between roughly $2.97 million and $5.24 million each.
The rail matters because of where the money went next. Prosecutors say the funds were wired to conspirator-controlled accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China, then converted into cryptocurrency to conceal the source, ownership and control of the proceeds.
The alleged scale is large. CBS News reports that, according to the indictment, the defendants targeted thousands of companies worldwide, often through accounting departments. Gizmodo reports that Hazan allegedly boasted of laundering more than $400 million over the past three years, while The Record describes the same boast as covering laundering since 1994. Either way, it is a boast described in charging papers, not a finding. According to the U.S. Attorney's Office, Hazan was convicted in a New York court of conspiracy to commit bank fraud in 2008, as CBS News reported.
What Your Leadership Team Should Decide This Quarter
The board-level question is simple: can one employee, persuaded by two convincing voices, release a seven-figure wire at your company? If the answer is yes, the fix belongs to the CFO, with the CCO or COO owning it at an adviser or fund manager.
Payment controls to assign now
- Separate authorization from release. The New York bank's back office stopped a wire an employee had already approved, according to Gizmodo's account of the indictment.
- Call back on a number you already hold. Confirm any CEO or outside-law-firm payment instruction through contact details in your own records, never details supplied in the request.
- Treat secrecy as an escalation trigger. A request to keep a payment from colleagues should route it to a second approver, because the "Lawyer Call" script was built to isolate employees.
- Gate new beneficiary accounts. A first-time account tied to a confidential transaction gets independent review before funds move.
Reporting and records
The FBI urged other companies that may have been victims to come forward, as The Record reported. If your finance team has received requests matching this pattern, preserve the messages and call records and direct your general counsel to decide on reporting.
Key Takeaways
- The alleged scheme was built to impersonate two people. Prosecutors say conspirators used AI to mimic a CEO, then impersonated a lawyer at a major law firm who gave the wiring instructions.
- Process stopped a wire that judgment approved. According to Gizmodo's account of the indictment, in an October 2024 attempt a New York investment bank's back office stopped a roughly $2.85 million wire after an employee authorized it.
- Financial firms were on the victim list. A Massachusetts mutual fund company lost approximately $4.64 million in April 2025, according to Gizmodo's summary of the indictment.
- Confidentiality language was part of the script. Soall's handwritten "Lawyer Call" script included language designed to keep employees from discussing the request with colleagues.
- The case is unproven and the defendants are abroad. All three are presumed innocent, and extradition requests for all three are pending.
Where the Fix Lives
The scheme alleged in this indictment was designed to defeat people, and the one stopped wire described in it was stopped by process. Investment advisers, fund managers and fintech companies that wire company or client money generally need their payment authorization procedures, callback protocols and impersonation-response steps reviewed before the next confidential-deal wire request reaches the finance team. To scope that work for your firm, speak with FinTech Law.
FinTech Law's SEC compliance practice works with investment advisers and fund managers on their compliance policies and procedures.
This blog post is for informational purposes only and does not constitute legal advice. No attorney-client relationship is formed by reading this content. If you need legal advice, please contact a qualified attorney.
FinTech Law fixed engagements: FinTech Startup Regulatory Path ($1,500) · Emerging Manager Launch Kit ($7,500) · Regulatory Path Outline ($7,500) · RIA/ERA Registration ($8,500) · Private Fund Formation (from ~$18,000) See the catalog.
Fractional General Counsel · from $7,500/qtr