The voice was the CEO’s. It was not the CEO.
By Mara Quinn | November 8, 2026
The Call That Started It
The fraud began with a phone call. An employee at a Missouri hospital system heard their CEO's voice on the line, calm and authoritative, laying out a confidential financial matter that needed to move quickly. The voice had the right cadence, the right tone, the right weight of command. Everything that makes a voice recognizable was present. Everything that makes a voice trustworthy had been fabricated.
That call, prosecutors allege, was placed by a team of fraudsters who had cloned the executive's voice using artificial intelligence. They did it again and again, over roughly nineteen months, targeting hospitals, a bank, a mutual fund firm, a pet food company, and a British fintech startup. They posed as CEOs. They posed as attorneys at major law firms. And they allegedly walked away with approximately $129 million.
A federal indictment unsealed Thursday, November 6, in the Southern District of New York charges three men with running the scheme: Jacob Soall, 41, of Marbella, Spain, and the United Kingdom; Sharon Hazan, 54, of Israel; and Guy Sheetrit, 42, of Israel and the United Arab Emirates. The charges include wire fraud, aggravated identity theft, and money laundering. The fraud and money laundering counts each carry a maximum of twenty years in prison; aggravated identity theft carries up to two additional years. All three defendants are foreign nationals. All three were arrested in Europe and are awaiting extradition.
All charges are allegations. The defendants are presumed innocent unless proven guilty.
How the Scheme Worked
The operation followed a layered script, according to the indictment. It began with a contact, typically aimed at an employee in a company's accounting or finance department. A member of the group would reach out posing as the company's own chief executive, using AI tools to replicate the executive's voice on a phone or video call. The impersonation was designed to establish urgency and invoke confidentiality: this deal is sensitive, do not discuss it with colleagues.
Prosecutors say that Jacob Soall, who went by the aliases "Rocky Balboa" and "Seba Clarke," focused particularly on impersonating British attorneys. He kept a handwritten script titled "Lawyer Call," which contained language crafted to discourage victims from raising the matter internally. The script was part of a deliberate psychological architecture: by the time an employee was handed off from the fake CEO to the fake lawyer, the trap had already been set.
Sharon Hazan, who used nicknames including "Superman Cash," "Impossible Mission," "Fat Boy," and "Ron," allegedly handled significant portions of the money movement. Guy Sheetrit played a supporting role in the alleged conspiracy.
Once a victim employee was convinced, they wired funds to accounts controlled by the conspirators. Those accounts stretched across multiple countries: the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia, and China. After the transfers landed, the money was converted into cryptocurrency to obscure its origin before being divided among the group and their unnamed co-conspirators.
What made the scheme work, according to prosecutors and outside security experts, was the combination of technical impersonation and social engineering. Seeing a face or hearing a familiar voice on a live call has long served as a final check against fraud. This operation removed that check entirely.
"We've reached a point where seeing someone on a video call or hearing their voice is no longer reliable proof that you're actually speaking to that person," Emmanuelle Saliba, chief investigations officer at GetReal Security, told the Daily Caller News Foundation. "With a relatively small amount of publicly available audio or video, attackers can clone a voice or impersonate someone's appearance in real time."
The fraudulent schemes also exploit a basic workplace dynamic: employees respond to urgent requests from people who appear to be their superiors. The combination of a believable impersonation and a credible sense of urgency left little room for the victim to pause and question.
Named Victims: Six Organizations, Roughly $32 Million
The indictment names six organizations and specifies losses to each. None were identified by name, but the indictment describes them by sector and location.
A hospital system in Missouri lost nearly $4.9 million. A hospital system in California lost approximately $3 million. Between them, two of the country's most resource-strained institutional sectors were hit for nearly $8 million, money diverted from organizations whose operating margins are frequently narrow.
A bank in Rhode Island lost approximately $2.7 million. A mutual fund company in Massachusetts lost more than $4.6 million. A pet food company in Florida lost more than $5.2 million. And a financial technology company in the United Kingdom lost more than $11.5 million, the single largest individual loss named in the indictment.
Together, these six organizations account for roughly $32 million in documented losses.
The Gap Between $32 Million and $129 Million
The gap between the named victims' losses and the total $129 million alleged in the indictment is not an arithmetic error. It reflects the breadth of the alleged scheme.
Prosecutors accuse Soall, Hazan, Sheetrit, and their co-conspirators of targeting thousands of companies in the United States and abroad over the course of the operation. The six named victims represent the cases prosecutors chose to detail in the indictment. The remaining roughly $97 million, by the government's accounting, represents losses spread across additional victims whose cases are part of the broader allegation but not individually itemized in the charges unsealed Thursday.
U.S. Attorney Jamie McDonald described the scale in a statement: "As alleged, Jacob Soall, Sharon Hazan, and Guy Sheetrit abused groundbreaking super intelligence technology to impersonate real people and deceive corporate executives into sending them and their co-conspirators approximately $129 million."
McDonald's office referred to the AI tools throughout its press release using the term "super intelligence," abbreviated to "SI." FBI Assistant Director in Charge James C. Barnacle Jr. added that "the use of advanced technology can be exploited to commit large scale fraud" and said the FBI remains committed to adapting its investigative capabilities in response.
As an indication of how deeply embedded in financial crime one defendant allegedly was: prosecutors say Hazan boasted that he had been laundering money since 1994 and had moved more than $400 million in the past three years alone. Hazan was also convicted in 2008 of conspiracy to commit bank fraud in the same Manhattan federal court where this new case has been filed.
Three Arrests, Three Countries
Law enforcement moved in three separate operations across five months to take the defendants into custody.
Spanish police detained Jacob Soall on June 17, 2026. Sharon Hazan was detained in Spain on August 5, 2026. The UK National Crime Agency arrested Guy Sheetrit on September 7, 2026. Extradition requests for all three defendants are pending.
According to the indictment, Soall faces 20 counts, Hazan faces 18 counts, and Sheetrit faces 6 counts. Note: the Associated Press reported that each defendant faces seven counts; this article uses the figures stated in the brief, which the desk understands to reflect the full indictment rather than a summary of charge types. RFTUV will update if the indictment count is independently confirmed.
The alleged operation ran from July 2024 through February 2026. It involved not just the three named defendants but unnamed co-conspirators who helped execute the transfers and launder the proceeds through the multi-country network of accounts.
What Companies Can Actually Do
The indictment does not prescribe corporate defenses, and the defendants have not been convicted. But the mechanics of the alleged scheme make clear what assumption proved fatal in every named case: that a live voice or face, in real time, confirms the identity of the person on the other end.
That assumption no longer holds.
Saliba, speaking to the Daily Caller News Foundation about the case, said companies must look at which internal processes are most exposed. "Companies need to identify the business processes that are most vulnerable, like wire transfers, credential resets, or requests involving privileged accounts," she said. "Those processes need additional security controls, including integrated deepfake detection technologies."
The indictment also reveals a specific tell: the fake CEO or lawyer consistently imposed a confidentiality requirement, steering the victim away from checking with colleagues. Any unexpected instruction to handle a financial request quietly, without looping in a supervisor or compliance team, should itself be treated as a red flag.
Authentication processes that require out-of-band verification, meaning a callback to a known number or a secondary confirmation through a separate channel, would not have defeated the attack on their own. But they would have inserted a gap in the chain of urgency the scheme depended on. A five-minute pause to call a known direct line, using a number already on file, is the kind of friction that disrupts the script entirely.
The FBI has urged anyone who believes they were targeted in this scheme to submit information through tips.fbi.gov.
Who Pays the Price
Three men are in custody in Europe waiting for extradition hearings. The charges allege wire fraud, aggravated identity theft, and money laundering totaling $129 million. The penalty exposure for each count is significant: up to twenty years per fraud or money laundering conviction, plus up to two additional years for each identity theft count.
The hospital systems, the bank, the mutual fund, the pet food company, the fintech firm, and the other victims whose losses have not yet been individually named are still out whatever they wired. Recovery in wire fraud cases depends heavily on how quickly funds are traced and whether assets remain recoverable at the time of prosecution. Funds converted to cryptocurrency and routed through nine countries are rarely recovered in full.
The case sits alongside a growing record of AI-facilitated fraud against corporate targets. In 2024, British engineering firm Arup confirmed that an employee in Hong Kong transferred approximately $25 million after a video call with digitally faked colleagues. That incident involved fabricated participants on the call, not live voice cloning, but the vector is the same: technology used to destroy the credibility of real-time audiovisual communication.
McDonald, in a second statement following the charges, was direct: "This Office and our law enforcement partners will do our part and continue to identify, investigate, and prosecute criminals, including those who use new technologies to defraud Americans."
What happened to the Missouri hospital, the Rhode Island bank, and the others was not a technical failure. Each organization had people trying to do their jobs. The scheme succeeded by making those people believe, with apparent certainty, that they were doing exactly what their boss wanted.
