Three Men Face Charges Over Alleged $129 Million Deepfake CEO Fraud

What happened

According to the indictment, which was unsealed on 5 November 2026 in the Southern District of New York, Jacob Soall, Sharon Hazan and Guy Sheetrit face seven counts each, including conspiracy to commit wire fraud, wire fraud, aggravated identity theft and money laundering. Prosecutors say the group targeted accounting employees who had authority to approve large wire transfers. The approach usually began with an email sent through an electronic signature service such as DocuSign, which appeared to come from the company's chief executive. The message described a confidential deal, asked the employee to sign a non-disclosure agreement, and pointed them to a supposed attorney at a large international law firm. On a later phone or video call, the group used AI to imitate the executive's voice and, in some cases, image, according to the indictment as reported by CyberScoop and the Associated Press.

The scale is the main reason the case is getting attention. Prosecutors put the total at about $129 million. The largest single loss named in the indictment, $11.6 million, was suffered by a UK financial technology company, according to Help Net Security. BankInfoSecurity reports that the six losses the indictment identifies in detail total about $32 million, which means most of the $129 million sits in losses that are not itemised in public reporting. The period is also described differently across outlets. The New York Times, as reported in the brief, describes roughly 18 months from July 2024. Other reports give the end date as February 2026.

Reporting also disagrees on the reach of the case. Some outlets describe thousands of targeted businesses, while the indictment's named victims are a smaller group. Some outlets describe deepfake video, while The Record describes calls. The Justice Department release does not say how the voices and images were generated, how any victim's bank flagged the transfers, or how much money has been recovered.

Where the men are now

BankInfoSecurity reports that the three men were arrested in Spain and Britain and face extradition to the United States. The allegations have not been tested in court, and nothing in the reporting so far shows a plea or verdict.

Why it matters for businesses that automate work

The scheme did not break into a computer system. It used trust in a voice, a signature request and a formal-sounding legal step. That matters for any business that has automated its payment approvals, because automation often makes a payment faster to release. If the workflow treats an approval message or a call as enough, a faster process can move a fraudulent payment faster too.

Federal guidance already points in this direction. A 2023 information sheet from the National Security Agency, the FBI and the Cybersecurity and Infrastructure Security Agency advised organisations to verify identities in real time when executing financial transactions, for example with a one-time password. It also advised rehearsing responses with the staff most likely to be targeted, as reported by American Banker.

What changes in practice, at any size

A five-person firm and a group with thousands of staff face the same basic control. Before a new payee, a changed bank account or an urgent large transfer is paid, someone should confirm it through a channel that the request did not use. In practice that means calling a phone number already on file, not one given in the message, and recording who made the call and when.

Automation can help with the parts that are repetitive. A workflow can flag any wire over a set amount, any change to vendor bank details, and any request that arrives with words like confidential or urgent. It can place those items in a queue, attach the vendor record and the original message, and block release until a second named person approves. Staff should still make the judgement calls. Automation cannot tell whether a voice is real, and it cannot decide whether a deal is genuine. Those decisions stay with people who know the business and can call the executive directly.

Limits matter here. A rule that every payment needs two approvals will slow down ordinary business. Firms should set thresholds based on their own payment patterns, and review them after any false alarm or missed case. The right thresholds depend on the firm's own figures, which a review of its payment records will show.

What to watch next

Three developments will show how far the case reaches. The first is extradition, since the US has asked for all three men to be sent to the United States. The second is the charging stage, where the defendants will enter pleas and the court will set a schedule. The third is whether more victims come forward. The FBI has asked anyone who believes they were a victim to use its tips page, according to the Justice Department release as reported by ZeroHedge. Finance teams should also watch for updated federal guidance on AI impersonation, since the 2023 sheet predates the scale reported in this case.