Deepfake CEO Fraud: $129M SDNY Indictment [2026]

On November 5, 2026, federal prosecutors in Manhattan unsealed a superseding indictment accusing three men of using artificial intelligence to impersonate corporate chief executives and international law-firm attorneys, stealing approximately $129 million from businesses around the world. The case lands in the middle of a year when deepfake CEO fraud has already appeared in FBI statistics, FinCEN alerts, and product features such as Microsoft Teams’ suspicious-meeting reporting—and it spells out, charge by charge, how synthetic voice and video can stand in for real people without hacking a single biometric login.

U.S. Attorney Jamie McDonald said that, as alleged, Jacob Soall, Sharon Hazan, and Guy Sheetrit “abused groundbreaking super intelligence technology to impersonate real people and deceive corporate executives into sending them and their co-conspirators approximately $129 million,” according to Courthouse News. The defendants—Jacob Soall, Sharon Hazan, and Guy Sheetrit—were arrested overseas; extradition requests were pending as of the announcement. They are presumed innocent unless convicted.

This guide answers the questions finance, legal, and communications teams are asking now: what the government alleges, how the playbook worked, what it did not require technologically, and what you can do today if someone on a video call demands an emergency wire.

What Exactly Was Unsealed in the Southern District of New York?

A seven-count superseding indictment charging wire fraud, aggravated identity theft, and money laundering, tied to an alleged conspiracy that ran from about July 2024 through February 2026. CyberScoop’s summary of the charging papers describes thousands of targeted companies and a repeated pattern: impersonate the CEO on a confidential deal, then impersonate a lawyer who confirms the wire.

Prosecutors allege the men used AI to “impersonate the voices and/or images” of executives and attorneys. On calls, they allegedly mimicked a CEO’s voice and sometimes appearance, then passed victims to a supposed lawyer who was another impersonation. Courthouse News quotes the government as saying:

“On those calls, the defendants and their co-conspirators would use AI to mimic the voice and at times the image of the impersonated CEO in order to convince the victim employee that the transaction was real.”

The same article quotes the indictment’s summary of the attorney leg:

“The impersonated attorney would ultimately direct the victim employee to wire a large sum of money in furtherance of that financial transaction to a particular bank account, which was in fact controlled by members of the conspiracy.”

Defendants face up to decades in prison if convicted on all counts. Soall was arrested in Spain in June 2026, Hazan in Spain in August, and Sheetrit in the United Kingdom in September, according to reporting on the announcement.

Why this indictment matters beyond one courtroom

Unlike an anonymous forum post or a vendor white paper, a Manhattan federal indictment attaches names, dates, and dollar amounts to a threat model compliance teams already feared. It also shows the alleged harm scale—$129 million attributed to the broader scheme—without reducing the story to a single viral clip.

If you have been tracking the macro numbers, our deepfake fraud statistics guide separates FBI-reported AI fraud losses from marketing slides; this case is the micro evidence behind those aggregates.

How Did the Alleged CEO and Lawyer Impersonation Playbook Work?

It allegedly combined familiar business procedure with synthetic media and stolen professional identities—not a magic bypass of bank-grade face login.

Biometric Update’s walkthrough of the indictment describes these steps:

1. Target selection — Find accounting or treasury staff who can approve large outbound wires.
2. Confidential transaction framing — Messages through an electronic signature platform, often described as a corporate acquisition requiring secrecy.
3. CEO voice or video — A call where AI reproduces the executive’s voice and, in some instances, visual likeness.
4. Lawyer confirmation — Handoff to a purported attorney at a major international firm; prosecutors say conspirators often used real lawyers’ identities from European offices so victims could verify credentials that matched a genuine professional profile.
5. Wire instructions — The fake attorney stresses confidentiality and names an account controlled by the conspiracy.
6. Laundering — Proceeds allegedly moved through banks in multiple countries and were converted to cryptocurrency.

Soall allegedly maintained a handwritten script titled “Lawyer Call” to keep employees from checking with colleagues. That detail matters: the scam’s strength was procedure and authority, with AI supplying the face and voice of authority.

Did attackers need to defeat corporate face or voice biometrics?

The public charging narrative says they exploited recognition of familiar people instead of compromising biometric gates. Biometric Update notes the attacks “did not require compromising biometric authentication systems” and instead used synthetic voices and images to exploit employees’ trust in people they thought they knew.

That is different from injected deepfakes in KYC onboarding, where a fraudster feeds a fake video into a verification portal. Both are serious; this indictment is squarely in the business email compromise plus live impersonation bucket that FinCEN flagged in 2024.

Which Documented Transfers Does the Government Highlight?

Six named thefts totaling roughly $32 million, against a wider $129 million attributed to the conspiracy.

Courthouse News gives additional examples, including more than $11.5 million from a U.K. fintech in March 2025 and $4.6 million from a Massachusetts mutual fund in April 2025.

The wire that never left the building

Biometric Update reports that in October 2024 conspirators allegedly impersonated a New York investment bank’s CEO and attorney to induce a $2.85 million transfer. The employee authorized payment, but back-office controls stopped release. That is the counterfactual every CFO should study: the social engineering succeeded up to the last control.

For a deeper look at live-filter mechanics and quick challenges, see our guide on detecting deepfake video call scams.

What Criminal Laws Cover AI Voice and Face Impersonation?

U.S. prosecutors typically charge synthetic impersonation under existing fraud and identity statutes, not a standalone “deepfake law.” Wire fraud under 18 U.S.C. § 1343 penalizes schemes to obtain money by false pretenses using interstate wires—email, phone, or video conferencing included. Aggravated identity theft under 18 U.S.C. § 1028A adds mandatory consecutive time when a fraud offense involves knowingly using another person’s identification.

The SDNY indictment’s two aggravated identity theft counts reportedly track separate misuses of executive and attorney identifying information. That structure signals how prosecutors think about harm: not only the stolen dollars, but the reputational weaponization of real professionals’ names and voices.

Money laundering charges mirror how investigators follow crypto conversions after wires land. CyberScoop describes transfers through accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia, and China, then conversion to cryptocurrency—classic placement-layering patterns FinCEN discusses in its deepfake alert typologies.

Transparency rules still matter for legitimate synthetic media

Fraud prosecutions and labeling obligations run on parallel tracks. If your communications team records reenactments for anti-fraud training, distinguish them from real executive messages. The EU AI Act’s disclosure duties for AI-generated depictions of real people—and state laws like New York’s synthetic performer rules—do not stop criminals, but they clarify what lawful publishers must say when they manipulate faces or voices. Our EU nudifier ban and consent-safe publishing guide walks through consent and labeling angles that differ sharply from impersonation fraud.

What Did Each Defendant Allegedly Do?

Prosecutors assigned roles rather than treating the trio as interchangeable callers.

Reporting identifies Jacob Soall, 41, as focusing on attorney impersonations from the United Kingdom, using lawyerly vocabulary and the handwritten “Lawyer Call” script. Sharon Hazan, 54, and Guy Sheetrit, 42, allegedly handled laundering; Courthouse News says prosecutors quoted Hazan boasting about being “number one all over the world” at professional money laundering, and noted Hazan’s prior conviction in the same district for bank-fraud conspiracy.

Sheetrit’s counsel told CyberScoop he had no involvement—a defense teams should read as unproven until trial. The indictment’s factual allegations, meanwhile, are what compliance trainers will cite: Soall’s scripted attorney persona, multi-jurisdiction bank hops, and crypto cash-out.

Understanding those roles helps you design controls: legal-named callbacks for any wire touching outside counsel, not only C-suite impersonation.

How Does This Case Connect to Earlier Deepfake Warnings?

Regulators were already telling banks to expect GenAI-enabled fraud before this indictment.

On November 13, 2024, FinCEN published Alert FIN-2024-Alert004 on fraud schemes involving deepfake media. The alert defines deepfakes as synthetic content that can produce “realistic but inauthentic videos, pictures, audio, and text,” and it warns that criminals alter or forge identity documents to circumvent identity verification and authentication.

The SDNY case stretches that typology from onboarding fraud to internal treasury fraud: the “identity” being faked is an executive’s voice and face on a call, not only a passport photo uploaded to a vendor portal.

Platform vendors have moved in parallel. Microsoft rolled out a Report button for suspected deepfake participants in Teams meetings, which we covered in our Teams deepfake reporting explainer. The Manhattan indictment is the law-enforcement mirror image: criminal charges for the same underlying technology misused at scale.

State and federal disclosure rules also keep converging on synthetic media that depicts real people. New York’s synthetic performer law and the EU AI Act’s transparency duties do not stop wire fraud, but they clarify when publishers must label manipulated video—useful context if your incident response team records calls for training. Start with our New York AI disclosure overview if your compliance desk covers both fraud and marketing.

What Should You Do If a “CEO” Demands a Wire on Video?

Slow down, verify out of band, and never let secrecy block a second signature.

1. Hang up and call back on a number from your corporate directory or SEC filings—not a number or Teams link supplied during the suspicious session.
2. Require dual control for wires above your policy threshold, with both approvers confirming via separate channels.
3. Ban “confidential acquisition” exceptions to your wire policy unless legal and treasury leaders confirm through established internal ticketing.
4. Run a live challenge if you must stay on video—ask the caller to turn profile, walk, or use an occlusion gesture; many real-time face maps fail. Our three-finger test guide explains why.
5. Train AP staff on lawyer impersonation, not only CEO spoofing: the indictment’s second identity-theft count centers on attorney credentials.
6. File SARs and law enforcement reports using FinCEN’s deepfake keyword when your institution sees similar patterns.
7. Document with redaction if you record suspicious calls for investigators—blur faces of uninvolved staff before sharing clips internally or with counsel.

Where BGBlur fits (and where it does not)

BGBlur does not authenticate live executives. It does help teams handle video evidence responsibly: motion-tracked face blur for witnesses in training reels, voice anonymization when you publish sanitized examples for staff education, and fast redaction before clips leave your browser. Read how blur differs from synthetic replacement in our face anonymizer comparison.

Never claim a privacy tool would have blocked this indictment’s alleged fraud—the failure mode here was trust in a familiar voice, not an unblurred TikTok.

How Is CEO Deepfake Fraud Different From Fake Job Candidates on Video?

Both use live synthetic faces, but the victim and payout mechanism differ. Recruiting scams described by the FBI and security vendors aim to infiltrate payroll or code repositories by passing a hiring interview with a filtered face. The SDNY scheme allegedly targeted employees already inside the building, abusing wire approval authority and fake outside counsel.

Detection overlap exists—occlusion challenges, refusal to move off-axis, mismatched lighting—but controls diverge. HR should harden interview liveness; treasury should harden callback and dual approval. Our unauthorized filming and face-blurring guide covers a different risk surface (bystanders in public video), but the same principle applies: verify before you trust a face on a screen.

Communications and investor-relations teams face yet another variant: fake CEO clips on social media. Those clips rarely initiate a wire directly, but they prime employees to believe an executive might request secrecy. Pair social monitoring with explicit policy: no acquisitions or wires are authorized solely over video.

Why Did Hospital Systems and a Bank Appear Among the Victims?

Nonprofit and regulated entities still move large wires quickly when leadership appears to order secrecy. Missouri and California hospital systems and a Rhode Island bank appear on the loss lists because finance teams in those sectors routinely execute vendor and acquisition payments on compressed timelines—exactly the story the indictment’s “confidential deal” framing exploits.

Healthcare privacy officers sometimes focus on HIPAA imaging while treasury faces BEC-style threats on different channels. After this indictment, joint tabletop exercises should include synthetic CEO and counsel calls, not only phishing attachments. Blurring patient faces in incident recordings remains essential under HIPAA-style policies, but it does not substitute for treasury callback rules.

What Happens Next in the Criminal Case?

Extradition and pretrial litigation come first. Sheetrit’s attorneys told CyberScoop their client had no connection to the matter—a denial you should treat as a defense position, not established fact.

For businesses, the operational clock is immediate: update wire policies, rehearse callbacks, and align with the FinCEN deepfake red flags your BSA officers already have on file.

Boards should ask security leaders for a one-page gap analysis: Does our wire policy treat video the same as email BEC? Do we ban NDAs signed under duress of immediate transfer? Do counsel and CFO share a verification channel that does not rely on the same chat thread as the suspicious request? Those policy answers cost less than a single seven-figure wire.

Conclusion

The November 5, 2026 Manhattan indictment translates deepfake CEO fraud from headline anxiety into dated transfers, named roles, and a lawyer-call script. The alleged scheme did not need to break your face-login vendor; it needed an employee to believe a familiar voice on a confidential acquisition. Independent callbacks and dual approval still work when synthetic media sells the story.

If you publish internal training video about this threat, redact colleagues who were not part of the incident. Try BGBlur in the browser to blur faces and anonymize voices before clips circulate—so education does not create a new privacy problem while you harden the controls that actually stop wires.