1. What did prosecutors charge in the AI voice cloning fraud case?
Federal prosecutors in Manhattan unsealed an indictment on November 6, 2026 against three men accused of using artificial intelligence to impersonate corporate executives and attorneys in a scheme that allegedly took more than $129 million from companies. The defendants are Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42. The case was filed in the U.S. District Court for the Southern District of New York.
The indictment charges the men with conspiracy to commit wire fraud, wire fraud, aggravated identity theft and money laundering offenses. Prosecutors say the AI voice cloning fraud operation ran from about July 2024 to February 2026. Each of the main charges carries a maximum sentence of 20 years in prison, while aggravated identity theft carries a maximum of two years.
As in every criminal case, the accusations are allegations. None of the three has been tried or convicted on these charges, and each is entitled to a presumption of innocence until a court rules otherwise.
2. How did the alleged scheme work?
According to the charges, the scheme began with an email that appeared to come from a company's chief executive officer. The message asked the recipient, usually someone in the accounting or finance function, for help with a confidential financial transaction, the kind of sensitive request that employees are reluctant to question or discuss with colleagues.
The group then allegedly arranged a phone or video call, during which AI tools were used to reproduce the voice, and in some cases the image, of the executive. A second impersonation followed: a person posing as a lawyer, in some instances at a prominent international law firm, contacted the target with wire instructions. Prosecutors say Soall primarily imitated attorneys based in the United Kingdom. The addition of a supposed outside counsel was meant to lend legitimacy to the request and to make the transfer appear part of a genuine, privileged deal.
The accounting staff who received these requests allegedly authorized large wire transfers into accounts controlled by the defendants. Because the payments were made by trusted employees following what seemed to be direct instructions from leadership, the transactions would not necessarily trigger the controls designed to catch outside fraud.
The structure of the approach is worth noting. Each layer of the deception was designed to answer a doubt before the target could raise it. The email established the request, the call supplied a familiar voice, and the lawyer supplied formal authority and the technical details needed to carry out the payment. A target who might have hesitated at any one of these steps faced a coordinated sequence that made hesitation feel unreasonable.
3. Who were the victims and how much was taken?
The indictment alleges that the operation stole more than $129 million from companies. The affected organizations described in the case span several industries and regions, and include hospital systems in Missouri and California, a bank in Rhode Island, a financial technology company in the United Kingdom, a mutual fund company in Massachusetts and a pet food company in Florida.
The breadth of that list illustrates a central feature of this type of crime. The fraud does not depend on a weakness in one sector or one technology platform. It depends on a predictable organizational behavior: employees obey a credible instruction from a senior executive, particularly when it is framed as urgent and confidential. Any organization that moves money by wire is a potential target, whether it is a hospital, a bank or a consumer goods company.
The scale of the alleged losses also shows how a small group can have an outsized effect when automation lowers the cost of deception. Producing a convincing imitation of a voice once required skill and access to recordings of the speaker. Modern voice cloning tools can generate a plausible imitation from relatively short audio samples, which for public-facing executives and attorneys are often easy to find in interviews, presentations and recorded calls.
Recovery of funds in wire fraud cases depends heavily on speed. Banks can sometimes recall a transfer if they are notified within a short window, but once money has been moved onward through several accounts, recovery becomes far less likely. That is one reason investigators emphasize reporting suspected fraud immediately and why prosecutors often pursue forfeiture of assets alongside criminal penalties.
4. How were the defendants arrested?
The three men were arrested in Europe during 2026, according to the charges. Soall was detained in Spain in June. Hazan was arrested in Spain in August. Sheetrit was arrested in the United Kingdom in September. U.S. authorities have submitted extradition requests for all three, and those proceedings remain pending.
Extradition is often a lengthy process, because the person sought has the right to contest the request in the courts of the country where they were arrested. A U.S. trial cannot begin until the defendants are physically in the country, and the timeline depends on the decisions of foreign judges and, in some cases, government officials.
The indictment also contains a notable allegation about Hazan. Prosecutors say he boasted of laundering money since 1994 and claimed to have laundered more than $400 million in the previous three years. This is a statement attributed to him in the charging document, not a finding by a court, and it has not been tested at trial.
Cross-border cases of this kind usually require cooperation between prosecutors and police in several countries. Arrests carried out in Spain and the United Kingdom reflect that coordination, since evidence, bank records and the suspects themselves are often located in different jurisdictions from the victims. Such cooperation depends on formal treaties and mutual legal assistance arrangements, which can add months to a case but also allow charges to proceed against people who operate outside the United States.
5. What role did cryptocurrency play?
Money laundering is a central part of the case, and digital assets reportedly featured in it. Prosecutors allege that the proceeds of the fraud were later converted into cryptocurrency in an effort to conceal where the money had come from. The court documents described in public reporting do not specify which tokens were used or how much value passed through them.
Converting stolen bank funds into crypto is a recurring pattern in financial crime cases. Once wire transfers arrive in an account, they can be moved through a series of exchanges and wallets, split into smaller amounts and exchanged between assets, each step making the trail harder for investigators to follow. Law enforcement agencies have in recent years built tools to trace such movements on public blockchains, and many cases rely on that analysis together with records from exchanges that verify customer identities.
The charges of money laundering conspiracy and money laundering allege that the defendants did more than commit the initial deception. They are accused of working to disguise the origin of the funds, which is a separate offense and carries its own penalties under federal law.
The case also touches a wider policy discussion about how digital asset platforms should respond when they receive funds linked to fraud. Exchanges that comply with anti-money-laundering rules are expected to monitor transactions, verify customers and report suspicious activity, and investigators frequently rely on those obligations to follow stolen money after it leaves the banking system.
6. Why does this case matter for corporate security?
The case shows how artificial intelligence has changed an older category of crime known as business email compromise, in which criminals pose as executives or vendors to redirect payments. The traditional version relied on spoofed email addresses and written requests. Adding a cloned voice or a manipulated video call removes one of the most common safeguards, which is the instinct of an employee to confirm a request by speaking to the person directly.
Security specialists generally recommend procedures that do not rely on recognizing a voice or a face. These include requiring a second approver for large wire transfers, confirming payment instructions through a separate channel using contact details already on file, introducing waiting periods for unusual transfers, and training finance staff to treat urgency and secrecy as warning signs rather than reasons to bypass normal process.
For companies, the allegations underscore that verification has to be built into workflows. A policy that depends on an employee deciding whether a caller sounds authentic is increasingly fragile as synthetic media improves. A policy that makes certain actions impossible without independent confirmation holds up regardless of how convincing a caller seems.
Insurers and auditors are paying closer attention as well. Many corporate insurance policies distinguish between losses caused by hacking and losses caused by an employee voluntarily sending a payment after being deceived, and disputes over coverage have followed earlier impersonation frauds. Companies are therefore being encouraged to review both their internal controls and the terms of their coverage, since a payment authorized by a deceived employee may not be treated like a theft carried out through a breach of the company's systems.
There is also a human dimension. The employees who authorize such transfers are often acting in good faith and under pressure, and organizations that respond to these incidents by blaming individual staff risk discouraging the prompt reporting that gives banks the best chance of freezing funds. Security teams generally advise building a culture in which questioning an unusual request from a senior executive is expected and rewarded.
7. What happens next?
The next developments will come through the extradition proceedings in Spain and the United Kingdom, where each defendant can challenge the U.S. requests. If the men are brought to New York, they would face arraignment in the Southern District of New York, where they would enter pleas to the charges. No trial date has been reported.
Observers will also watch whether prosecutors identify further participants or additional victims, and whether recovered funds are returned to the affected companies. In the meantime, the case is likely to be cited by regulators, insurers and corporate security teams as an example of how AI-enabled impersonation is moving from a theoretical risk to a documented source of large-scale losses.