DOJ Charges Trio in $130M AI Voice Cloning Fraud Targeting Corporate Payments

What Happened

Between July 2024 and February 2026, Jacob Soall, Sharon Hazan, and Guy Sheetrit allegedly ran a coordinated impersonation operation targeting finance and operations staff at companies across multiple industries and countries.

The method was deliberate and layered. The trio would contact an employee, claim a confidential financial transaction was underway, and use AI to replicate the voice—and in some cases the image—of the company’s CEO during calls. They then directed the employee to coordinate with attorneys at large international law firms, whom they also impersonated, creating a second layer of apparent legitimacy.

The employee, believing both the executive and the legal counsel were real and aligned, would ultimately wire a large sum to a bank account controlled by the conspirators.

The Scale of the Damage

The indictment names specific victims across sectors:

• A Missouri hospital system: $4.8 million
• A Rhode Island bank: $2.7 million
• A California hospital system: $3 million
• A UK fintech company: $11.6 million
• A Massachusetts mutual fund company: $4.6 million
• A Florida pet food company: $5.2 million

Total losses across all victims exceeded $129 million. The breadth of targets—healthcare, financial services, fintech, consumer goods—signals that no single industry profile was being pursued. Any organization with a wire transfer process and a recognizable executive was a potential target.

The Arrests

All three suspects are foreign nationals arrested in Europe and currently awaiting extradition to the United States.

• Jacob Soall, 41, of Marbella, Spain and the UK, was arrested in Spain in June.
• Sharon Hazan, 54, of Israel, was arrested in Spain in August. Hazan was previously convicted in Manhattan federal court of conspiracy to commit bank fraud in 2008.
• Guy Sheetrit, 42, of Israel and the UAE, was arrested in the UK in September.

They face charges including conspiracy and money laundering, each carrying a maximum sentence of up to 20 years in federal prison.

Why This Case Matters for Enterprise Security

This indictment is a concrete illustration of how AI voice cloning has moved from a theoretical threat to an operational fraud tool. The scheme did not rely on technical exploits or system breaches. It exploited human trust, institutional hierarchy, and the assumption that a CEO’s voice is a reliable authentication signal.

The attack pattern—executive impersonation followed by attorney impersonation—is a deliberate escalation of the classic business email compromise (BEC) playbook. Where BEC relies on spoofed email addresses and written social engineering, this scheme added synthesized audio and video to make the deception significantly harder to detect in real time.

U.S. Attorney Jamie McDonald noted that AI “offers tremendous potential” but warned that “there are some who seek to use this emerging technology to pursue criminal goals.” The case also reflects broader concerns about how AI is changing cybersecurity in real time.

What Organizations Should Take Away

The practical implication is straightforward: voice alone is no longer a reliable verification method for authorizing financial transactions.

Organizations that have not yet implemented out-of-band verification protocols for wire transfers—meaning a separate, pre-established channel to confirm large payment requests—are operating with a meaningful gap in their controls. A callback to a known, independently verified number, rather than one provided in the request itself, is a basic countermeasure that this scheme would have struggled to bypass.

Training finance and operations staff to recognize the specific pattern used here—urgency, confidentiality framing, multi-party coordination pressure—is equally important. The social engineering layer is often what makes the technical deception effective.

As AI voice synthesis tools become more accessible and more convincing, the cost of running this type of attack decreases. The DOJ case establishes a legal precedent, but the defensive work falls on individual organizations before the call is ever made.