US prosecutors have charged three men with running a deepfake payment fraud that allegedly took about $129m from companies worldwide, using cloned executive voices and fake UK lawyers. A UK fintech is named as the single biggest loser, and the playbook targets exactly the finance processes most British firms still rely on.
What happened
On Thursday 5 November 2026 the US Attorney’s Office for the Southern District of New York unsealed an indictment against Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42. Prosecutors allege that over roughly a year and a half the group approached thousands of businesses and persuaded staff, usually in accounts teams, to send large payments to accounts the conspirators controlled. The total alleged haul is more than $129m.
According to figures reported by IBTimes UK and ITPro, they include a Missouri hospital system (about $4.8m), a Rhode Island bank (about $2.7m), a California hospital system (about $3m), a Massachusetts mutual fund company (about $4.6m) and a Florida pet food business (about $5.2m). The largest single figure belongs to an unnamed financial technology company based in the UK, which reportedly lost around $11.6m.
IBTimes UK reports that each defendant faces seven counts, spanning wire fraud and conspiracy to commit it, aggravated identity theft, and money laundering plus a related conspiracy charge. The most serious counts carry up to 20 years. These are allegations only, and all three are presumed innocent.
Details of the defendants vary slightly between reports. The AP describes the three as coming from Spain, the UK, Israel and the United Arab Emirates, and says they were arrested between June and September. ITPro describes Soall as a UK citizen, Hazan as Israeli and Sheetrit as linked to Israel and the UAE. IBTimes UK, citing the authorities, reports that Soall was detained in Spain on 17 June, Hazan in Spain on 5 August and Sheetrit in the UK on 7 September, with extradition requests pending.
How it works
Nothing here is technically novel. The alleged scheme layered three familiar social engineering stages and used AI to make each one more believable.
First came an email that appeared to come from the target company’s chief executive, asking a member of the finance team to help with a confidential deal. Second, the group would set up a phone or video call in which, according to the indictment, AI was used to imitate the executive’s voice and sometimes their face. Prosecutors used the rather grand phrase “super intelligence technology” to describe the tooling, which in practice sounds like commercially available voice and face cloning.
The third stage is the clever one. The fake CEO would point the employee towards a lawyer at a major international law firm who was supposedly handling the transaction. That lawyer was also an impostor. Prosecutors say Soall mostly played the part of UK-based solicitors and worked from a handwritten crib sheet titled “Lawyer Call”, which included lines designed to stop the employee talking to colleagues about the payment. Once the victim was isolated, the “lawyer” supplied the bank details.
Money was reportedly routed to accounts in the US, Spain, Portugal, Greece, the UAE, Singapore, Austria, Slovakia and China, then converted to cryptocurrency to blur its origin before being shared out. ITPro reports that Hazan allegedly boasted of laundering more than $400m over three years.
Why it matters for UK organisations
There are three distinct UK threads. A British fintech is the biggest named victim. One defendant is described as a UK citizen and another was reportedly arrested here. And the fraud traded directly on the credibility of UK legal practice: a call from a UK solicitor about a confidential transaction is precisely the sort of thing a finance team is conditioned to treat as routine and discreet.
That last point deserves attention from any UK business with an overseas parent, subsidiaries abroad or a history of acquisitions. Many deal processes genuinely do involve external counsel, non-disclosure and pressure to move quickly. The attackers simply copied that shape. If your payment controls rely on the instruction “sounding right”, they will not hold.
The wider trend is clear. ITPro cites Gartner research suggesting around four in ten CISOs have seen social engineering attempts using deepfake voice calls in the past year, and 36% have seen video-based attempts. For business email compromise, cloned voices and faces remove the last cheap check many firms leaned on, which was hearing the boss say it.
Expert view
In my experience running social engineering exercises, the email is rarely what wins. What wins is the second channel. Staff are trained to be suspicious of an odd email, and they feel reassured once a voice on the phone confirms it. Deepfake audio does not need to be perfect; a slightly tired-sounding CEO on a poor line is entirely plausible at five o’clock on a Friday.
The fake solicitor step is what I would want every board to hear about. It exploits deference to professional advisers and the norm that deals are confidential. The “do not discuss this internally” instruction should be treated as a red flag in its own right, because legitimate counsel almost never needs a junior accounts clerk to keep secrets from their own finance director.
The good news is that the defences are mostly procedural and cheap. You cannot detect your way out of this with a deepfake classifier alone, and I would be wary of any vendor promising that. You beat it by making sure no single person, on the strength of any single conversation, can move a large sum to a new beneficiary.
What to do now
- Enforce out-of-band verification. Any new payee or changed bank details must be confirmed by calling a number already held on file, never one supplied in the email, call or meeting invitation.
- Require dual authorisation above a threshold. Two named approvers for high-value or first-time payments, with no exceptions for “confidential” deals.
- Agree a secrecy rule. Tell finance staff in writing that a request to keep a payment from colleagues automatically triggers escalation.
- Verify advisers independently. Check a solicitor’s identity through the firm’s main switchboard or the Solicitors Regulation Authority register, not contact details given by the caller.
- Harden email identity. Enforce DMARC at reject, flag external senders and keep phishing-resistant MFA on executive and finance mailboxes. These sit alongside the Cyber Essentials controls on secure configuration and user access, though Cyber Essentials does not cover payment process fraud itself.
- Rehearse it. Run a tabletop exercise with finance, legal and the executive assistants who handle diaries, and agree a code word or call-back routine for genuine urgent requests.
- Know how to report. If money moves, contact your bank immediately and report to Report Fraud (formerly Action Fraud); speed matters for recovery.
Bottom line
This case shows AI making old fraud more convincing rather than inventing anything new. A UK firm reportedly lost more than anyone else named, and the scam leaned on the authority of UK lawyers. The fix is not exotic: verify by a second, trusted channel, split payment authority and treat secrecy as a warning sign.
Sources
- ITPro: Three charged after impersonating CEOs and attorneys in $129 million deepfake fraud scheme
- IBTimes UK: Fake CEOs and lawyers tricked companies worldwide into sending $129M using AI voice and video impersonations, DOJ says
- Associated Press (via ClickOrlando): 3 charged in scheme to use AI to impersonate CEOs and attorneys to steal $129 million
