Short answer: On 5 November 2026 the US Attorney’s Office for the Southern District of New York announced an unsealed indictment against Jacob Soall, Sharon Hazan and Guy Sheetrit. It alleges that between 2024 and 2026 they and co-conspirators used AI to mimic the voices or images of corporate executives, and then of attorneys at major law firms, to persuade employees to wire large sums, more than US$129 million in all. These are allegations, and extradition requests are pending. The practical lesson is about records: keep a dated copy of each payment instruction as received, a log of how the request was verified and by whom, and the contact details you hold for your lawyers and executives from before the request. A TimeBind dates the files you hold. It does not tell you whether a voice or a call is real.
Last checked 13 November 2026. General information for finance teams, firm administrators and lawyers, not legal advice. The charges are accusations. The defendants are presumed innocent unless and until proven guilty, as the release says, and every fact below that comes from the indictment is an allegation.
Table of Contents
What the release says
The Justice Department release, dated 5 November 2026, says the indictment was unsealed and charges the three men with seven counts each: conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, a money laundering conspiracy and two counts of money laundering. It says Soall was arrested in Spain on 17 June 2026, Hazan in Spain on 5 August 2026 and Sheetrit in the United Kingdom on 7 September 2026, and that extradition requests are pending.
According to the indictment as described in the release, the scheme typically began with a call to an employee from someone pretending to be the company’s chief executive, using AI to mimic the executive’s voice or image, about a confidential financial transaction. The employee was then pointed to supposed lawyers at large international law firms, who were also impersonated, and one of them directed the employee to wire money to an account the conspirators controlled. The release lists six victim companies, including two hospital systems, a bank, a UK fintech, a mutual fund company and a pet food company, with amounts from about US$2.7 million to about US$11.6 million. It also says one defendant kept a handwritten script titled “Lawyer Call.” The release uses the term “super intelligence” for the technology.
Everything in this section is the prosecutors’ account of what the indictment alleges. We have not read the indictment itself, and none of it has been tested in court.
Why this matters to finance teams and law firms
The allegation has two features that make it different from a plain fake-CEO email. First, it is described as voice or image impersonation of executives. Second, it adds an apparently independent second person, a lawyer, which gives the instruction a second layer of credibility. For a law firm, the practical point is that your name and your partners’ identities can be used to lend that credibility, without your firm ever being contacted.
For finance teams the usual controls still apply, and they are about process rather than about spotting a fake voice: agree in advance how payment changes and one-off confidential payments are confirmed, and confirm through a channel you already hold, not one the requester gives you. The records below make it possible to show afterwards what was asked, by whom, and what was done.
Why people are searching for this
Measured on 13 November 2026. The SDNY post announcing the charges (5 November) had 8,008 impressions and 81 likes. A post by @DarkWebInformer on 6 November summarising the case had 10,103 impressions and 45 likes. @Newsforce’s post the same day had 4,288 impressions. X’s trending summary, updated 6 November, described the case as a $129 million AI impersonation fraud. Larger posts about the case exist, and some framed it around the defendants’ nationality, which we did not use as demand. Counts keep moving.
Checklist for finance teams, firm administrators and lawyers
- Keep each payment instruction as received. Save the email, message or call note with its time, and keep the original file separate from any edited copy.
- Keep a verification log. For every new or changed payment instruction, record who called, which number or channel was used, who confirmed it, through which pre-agreed channel, and when.
- Hold known-good contact details from before the request. Keep a dated list of the numbers and addresses you hold for executives and outside counsel, and use only those to confirm.
- Write the rule for confidential transactions. Have a written policy that no confidential wire is made on a single call, and keep the policy as it read on the day.
- Record who knew. If an employee is told to keep a transaction confidential, note who they told and when, and keep the messages.
- For law firms, publish a verification route. Tell clients in writing how your firm will and will not communicate payment details, and keep a dated copy of that notice.
- Preserve call evidence promptly. If something goes wrong, keep call logs, recordings where lawful, bank confirmations and the full email headers, and tell your bank and the authorities quickly.
- Date your records before a dispute. Fingerprint the saved instruction, the log and the policy so you can show later what existed and when.
What a TimeBind does and does not show
A TimeBind is a dated, checkable record that an exact file existed no later than a recorded time and still matches. The SHA-256 fingerprint is made in your browser and the file is never uploaded. The record is anchored to Bitcoin (a Merkle root in an OP_RETURN). Your first Pooled TimeBind is free; after that, TimeBinds start from US$5, and an ASAP TimeBind is US$15. See how it works.
For a payment dispute, it can date a saved instruction, a verification log and a written policy. It does not show that a call or voice was real or fake, does not detect AI impersonation, does not recover money, and does not decide who bears a loss. Use it as one dated record next to your bank’s records and your own procedures.
Limits
This page relies on the Justice Department release and on posts on X. We have not read the indictment, we cannot verify any allegation, and we cannot say how the voices or images were produced. The defendants are presumed innocent. Nothing here is advice on payment controls, banking, insurance or criminal law, and each organisation’s duties depend on its jurisdiction and contracts.
Tools that can help
Use the bulk SHA-256 manifest to fingerprint a folder of saved instructions and logs, and the file date metadata inspector to see what dates a file carries. For related reading see a law-firm voice-clone payment instruction case, what lawyers and clients should preserve about voice cloning and a revised wire instruction that nearly went out.
Frequently Asked Questions
-
What did prosecutors allege in the US$129 million AI-impersonation case?
That three men and co-conspirators used AI to mimic executives and then lawyers to persuade employees to wire large sums, with more than US$129 million stolen from companies worldwide. These are allegations, and the defendants are presumed innocent.
-
Has anyone been convicted?
Not as far as we found. The release says the three men were arrested in Spain and the United Kingdom and that extradition requests are pending.
-
How can a company reduce the risk of a fake-executive call?
Agree in advance how payment changes and confidential payments are confirmed, use contact details you already hold, and avoid acting on a single call. These are general controls, not guarantees.
-
Can a TimeBind show a voice or call was fake?
No. It shows that exact files existed no later than a recorded time and still match. It does not detect AI voices or verify callers.
-
What should a law firm keep to protect against impersonation?
A dated written notice to clients on how payment details are and are not communicated, and records of any request made in the firm’s name that it reports to a bank or the authorities.
Sources checked
- U.S. Attorney’s Office, Southern District of New York, “Three Foreign Nationals Arrested And Charged With Scheme To Use Super Intelligence To Defraud Companies Of $129 Million,” 5 November 2026, https://www.justice.gov/index.php/usao-sdny/pr/three-foreign-nationals-arrested-and-charged-scheme-use-super-intelligence-defraud (read 13 November 2026)
- X posts by @SDNYnews (5 November 2026), @DarkWebInformer (6 November 2026) and @Newsforce (6 November 2026), read 13 November 2026
- X trending summary, “Three Foreign Nationals Indicted for $129 Million AI Impersonation Fraud,” updated 6 November 2026 (read 13 November 2026)
Date your saved instructions, verification log and payment policy
Your first Pooled TimeBind is free, with no credit card required. After that, TimeBinds start from US$5, and an ASAP TimeBind is US$15. Click here to start, or see plans and pricing.
