Three charged in US over alleged $129 million executive impersonation fraud and laundering
Federal prosecutors in Manhattan unsealed an indictment charging three foreign nationals with wire fraud and money laundering over a scheme that allegedly impersonated company chief executives and law firm lawyers to trick employees into wiring money. Prosecutors say more than $129 million was stolen and converted into cryptocurrency.
The U.S. Attorney's Office for the Southern District of New York (SDNY) announced on 5 November 2026 the unsealing of an indictment against Jacob Soall, 41, of Marbella, Spain, and the United Kingdom; Sharon Hazan, 54, of Israel; and Guy Sheetrit, 42, of Israel and the United Arab Emirates. Prosecutors allege the three took part in a scheme that used technology that prosecutors call super intelligence (SI) to defraud companies around the world. According to the release, the scheme allegedly stole more than $129 million.
According to the indictment, between 2024 and 2026 the defendants and their co-conspirators used SI to imitate the voices and/or images of chief executives at victim companies and of attorneys at major law firms. A caller posing as the chief executive would tell an employee that help was needed with a confidential financial transaction. The employee was then directed to lawyers said to be working on the transaction, whom the conspirators also impersonated. A co-conspirator posing as one of those lawyers then told the employee to wire a large sum to a bank account that was in fact controlled by members of the conspiracy. The release lists losses including $11,578,474 from a financial technology company headquartered in the United Kingdom, $5,242,747 from a pet food company headquartered in Florida, $4,829,580 from a hospital system headquartered in Missouri, $4,639,918 from a mutual fund company headquartered in Massachusetts, $2,968,497 from a hospital system headquartered in California and $2,684,580 from a bank headquartered in Rhode Island.
Prosecutors say victims were told to wire money to accounts controlled by conspirators in countries including the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China. Once the money arrived, the defendants and their co-conspirators allegedly converted it into cryptocurrency to conceal the source, ownership and control of the stolen funds, and shared it among themselves. According to the release, Soall mainly impersonated attorneys from the United Kingdom, while Hazan and Sheetrit are alleged to have laundered funds from the scheme.
Each defendant is charged with conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy and two counts of money laundering. The release lists a maximum sentence of 20 years for each fraud and money laundering count and two years for each aggravated identity theft count. Soall was arrested in Spain on 17 June 2026, Hazan in Spain on 5 August 2026 and Sheetrit in the United Kingdom on 7 September 2026, and extradition requests for all three are pending. The release says the charges are accusations and the defendants are presumed innocent unless proven guilty. The FBI's New York Field Office investigated the case.
Why it matters to AML professionals
Executive impersonation fraud is moving from spoofed emails to faked voices and video, which makes a payment instruction harder to doubt. Payment and treasury teams are the first line of defence, but AML professionals at the receiving banks see the other side: large, one-off incoming wires that are quickly converted to crypto or sent abroad. Spotting that pattern early can stop funds before they are layered.
Red flags in this case
- A large incoming wire to a recently opened business account with little prior activity, followed within days by transfers to a crypto exchange
- Funds received from a hospital, fund manager or other corporate payer that has no visible business link to the account holder
- Payment instructions described as urgent and confidential, sometimes linked to an unannounced deal, that skip normal approval steps
- Rapid onward transfers of received funds to accounts in several different countries
If this landed in your queue
- Check whether the incoming wire matches the customer's stated business and expected activity, and request supporting documents such as an invoice or contract
- Look for recall requests or fraud notices from the sending bank, and contact the sending institution if the payment looks unusual
- Trace where the funds went next, including transfers to crypto exchanges or overseas accounts, and consider a hold if your procedures allow it
- File a suspicious activity report describing the inbound payer, the speed of onward movement and any crypto conversion
Key terms
- Business email compromise (BEC) and CEO fraud
- Scams in which criminals pose as a senior executive or trusted adviser to trick staff into sending money.
- Voice and image impersonation
- Using technology to copy how a real person sounds or looks, for example on a phone or video call, so that a fake instruction seems to come from them.
- Layering
- The stage of money laundering where funds are moved through many transactions or assets, such as crypto, to hide where they came from.
Interview angle
An account receives a $4 million wire from a hospital system and sends most of it to a crypto exchange two days later. What do you do?
Explain that you would compare the activity to the customer profile, look for a recall or fraud notice from the sending bank, trace the onward transfers, consider escalation or a hold under your procedures, and file a SAR describing executive impersonation fraud as a possible source.
Sources
Go deeper on AMLift
Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.
Report an error
Every report is checked against the official source. If we got something wrong, the story is corrected.