The executive on the call said a deal had to stay confidential and sent the employee to a lawyer for the payment instructions. According to a U.S. federal indictment unsealed on November 5, the people behind both conversations were part of the same alleged fraud. Prosecutors say the scheme used AI to imitate company executives and obtained about $129 million from companies between July 2024 and February 2026.
The indictment names Jacob Soall, Sharon Hazan and Guy Sheetrit. The charges are allegations, and all three defendants are presumed innocent. The $129 million is the prosecution’s estimate for the scheme as a whole.
A request to sign set up the call
Prosecutors say the group approached employees who could authorize or execute company payments. A message delivered through an electronic-signature service appeared to come from a senior executive. It asked the employee to sign a nondisclosure agreement, or NDA, for a confidential transaction. The signature request gave the deal a document and a reason to keep the conversation within a small circle.
Illustrative wording: An email titled “Confidential deal,” displayed as coming from “Signing service,” might say: “Hi, please review the NDA for this transaction before we discuss the details.” The button might read “Review NDA.” In a redacted October 2024 example involving a New York investment bank, the email went further. It asked the employee to sign an attached NDA and call the lawyer at the number in the message to arrange a compliance call later that day. The indictment omits that phone number and does not reproduce the original interface.
The fake executive handed the employee to a fake lawyer
The next contact reinforced the premise. The indictment alleges that the group arranged calls using an AI imitation of the executive’s voice and, in some cases, an imitation of their appearance. The person on the call gave the employee a new contact: a lawyer supposedly working on the transaction. Prosecutors say someone impersonating a real lawyer at a real firm then supplied instructions to wire money to an account controlled by the group.
Each contact seemed to confirm the previous one. The employee had a document, a conversation with a familiar voice and a second person who knew about the deal. But the route to that second person came from the first caller. The contact itself was part of what needed verifying. Prosecutors describe transfers to accounts in multiple countries and say some proceeds were converted to cryptocurrency.
Verify the payment outside the conversation
For a confidential or unusual transfer, pause before creating or releasing the payment. Call the executive through an existing company directory entry and verify the matter with internal legal or finance staff. If outside counsel is involved, contact the firm through details already on file or obtained separately from its official directory. Confirm the recipient and account details through your normal approval process and require a second authorized approver. An NDA can govern who sees a deal while still allowing the company’s designated approvers to check it.
If a transfer has already gone out and fraud is suspected, contact the originating bank promptly to request a recall and preserve the email, call details and payment record. In the U.S., submit the incident to the FBI’s Internet Crime Complaint Center. See our business email compromise guide for how to recognize related payment requests.
References
- U.S. District Court, Southern District of New York. United States v. Soall, Hazan and Sheetrit, superseding indictment S3 26 Cr. 168, unsealed November 5, 2026, ¶¶ 1–6.
- FBI Internet Crime Complaint Center. Business Email Compromise. Accessed November 8, 2026.
