---
type: "post"
id: "three-foreign-nationals-arrested-and-charged-with-scheme-42a724"
slug: "three-foreign-nationals-arrested-and-charged-with-scheme-42a724"
title: "Three Foreign Nationals Arrested And Charged With Scheme To Use Super Intelligence To Defraud Companies Of $129 Million"
description: "Summary The U.S. Attorney’s Office for the Southern District of New York says three people were charged in an alleged scheme that used synthetic voices or images to impersonate corporate executives and lawyers inducing employees to wire more than 129"
retrieval_nugget: "Summary The U.S. Attorney’s Office for the Southern District of New York says three people were charged in an alleged scheme that used synthetic voices or images to impersonate corporate executives and lawyers inducing employees to wire more than 129"
published_at: "2026-11-12"
updated_at: "2026-11-12"
record_date: "2026-11-12"
date_kind: "published_at"
topics: ["ai-security","generative-media","security"]
entities: ["U.S. Department of Justice","Southern District of New York","Jacob Soall","Sharon Hazan","Guy Sheetrit"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: null
prior_refs: []
source_url: "https://www.justice.gov/usao-sdny/pr/three-foreign-nationals-arrested-and-charged-scheme-use-super-intelligence-defraud"
source_urls: ["https://www.justice.gov/usao-sdny/pr/three-foreign-nationals-arrested-and-charged-scheme-use-super-intelligence-defraud"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:three-foreign-nationals-arrested-and-charged-with-scheme-42a724"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/three-foreign-nationals-arrested-and-charged-with-scheme-42a724/","markdown":"https://newruntime.com/posts/three-foreign-nationals-arrested-and-charged-with-scheme-42a724.md","json":"https://newruntime.com/posts/three-foreign-nationals-arrested-and-charged-with-scheme-42a724.json"}
markdown_url: "https://newruntime.com/posts/three-foreign-nationals-arrested-and-charged-with-scheme-42a724.md"
---

# Three Foreign Nationals Arrested And Charged With Scheme To Use Super Intelligence To Defraud Companies Of $129 Million

## Retrieval answer

Summary The U.S. Attorney’s Office for the Southern District of New York says three people were charged in an alleged scheme that used synthetic voices or images to impersonate corporate executives and lawyers inducing employees to wire more than 129

## Summary
The U.S. Attorney’s Office for the Southern District of New York says three people were charged in an alleged scheme that used synthetic voices or images to impersonate corporate executives and lawyers, inducing employees to wire more than $129 million. For teams building AI-enabled workflows, the case makes identity verification and payment authorization part of the threat model, not merely model-safety concerns.

## What happened
The Southern District of New York announced on November 5, 2026, that an indictment had been unsealed against Jacob Soall, Sharon Hazan and Guy Sheetrit. Prosecutors allege that between 2024 and 2026, the three and their co-conspirators used what the release calls “super intelligence” to impersonate the voices and/or images of executives at companies around the world and attorneys at major law firms. The defendants are presumed innocent unless and until proven guilty.

According to the indictment as summarized by the Justice Department, the operation began by targeting employees and pretending to be their company’s chief executive. The impersonator would claim to need help with a confidential financial transaction and use synthetic voice or image impersonation during calls. The employee would then be directed to contact lawyers at large international firms said to be involved in the transaction. The conspirators allegedly impersonated those lawyers as well, reinforcing the appearance that the transaction was legitimate.

A person posing as a lawyer would ultimately instruct the employee to wire a large sum to a specified bank account. Prosecutors say the accounts were controlled by members of the conspiracy. The release lists losses including $4,829,580 from a Missouri-headquartered hospital system, $2,684,580 from a Rhode Island-headquartered bank, $2,968,497 from a California-headquartered hospital system, $11,578,474 from a UK-headquartered financial technology company, $4,639,918 from a Massachusetts mutual fund company and $5,242,747 from a Florida pet food company. The total alleged loss exceeded $129 million.

The release says the money was sent to accounts in the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China, then converted into cryptocurrency in an attempt to conceal its source, ownership and control. It says Soall primarily impersonated UK attorneys and kept a handwritten script titled “Lawyer Call,” including language intended to discourage employees from discussing communications with colleagues. Hazan and Sheetrit allegedly laundered funds; the release attributes laundering claims to the indictment.

Soall was arrested in Spain on June 17, 2026; Hazan in Spain on August 5; and Sheetrit in the United Kingdom on September 7. Extradition requests are pending. Each faces charges including conspiracy to commit wire fraud, wire fraud, aggravated identity theft, money laundering conspiracy and money laundering. The release lists statutory maximum sentences of up to 20 years for several counts and two years for each identity-theft count; actual sentencing, if any, would be determined by a judge. It gives no product, model, vendor, price or technical specification for the impersonation system.

## What the archive adds
New Runtime’s earlier coverage on October 24, 2026, reported that OpenAI said it found a concealed audio-recording device in a conference room at its San Francisco office ([earlier coverage](https://newruntime.com/posts/openai-employee-arrested-for-allegedly-hiding-a-sophisticated-0d3e4f/)). That was a separate alleged incident involving recording; this indictment adds a distinct, large-scale allegation of synthetic impersonation in corporate financial workflows. It is a new event, not a development in the earlier case.

## Trend signal
This case supports the security concern behind [agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/), though it does not involve an autonomous agent. The attack described by prosecutors exploits trust at the point where identity claims trigger consequential action. A prompt-level safeguard cannot establish that a caller is a real executive or authorize a wire transfer; those controls need to sit in the communication and payment processes around the technology.

## Why it matters
The important operational lesson is that familiar voice and video are no longer reliable proof of authority. The alleged scheme paired executive impersonation with a second layer of lawyer impersonation and a plausible confidential transaction, so the defense cannot depend on employees spotting an obviously strange request. Teams should separate identity confirmation from the channel that carries the request, require a second approver for high-value payments and make exceptions auditable.

For AI builders, the same principle applies wherever an assistant can cause external actions. A system that can draft or initiate payment instructions needs explicit authorization boundaries, identity provenance and a review step proportionate to the impact. The indictment does not show that an AI agent made these transfers; it does show why workflows that connect generated media, human trust and financial execution deserve controls beyond content detection.

## Limits and uncertainty
The Justice Department describes allegations in an indictment, not findings after trial. The defendants’ guilt has not been established, and extradition requests were pending at the time of the release. The announcement does not identify the models, tools or service providers allegedly used, quantify how much of the scheme depended on synthetic media rather than other deception, or report how companies detected the fraud. The listed losses illustrate the alleged scale but do not establish the full set of victims or recovery amounts.

## Reader takeaway
Treat a convincing voice or image as a communication signal, not as authorization. If a request moves money or grants access, confirm the person and the transaction through a separate, established channel, and require independent approval for consequential actions.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Ai Security](https://newruntime.com/topics/ai-security.md): Explore the ai-security topic hub.
- topic hub: [Generative Media](https://newruntime.com/topics/generative-media.md): Explore the generative-media topic hub.
- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)