DOJ alleges AI voice and image impersonation in a $129 million corporate payment-diversion scheme

On November 5, SDNY prosecutors unsealed a superseding indictment against Jacob Soall, Sharon Hazan and Guy Sheetrit. The allegation is a corporate payment-diversion operation conducted from 2024 into 2026: callers used manipulated or AI-generated voices and images to appear to be CEOs and lawyers, instructed employees to process supposedly confidential transactions, and routed transfers to accounts connected with the alleged conspiracy. The prosecutor's phrase "super intelligence" should not be read as evidence of an autonomous or unusually advanced model. The charged behavior is synthetic identity fraud followed by human-initiated bank transfers.

The alleged second identity mattered. Someone appearing to be a company CEO supplied authority; a purported lawyer supplied a different kind of assurance and a reason to conceal or hurry the transfer. The critical effect was not producing an imitation voice. It was an employee approving a destination account without independently validating a payment request through a previously established channel. Prosecutors allege more than $129 million in aggregate transfers; the public documents do not determine recovery for every identified payment or establish a specific generator vendor. These are indictment allegations, and all defendants are presumed innocent.

The public indictment alleges a concrete pretext before the reported lawyer call. An accounting employee receives an electronic-signature message represented as coming from the company's chief executive, with a confidential transaction and nondisclosure agreement. A purported outside lawyer then provides a second, seemingly independent reason to process the payment and avoid wider consultation. The same claimed authority can therefore be reinforced across channels while the controlling instruction remains to send money to substituted beneficiary accounts. No model, generated-media artifact or phone authentication trace is publicly mapped to every alleged transfer.

For incident reconstruction, keep three questions separate: whether synthetic media was used in a particular victim conversation, who actually authorized the wire and what amount reached an account controlled by the alleged scheme. The public indictment supports an allegation of a multi-company operation; it is not a judgment of guilt or an adjudicated recovery ledger. The parallel deepfake account-recovery case concerns a different bank control boundary and must not be merged with the DOJ allegations.