# Three Arrested for AI-Enhanced Corporate Impersonation Fraud

Suspects used synthetic media to steal 129 million dollars from global firms.

- **Source:** [Schneier on Security](https://brifing.si/source/7aee9996-c7c0-47f7-89ec-66a1ed95f8cc)
- **Published:** 2026-11-11
- **Topic:** [technology](https://brifing.si/c/technology)
- **Original article:** <https://www.schneier.com/blog/archives/2026/11/three-people-arrested-for-ai-enhanced-impersonation-fraud.html>
- **On Brifing:** https://brifing.si/s/af0b6b1a-6fad-4e77-922a-df11be216df4

## Global Fraud Operation Exposed

Authorities in the United States have apprehended three individuals involved in a sophisticated impersonation scheme. Jacob Soall, Sharon Hazan, and Guy Sheetrit allegedly utilized artificial intelligence to mimic corporate executives and legal professionals. This criminal operation successfully targeted employees across various international companies, resulting in the theft of over 129 million dollars.

## Arrests Across International Borders

The legal crackdown spanned multiple continents to capture the suspects involved in this complex fraud. Soall and Hazan were taken into custody in Spain during the summer months. Meanwhile, Guy Sheetrit was arrested in the United Kingdom this past September. These coordinated efforts highlight the cross-border nature of modern digital financial crimes.

## Deceptive Social Engineering Tactics

The perpetrators employed AI tools to alter voices and images, creating highly convincing digital personas. By impersonating high-level executives, they pressured employees to assist with sensitive financial transactions. The scheme relied on manipulating internal staff into believing they were communicating with legitimate leadership figures regarding urgent and confidential corporate business matters.

## Multi-Stage Impersonation Workflow

The fraud followed a structured, multi-stage process designed to bypass standard corporate verification protocols. After initial contact as an executive, the suspects directed employees to consult with specific lawyers at international firms. The scammers then impersonated those legal professionals to finalize the wire transfers, effectively closing the loop on their deceptive financial scheme.

## Timeline of Criminal Activity

The illicit activities occurred over a two-year period, spanning from 2024 through 2026. During this timeframe, the group successfully exploited vulnerabilities in corporate communication channels to siphon funds globally. The sustained nature of these attacks suggests a persistent effort to refine their AI-driven impersonation techniques against unsuspecting corporate targets worldwide.

## Financial Impact and Scale

The total financial damage caused by this operation exceeded 129 million dollars. These funds were extracted from companies located in the United States and other international jurisdictions. The scale of the theft underscores the growing threat posed by synthetic media when applied to high-stakes corporate finance and internal authorization processes.

## Security Framework Against AI

Experts emphasize that AI security involves three distinct pillars: security of AI, security with AI, and security from AI. This specific case represents the third pillar, which focuses on defending against malicious applications of synthetic technology. Organizations must implement robust verification protocols to protect themselves from increasingly sophisticated AI-powered social engineering attacks.

## Future Implications for Businesses

This case serves as a critical warning for organizations regarding the evolving landscape of digital threats. As AI tools become more accessible, the barrier to entry for complex impersonation fraud continues to drop. Companies must prioritize employee training and multi-factor authentication to prevent similar financial losses in the future global economy.

## Sources covering this story

- https://www.schneier.com/blog/archives/2026/11/three-people-arrested-for-ai-enhanced-impersonation-fraud.html — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._
