{"schema":"sanctity-signal/0.2","record_type":"signal","id":"doj-si-ceo-fraud-129m-e079","domain":"security","drop_id":"signal-e079","occurred_at":"2026-11-05","how_to_use":"This is a structured record of one real-world action and its competing interpretations, from Sanctity Signal. To build content from it (a reel script, a blog, a thread): open on the hook, ground the viewer with plain and observed, walk the dated trail, present the interpretations as live tension between named readings, and close on the before/after shift and what_to_watch. Hard rules: items under established are fact; items under unknown are never presented as fact; the evidence status (verified or reported) is stated, not dropped; sources are cited.","actor":"US Attorney's Office for the Southern District of New York","action_type":"unsealing of a 7-count indictment charging 3 men with using AI to impersonate chief executives and lawyers to obtain fraudulent wire transfers, extradition pending","observed":"We read the primary at justice.gov: US Attorney's Office, Southern District of New York, release 26-317, November 5, 2026, page updated November 6, headed Three Foreign Nationals Arrested And Charged With Scheme To Use Super Intelligence To Defraud Companies Of $129 Million. It unseals an indictment in that district's federal court, and uses \"super intelligence\" and \"SI\" throughout and never writes artificial intelligence or AI. Defendants, with ages and residences as listed: Jacob Soall, 41, of Marbella, Spain and the United Kingdom, also known as Seba Clarke and Rocky Balboa; Sharon Hazan, 54, of Israel, also known as Superman Cash, Impossible Mission, Fat Boy and Ron; Guy Sheetrit, 42, of Israel and the United Arab Emirates. Arrests: Soall June 17, 2026 in Spain; Hazan August 5, 2026 in Spain; Sheetrit September 7, 2026 in the United Kingdom. Extradition requests for all 3 are pending. Conduct alleged: between 2024 and 2026. Each faces 7 counts: wire fraud conspiracy, 20 years; wire fraud, 20 years; 2 counts of aggravated identity theft, 2 years each; money laundering conspiracy, 20 years; 2 counts of money laundering, 20 years each. Congress sets those maximums. The scheme alleged: SI used to impersonate executives and lawyers, approaching employees first as the chief executive and then as lawyers at large international firms, to obtain wire transfers to controlled accounts, proceeds moved into cryptocurrency. Soall allegedly impersonated British lawyers from a written script; Hazan and Sheetrit allegedly laundered; Hazan allegedly boasted of laundering more than $400 million in 3 years. The headline says $129 million, the body more than $100 million. 6 victims are itemised, $31.9 million: $4,829,580, a Missouri hospital system; $2,684,580, a Rhode Island bank; $2,968,497, a California hospital system; $11,578,474, a British financial technology company; $4,639,918, a Massachusetts mutual fund company; $5,242,747, a Florida pet food company. The remainder is not itemised. Hazan was convicted here in 2008 of bank fraud conspiracy. US Attorney Jamie McDonald: \"SI technology offers tremendous potential.\" FBI Assistant Director in Charge James C. Barnacle, Jr. is quoted on criminals weaponizing emerging technologies. Credited: the FBI, Spain's Policia Nacional, Britain's National Crime Agency, the Complex Frauds and Cybercrime Unit, and Assistant US Attorneys Kevin Mead, Brandon C. Thompson and Jackie Delligatti. The charges are accusations. Not established: which models or vendors, how the voices were made, or the victim count.","corrections":[],"evidence":{"status":"verified","note":"Verified at the Justice Department's own release, number 26-317, read at justice.gov. Carded on its event date of November 5, not today: it surfaced late through weekend coverage. Editions 075 to 078 covered that date and none reached it.","sources":[{"role":"primary","label":"US Attorney, Southern District of New York, press release 26-317, Nov 5, 2026","url":"https://www.justice.gov/usao-sdny/pr/three-foreign-nationals-arrested-and-charged-scheme-use-super-intelligence-defraud"},{"role":"corrob","label":"PBS NewsHour with the Associated Press: 3 charged in the $129 million scheme, Nov 6, 2026","url":"https://www.pbs.org/newshour/nation/3-charged-in-129-million-ai-scheme-targeting-thousands-of-companies"},{"role":"corrob","label":"Quartz: Three charged with using AI to impersonate CEOs, steal about $129M","url":"https://qz.com/ai-impersonation-fraud-three-charged-129-million-110626"},{"role":"corrob","label":"NBC News: 3 foreign nationals allegedly used AI to mimic CEOs in $129M scheme","url":"https://www.nbcnews.com/news/us-news/3-foreign-nationals-allegedly-used-ai-mimic-ceos-129m-scheme-doj-says-rcna607818"}]},"strength":{"cost":"High","commitment":"High","reversibility":"Low","persistence":"Year","rationale":"Cost is high: 3 arrests across 2 countries over 3 months, 3 named prosecutors, a grand jury, and the cooperation of Spain's and Britain's national police forces. That is years of investigator time, not a press release. Commitment is high because an unsealed indictment cannot be withdrawn quietly, and the government has tied its new vocabulary to a case it must prove. Reversibility is low for the same reason. Persistence is a year: the prosecution runs through 2027, but one case does not change how companies authorise payments."},"shift":{"prior":"AI voice fraud was a warning in security reports and vendor demos.","action":"We read the primary at justice.gov: US Attorney's Office, Southern District of New York, release 26-317, November 5, 2026, page updated November 6, headed Three Foreign Nationals Arrested And Charged With Scheme To Use Super Intelligence To Defraud Companies Of $129 Million. It unseals an indictment in that district's federal court, and uses \"super intelligence\" and \"SI\" throughout and never writes artificial intelligence or AI. Defendants, with ages and residences as listed: Jacob Soall, 41, of Marbella, Spain and the United Kingdom, also known as Seba Clarke and Rocky Balboa; Sharon Hazan, 54, of Israel, also known as Superman Cash, Impossible Mission, Fat Boy and Ron; Guy Sheetrit, 42, of Israel and the United Arab Emirates. Arrests: Soall June 17, 2026 in Spain; Hazan August 5, 2026 in Spain; Sheetrit September 7, 2026 in the United Kingdom. Extradition requests for all 3 are pending. Conduct alleged: between 2024 and 2026. Each faces 7 counts: wire fraud conspiracy, 20 years; wire fraud, 20 years; 2 counts of aggravated identity theft, 2 years each; money laundering conspiracy, 20 years; 2 counts of money laundering, 20 years each. Congress sets those maximums. The scheme alleged: SI used to impersonate executives and lawyers, approaching employees first as the chief executive and then as lawyers at large international firms, to obtain wire transfers to controlled accounts, proceeds moved into cryptocurrency. Soall allegedly impersonated British lawyers from a written script; Hazan and Sheetrit allegedly laundered; Hazan allegedly boasted of laundering more than $400 million in 3 years. The headline says $129 million, the body more than $100 million. 6 victims are itemised, $31.9 million: $4,829,580, a Missouri hospital system; $2,684,580, a Rhode Island bank; $2,968,497, a California hospital system; $11,578,474, a British financial technology company; $4,639,918, a Massachusetts mutual fund company; $5,242,747, a Florida pet food company. The remainder is not itemised. Hazan was convicted here in 2008 of bank fraud conspiracy. US Attorney Jamie McDonald: \"SI technology offers tremendous potential.\" FBI Assistant Director in Charge James C. Barnacle, Jr. is quoted on criminals weaponizing emerging technologies. Credited: the FBI, Spain's Policia Nacional, Britain's National Crime Agency, the Complex Frauds and Cybercrime Unit, and Assistant US Attorneys Kevin Mead, Brandon C. Thompson and Jackie Delligatti. The charges are accusations. Not established: which models or vendors, how the voices were made, or the victim count.","update":"It is a federal indictment with named victims and 9-figure losses."},"inference":{"established":["A sealed indictment was unsealed November 5 in the Southern District of New York.","The release itemises 6 victims, including 2 hospital systems and a bank.","All 3 were arrested abroad in 2026, and extradition requests are pending."],"unknown":["Guilt. These are accusations, and all 3 are presumed innocent.","The $129 million total. The release itemises about $31.9 million of losses.","Which tools were used. The release names no model, vendor or product."]},"narrative":{"hook":"Prosecutors said 3 men used AI to impersonate CEOs and lawyers, stealing $129 million.","plain":"The Southern District of New York unsealed an indictment on November 5 charging 7 counts each. Caveat: the release never writes AI, saying super intelligence and SI throughout.","story":["The victims are ordinary institutions, not technology firms: 2 hospital systems, a bank, a mutual fund company and a pet food company. The method was a phone call from a voice employees knew. Every company that approves payments by voice is now on notice, and so is its insurer."],"trail":[{"d":"OCT 9","t":"The White House Super Intelligence Force tells every AI company that reporting security incidents is no longer optional. Edition 046. The vocabulary this release uses was set by executive order."},{"d":"OCT 26","t":"Seoul police announce 7 arrests over AI-assisted hacking of 90 organizations and 8.2 million records. Edition 063. That case is intrusion; this one is persuasion, and the targets are finance staff."},{"d":"NOV 5","t":"The Education Department proposes striking artificial intelligence from its grant rules and writing Super Intelligence. Edition 075. The same day, a criminal indictment arrives written entirely in that vocabulary."},{"d":"NOV 5","t":"The Southern District of New York unseals the 7-count indictment and names 6 victims. The arrests had already happened in Spain and the United Kingdom between June 17 and September 7, 2026."},{"d":"NOV 6","t":"The Associated Press reports the case, adding that the scheme mimicked the voice and sometimes the image of chief executives on phone and video calls. That detail is not in the release."},{"d":"Reacts","r":true,"t":"The named victim sectors, 2 hospital systems, a bank, a mutual fund company and a pet food company, and every finance team that approves wires by voice; Spanish and British authorities holding the defendants while extradition runs; commercial crime insurers writing social engineering cover; bank fraud teams; and boards with no out of band payment check."}],"glossary":[{"term":"Super intelligence","def":"The United States government's official term for AI since a September 2026 executive order directed agencies to write it instead."},{"term":"Aggravated identity theft","def":"Using a real person's identity while committing another felony. It adds a mandatory sentence on top of the underlying crime."},{"term":"Unsealing an indictment","def":"Making public a grand jury charge filed in secret, usually once defendants are held. It is an accusation, not a finding of guilt."},{"term":"Business email compromise","def":"Fraud in which an attacker poses as a trusted executive or supplier to redirect a payment."}]},"judgment":{"prompt":"Which explanation do you believe?","interpretations":[{"id":"a","label":"AI fraud reached industrial scale","text":"A years-long scheme with 9-figure alleged losses and 6 named victims.","abstain":false},{"id":"b","label":"Old fraud with a new tool","text":"Wire fraud and laundering charges. One defendant was convicted in 2008.","abstain":false},{"id":"c","label":"A deliberate federal signal","text":"A long investigation announced in the government's new official vocabulary.","abstain":false},{"id":"d","label":"Routine cross-border fraud policing","text":"Arrests in Spain and Britain, extradition pending. This is normal casework.","abstain":false},{"id":"e","label":"Too early to call.","text":"The evidence cannot yet separate these.","abstain":true}],"distribution":{"status":"held back until you have made your call","calls":null}},"story_thread":null,"what_to_watch":[{"linked_interpretation":"a","direction":"strengthens","observable_event":"A second United States federal indictment alleging AI-assisted impersonation losses above $50 million is unsealed, by June 30, 2027.","window_end":"2027-06-30","state":"unresolved"},{"linked_interpretation":"a","direction":"weakens","observable_event":"The itemised loss figure in a superseding indictment, plea or verdict falls below $50 million, or the case is dismissed, by December 31, 2027.","window_end":"2027-12-31","state":"unresolved"},{"linked_interpretation":"c","direction":"strengthens","observable_event":"A federal banking or securities regulator issues guidance requiring out of band verification of payment instructions, citing AI impersonation, by December 31, 2027.","window_end":"2027-12-31","state":"unresolved"}]}