Men allegedly impersonated voices and images of executives to convince employees to send large payments

Three foreign nationals were arrested and charged with using AI to allegedly impersonate corporate CEOs and attorneys to steal over $100m, according to an indictment that was newly unsealed by the US Department of Justice.

According to a press release from the United States attorney’s office for the southern district of New York, three men – Jacob Soall, Sharon Hazan, and Guy Sheetrit – were arrested for using AI to alter and impersonate the voices and images of executives and attorneys at various companies in order to convince employees to send over large payments. Soall and Hazan were arrested in Spain over the summer, while Sheetrit was arrested in the United Kingdom in September. The alleged fraud took place between 2024 and 2026.

Ukraine’s Security Service (SBU) detained two Kyiv entrepreneurs it suspects of supplying the National Guard with defective combat shirts worth more than 8.6 million hryvnias (about $190,000) and of trying to bribe an officer to accept them, the agency reported on 5 November. According to the SBU, the officer reported the offer to his superiors, and its officers caught the pair as they allegedly handed over the bribe. The agency did not name the company.

Ukraine’s army needs every supply contract to deliver as it fights Russia’s full-scale invasion, and cheating on military procurement costs it twice: in money and in gear that fails soldiers at the front. Investigators have exposed such schemes before, including one in which suspects allegedly stole state funds meant for tank armor. This time, the SBU says, the alleged scheme collapsed early because the officer the suppliers approached refused the money.

Shirts unfit for the front

In August, the company signed a contract to supply 10,000 combat shirts to the National Guard. The shirts did not meet the technical specifications and were unfit for use at the front, the SBU said. According to the agency, the suppliers also delivered an incomplete batch.

The pair then allegedly offered a bribe to an official at the National Guard’s Central Support Base to overlook the defects. He immediately told his commanders, the SBU said. Its military counterintelligence, with help from the National Guard commander, detained the suspects during the handover. They are a woman who previously founded a Kyiv military equipment maker and a man representing the company.

Searches of their workplaces, homes, and cars turned up more than 3.5 million hryvnias (about $77,000) in cash, as well as phones and documents, the agency said. Both are in custody. They have been served notices of suspicion of obstructing the lawful activity of the armed forces and of offering a bribe as a group, and face up to eight years in prison with confiscation of property.

A general in the agency’s own ranks

The arrests come as anti-corruption investigators turn on the SBU itself. On 4 November, Ukraine’s National Anti-Corruption Bureau (NABU) detained SBU Major General Serhii Duka, whom it identifies as “Akim” in wiretaps of a group accused of running scam call centers. SBU head Oleksandr Poklad said he fired two senior officials involved in the case.

Explore further

Russia is stepping up fake Ukrainian government pages as bait for recruiting agents, Ukraine’s security service says

Suspected Russian agents caught the same week

The SBU also keeps catching people reportedly working for Russia. On 6 November, it detained a man who, the agency says, blew up the car of the head of Dnipro City Council’s Left Bank administration on Russia’s orders in April 2025. The official died of his injuries in hospital. According to the SBU, the man was recruited through an acquaintance in occupied Luhansk. He allegedly watched the victim from a hidden camera on his balcony and fixed a bomb with a motion sensor under the driver’s seat, then hid in Dnipro for more than a year and a half.

A day earlier, the agency caught an unemployed woman in Sumy who, the agency says, helped Russia’s Federal Security Service (FSB) target the front-line city. She allegedly looked for border guard bases and checkpoints and sent their photos with map coordinates, moving between four homes in a week to avoid detection. According to the SBU, she found her Russian handler while looking for easy money in Telegram chats. She has been served a notice of suspicion of treason.

A few years ago, Yuriy Nazarenko sat at a desk in his grandfather’s apartment in Ukraine and, on a diet of cigarettes, Lay’s chips, and beer, painstakingly made digital copies of fake identity documents. One of his four computer screens had the messaging app Telegram open. Another displayed a scan of a passport in Photoshop filling the entire monitor.

Pixel by pixel, with rap music blaring, Nazarenko edited each part of the passport. That included the MRZ codes, the block of text printed at the bottom of identity documents; the portraits to superimpose someone else’s face into the document; and the overall dimensions and quirks of each different type of passport. Nazarenko would sometimes sit for more than 12 hours at his computer, obsessively tinkering away, with a single, high-quality fake identity document taking up to a week of work.

When someone thinks of fake IDs, maybe they imagine a spotty underage teen buying a physical counterfeit driver’s license so they can score some beer. But in the global criminal underworld, digital copies or scans of IDs are like a skeleton key. A convincing scan of an ID or utility bill, loaded with a bogus name or someone else’s identity, can unlock the ability to make bank accounts, bypass checks on cryptocurrency exchanges to buy or sell more Bitcoin, or rent a safehouse, all while keeping the criminal’s real identity hidden. The digitally altered IDs need to fool both human reviewers and automated systems that scan them for inconsistencies. Making fake IDs requires exquisite attention to detail.

All of that manual labor doesn’t really scale, Nazarenko thought to himself as he meticulously edited passport after passport. He went on to make templates of fake identity documents that sped up the process, but it was still slow. 

After many of these nights, he had an idea. He built a website to automate the process that autopopulated a fake ID with the personal data a customer wanted, rather than having him do it by hand. Then, when generative AI became mainstream a short while later, he incorporated that too.

“That gradually became OnlyFake,” Nazarenko told me.

OnlyFake, the underground website Nazarenko made, landed like a bomb in the fraud world. It allowed anyone to generate not only convincing scans of driver’s licenses or passports, but also realistic looking photos of those fake identity documents laying on a sofa, carpet, or desk, as if someone had taken the ID out of their wallet and snapped a picture of it on their phone. Needed a convincing looking photo of a California driver’s license to open a cryptocurrency account in someone else’s name? Or a British passport to incorporate a company overseas? Or a Social Security card? No problem. The results were photos of identity documents that didn’t really exist, of people who may not be real, but yet could trick the sorts of people and companies that verify documents.

With OnlyFake, you didn’t have to be a master forger like Nazarenko to make fake documents. Now, anyone could churn out fake IDs at scale, sometimes even hundreds or thousands at a time. OnlyFake threatened the entire idea of know-your-customer, or KYC, where financial institutions take steps to know who exactly are using its services. When anyone can make a photo of a fake ID for just a few dollars in Bitcoin, is anyone really who they say they are?

Nazarenko didn’t know it then, hunched over his desk, but OnlyFake would soon become so influential that it would spawn copy cats, and the FBI would eventually hunt Nazarenko and shut down some of OnlyFake’s competitors. The Department of Justice said in an announcement about Nazarenko’s guilty plea that OnlyFake made more than a million dollars selling fake IDs which cost just $15 a pop.

Now for the first time, Nazarenko, 28, free after a year in prison and living in Asia, is telling his story: how North Korean fake IT workers used his creation, how he ended up in ICE detention after serving his sentence in the U.S., and how OnlyFake unleashed a new age of AI-powered fraud. Nazarenko said he wanted to talk to me because I was the first journalist to reveal that OnlyFake existed. This article is based on interviews with Nazarenko and his lawyer, court records, and my own reporting in the online world of fraud that OnlyFake inhabited.  

“OnlyFake was the first time I saw how quickly a small internet project could turn into something global. Unfortunately, it also taught me, in a very painful way, what can happen when the scale of something grows faster than your understanding of its consequences,” Nazarenko told me.

Growing up, Nazarenko’s parents questioned whether Nazarenko would ever find a job. His father worked for the Security Service of Ukraine. Raised in a suburb outside of Odesa, Nazarenko jumped between a few different gigs. He worked as a cook, a waiter, at a supermarket, and as a cameraman at a local Ukrainian TV station.