Scammers Posed as a Bank CEO and Cloned a Lawyer's Voice — Then Tricked a Bank Into Sending $108M

An AI-enabled impersonation scheme helped trigger $108 million (€95 million) in transfers from Fideuram, the private banking arm of Intesa Sanpaolo, after fraudsters combined a fake WhatsApp identity with a cloned voice.

The incident shows how criminals can exploit several layers of corporate communication at once, turning a seemingly familiar request into a high-value financial transaction.

The Attack Exploited Familiarity, Not Just Technology

The scheme reportedly began in February, when Fideuram chairman Paolo Molesini received a WhatsApp message that appeared to come from Intesa Sanpaolo chief executive Carlo Messina. The conversation created a sense of urgency around an overseas transaction. A subsequent call appeared to involve a senior lawyer, whose voice had been replicated using AI. Molesini then instructed the bank's finance department to make transfers to foreign accounts, primarily in China and Hong Kong.

The important vulnerability was therefore not a single deepfake tool. It was the combination of several familiar communication methods that made the request appear legitimate.

Voice Is Becoming a Weaker Financial Security Signal

For years, recognising a colleague's voice could provide an informal layer of reassurance during a sensitive conversation. Generative AI is changing that calculation. The FBI's 2025 Internet Crime Report says businesses reported more than $30 million (£22.6 million) in losses from business email compromise scams involving AI. The agency specifically warned that voice cloning can be used to impersonate executives and request wire transfers.

The Federal Trade Commission has similarly warned that cloned voices can be used to impersonate business executives and obtain money or sensitive information. That creates a practical problem for banks and other businesses: authentication procedures that rely partly on human familiarity need stronger safeguards when voices, messages, images, and identities can all be fabricated.

The €36 Million Still Missing Shows Why Recovery Speed Matters

More than half of the money transferred in the Fideuram case has reportedly been recovered, but approximately €36 million remains unrecovered. The money moved through foreign accounts, with some of the outstanding funds converted into cryptocurrency, making recovery more complicated.

That turns AI impersonation into more than a cybersecurity problem. It becomes a financial-control issue in which the speed of detection can directly affect how much money can still be traced or frozen. The case also illustrates why high-value transfers require controls that remain effective even when an instruction appears to come from someone the recipient knows.

Banks Are Being Forced to Verify the Person Behind the Voice

The emerging lesson for financial institutions is not that voice authentication is useless, but that voice alone is increasingly insufficient for high-risk transactions. The FTC has identified several possible layers of defence, including stronger authentication, real-time detection, monitoring, and procedures for evaluating suspicious interactions after they occur. For sensitive financial decisions, independent verification through a known communication channel can provide another barrier.

The scale of the wider fraud problem makes that shift increasingly relevant. The FBI recorded more than $20.8 billion (£15.7 billion) in reported internet-crime losses in 2025, while business email compromise accounted for roughly $3 billion (£2.3 billion).

AI does not need to defeat every security system to cause damage. It only needs to make a fraudulent request believable long enough for an existing business process to approve it. For banks, the emerging security question is therefore less about whether a voice sounds real and more about whether the person giving the instruction has been independently verified.