Fideuram €95M AI voice-clone fraud: verify every payment

Fraudsters used a spoofed WhatsApp message from a bank CEO and an AI voice clone of a law-firm partner to move about €95 million out of Fideuram, the private-banking arm of Intesa Sanpaolo. No malware. No hacked server. A message, a phone call that sounded right, and a set of convincing emails. If a bank's treasury can be talked into this, so can your bookkeeper.

What actually happened

As Reuters reported via Gulf News:

• February 2026: Fideuram's then-chairman received a WhatsApp message presented as coming from Intesa Sanpaolo CEO Carlo Messina, about an urgent, secret overseas acquisition.
• The voice: a phone call from what sounded like a senior partner at a major law firm. The voice was cloned with AI.
• The paperwork: follow-up emails styled as law-firm correspondence carried payment instructions and foreign account details.
• The money: about €95 million (roughly $108 million) went out, mainly to accounts in China and Hong Kong. More than half has been recovered. About €36 million was converted to crypto and remains untraced.
• Aftermath: the chairman resigned in March. Milan prosecutors have placed a foreign national living outside Europe under investigation for computer fraud. Intesa and Fideuram declined to comment.

Why voice-clone fraud matters for your business

Every signal was fake, and every signal was consistent. The message, the voice and the emails all agreed. That is the point. Consistency across channels the attacker controls proves nothing.

The fix is a callback, not a detector. Do not try to hear the fake. Set one rule: any new payee, changed bank details or urgent wire gets confirmed by calling a number you already had on file. Never the number in the message. Never a reply to the email.

Secrecy plus urgency is the tell. "Confidential acquisition, move fast, tell no one" is the script. Make it policy that secret payments still need a second approver.

Put the rule in the system. If you run payables through software, require dual approval on new payees and on bank-detail changes. A policy staff can skip under pressure is not a control.

Sources: Gulf News / Reuters.