AI Voice Cloning Scam Tricks Italian Bank Into Transferring €95 Million
An AI-powered social engineering campaign convinced Fideuram, the private banking arm of Intesa Sanpaolo, to transfer approximately €95 million overseas. Attackers impersonated a senior executive through WhatsApp, used AI to clone the voice of a lawyer and supplied forged documents to make the request appear legitimate. More than half of the money was recovered, while roughly €36 million remained untraced.
One of the most significant AI-enabled financial fraud cases reported in 2026 demonstrates that attackers do not need to breach a banking system to cause losses worth more than $100 million.
How did attackers use AI to build trust?
The operation did not rely on a single fake message.
Instead, the attackers created several layers of false confirmation designed to make the transaction appear legitimate.
The first layer was a WhatsApp message impersonating the CEO.
The request was presented as an urgent and confidential transaction involving the wider banking group.
A second layer came through a phone call from someone claiming to be Paolo Nastasi, managing partner of international law firm A&O Shearman in Italy.
The lawyer’s voice was AI voice cloning scam. This additional verification was especially effective because the victim was no longer relying on one communication channel.
But when a recognizable “lawyer” appeared to confirm the transaction and legal documents were provided afterward, the overall story became significantly more convincing.
The attackers also supplied documents including confidentiality agreements and authorizations containing forged signatures.
Individually, each element may not have been enough. Together, however, they created a highly persuasive chain of false validation:
Fake CEO message + cloned lawyer voice + forged documents + urgency + confidentiality
€95 million was transferred in only a few days
Between February 23 and 25, 2026, approximately €95 million was transferred from Fideuram through multiple transactions.
Much of the money was sent to accounts in China and Hong Kong, with some payments routed through intermediary accounts in Portugal.
After the unusual transactions were discovered, the bank worked with authorities and financial institutions in several countries to freeze and recover funds.
Approximately €53 million was recovered through cooperation involving authorities in Italy, China and Portugal.
However, around €36 million remained untraced after funds moved through multiple accounts and some of the money was converted into cryptocurrency.
Prosecutors in Milan have continued investigating the case.
Was this a bank hack?
No, this is one of the most important distinctions in the incident.
There is no public evidence showing that attackers:
breached core banking systems;
compromised payment infrastructure;
exploited software vulnerabilities;
stole administrative access;
or took control of the bank’s internal network.
Instead, they convinced an authorized person to approve the transfers voluntarily.
This makes the incident a form of AI-enhanced social engineering.
The attack has similarities to Business Email Compromise, or BEC, in which criminals impersonate executives, suppliers or business partners to convince employees to transfer money.
As a result, hearing the “right voice” or seeing the “right name” is no longer sufficient proof that a request is genuine.
Why does AI voice cloning scam make social engineering more dangerous?
In the past, executive impersonation over the phone had an obvious weakness: the attacker’s voice often sounded wrong.
AI is reducing that barrier.
With enough audio samples from:
interviews;
podcasts;
conferences;
webinars;
video calls;
social media;
voice cloning systems can generate speech that resembles the target closely enough to deceive a listener.
For CEOs, CFOs, board members and other executives who frequently appear in public, large amounts of usable voice data may already be available online.
Even if someone looks and sounds like an executive during a call, that should not be enough to bypass independent financial controls.
How could a senior banking executive still become a victim?
A common misconception is that phishing and social engineering only succeed when victims lack technical awareness.
In reality, sophisticated fraud often exploits psychological and organizational pressure.
In this case, the request was presented as a sensitive corporate transaction and appeared to be confirmed by a lawyer.
Deepfakes are changing executive impersonation attacks
AI-generated voice does not create an entirely new form of crime. Instead, it makes existing fraud techniques more convincing.
Before generative AI, attackers already used:
CEO fraud;
Business Email Compromise;
fake invoices;
supplier impersonation;
fake legal requests;
account takeover.
A modern fraud chain might now look like:
Email from CFO → WhatsApp from CEO → cloned voice call → deepfake video meeting → forged documents → payment request
If each verification step is performed using information supplied within the attacker-controlled scenario, a company may believe it has completed multiple checks while still remaining entirely inside the fraud.
How should businesses verify financial transactions?
For high-value transactions, businesses should not rely on voice, video or messaging alone to confirm identity.
Controls should be formalized into the process.
1. Verify through an independent channel
If a payment request arrives through WhatsApp, do not call back using a new number provided in the same message.
Instead, use:
a previously verified phone number;
an internal communication platform;
the corporate directory;
or in-person confirmation for especially sensitive transactions.
2. Apply dual approval
Transactions above a defined threshold should not be completed by a single approver.
A stronger model is:
Requester → Independent verifier → Final approver
3. Do not bypass controls because a request is confidential
The more urgent or secret a request appears, the stronger verification should become.
Organizations should avoid informal exceptions such as:
“The CEO requested it, so no further confirmation is needed.”
4. Establish pre-agreed verification mechanisms
For exceptional transactions, businesses can use an out-of-band verification process agreed in advance.
The verification method should not be contained in public documents or easily accessible communications.
5. Flag changes in payment details
Businesses should treat the following as high-risk events:
a new bank account;
a new destination country;
a new business partner;
an unusual payment method;
a transaction outside normal patterns.
These changes should automatically trigger additional verification.
IPSIP Vietnam solutions for businesses facing AI deepfake fraud
For this type of attack, security technology alone cannot solve the entire problem because systems may be functioning normally while an authorized user approves a fraudulent payment.
The most relevant defense is therefore to combine social engineering awareness with stronger transaction verification procedures.
Social Engineering awareness and simulation
IPSIP Vietnam’s Cybersecurity Training and Consulting Services can help organizations build role-specific awareness programs, particularly for:
executives;
finance teams;
accounting departments;
human resources;
procurement teams;
employees authorized to approve payments.
Training should go beyond traditional email phishing.
Realistic simulations can include:
a cloned CEO voice requesting an urgent transfer;
deepfake video calls;
fake suppliers requesting bank account changes;
impersonated lawyers or advisors;
confidential payment requests designed to discourage independent verification.
The objective is not to make employees experts at spotting deepfakes by sight or sound.
A stronger objective is to build the habit that:
No matter how realistic the voice or video appears, high-risk transactions must still pass through an independent verification process.
Continuous Monitoring When Account Compromise Is Suspected
If an organization suspects that executive impersonation is combined with compromised email, cloud accounts or endpoints, IPSIP Vietnam's SOC 24/7 can provide an additional layer of monitoring, alert validation and investigation support.
However, in a primarily social-engineering-driven incident such as the Fideuram case, training, simulation and transaction controls remain the most important defensive measures.
AI Deepfake Fraud Prevention Checklist
Do not approve transactions based on voice alone.
Do not treat a video call as definitive proof of identity.
Require dual approval for high-value payments.
Verify sensitive requests through an independent channel.
Do not use a new phone number supplied in a suspicious request.
Flag changes to beneficiary bank accounts.
Do not bypass procedures because a request is urgent or confidential.
Provide specialized training for executives and finance teams.
Run simulations involving AI voice cloning and executive impersonation.
Maintain a rapid procedure for freezing transfers and contacting banks when fraud is suspected.
IPSIP Vietnam's expert perspective: is this a technology failure or a process failure?
In the deepfake era, identity verification cannot depend on whether someone looks, sounds or writes like an executive. Financial approval processes need multiple independent controls that an attacker cannot easily impersonate at the same time.
The Fideuram incident shows that a company can suffer major financial losses even when no system has been breached.
AI is changing long-standing assumptions about identity verification. A call that sounds like the CEO, a video that looks authentic or a document containing a familiar signature can no longer be treated as sufficient proof that a request is legitimate.
The goal should not be to train every employee to become a deepfake detection expert.
A stronger approach is to build processes where even a highly convincing deepfake cannot independently bypass all verification and payment approval controls.
References
