In February 2026, the chairman of the private banking arm of Italy’s biggest bank got a WhatsApp message from his group CEO. There was an urgent overseas transaction, the message said, and the parent bank could not handle it directly. Could he help? A call followed, from a senior lawyer confirming the deal. He recognised the voice.
About €95 million left the bank. The message was fake. The lawyer’s voice had been generated by artificial intelligence.
That is the case Reuters reported on 25 September 2026: fraudsters impersonated Carlo Messina, chief executive of Intesa Sanpaolo, Italy’s biggest bank, to move money out of Fideuram, the group’s private banking arm. I build verification tools for a living, and this is the clearest real-world example I have seen of the problem we work on. Nothing was hacked. Two trusted voices were copied, and every check the victim could run came back green.
What happened at Fideuram
According to Reuters, which cited sources familiar with the matter, the scheme began in February when Paolo Molesini, then chairman of Fideuram, received a WhatsApp message that appeared to come from Messina, asking for urgent help with an overseas transaction. A follow-up call used AI to replicate the voice of a senior partner at a prominent law firm, confirming the request.
The key facts, as reported:
- About €95 million was transferred to foreign accounts, mainly in China and Hong Kong.
- Roughly €53 million has been recovered, through cooperation between authorities in China, Portugal and Italy.
- About €36 million is still missing, after passing through a network of overseas accounts and being converted into cryptocurrency.
- Milan prosecutors are investigating a foreign national living outside Europe on suspicion of computer fraud. No Fideuram executive is under investigation.
- Molesini resigned in March, citing personal reasons. Intesa Sanpaolo and Fideuram declined to comment to Reuters.
The Italian daily il Giornale adds that the fraudsters also sent emails imitating the law firm, and that more than €40 million was recovered in China and €13 million seized in Portugal.
How the AI voice clone scam worked, step by step
Strip away the headlines and the attack is a textbook CEO fraud with one modern upgrade.
- The authority. The first message came from the most senior person in the group. A subsidiary chairman does not normally interrogate his group CEO.
- The story. An urgent, confidential overseas deal that the parent company could not execute itself. Urgency closes the window for reflection; confidentiality keeps colleagues out of the loop.
- The confirmation. This is the clever part. The fraudsters did not ask to be trusted blindly. They supplied a second, independent-looking source: a call from a senior lawyer, in a voice he recognised, backed by emails in the firm’s style. The confirmation step, the very thing that is supposed to stop fraud, was itself forged.
- The payout. Transfers to foreign accounts, then onward through more accounts and into cryptocurrency, where tracing gets hard fast.
Notice what the attackers did not need. No malware, no breached server, no stolen password. The money moved because an authorised person was persuaded that the instruction was real.
Why a senior banker fell for it
It is tempting to read a story like this and think “I would have noticed.” Almost nobody notices, and the reason is structural, not personal.
A cloned voice defeats the check most of us rely on without thinking: I know that voice. Voice cloning now needs only a short sample, and senior executives and prominent lawyers speak in public, on podcasts, at conferences and on earnings calls. Their voices are on the internet.
Italy has seen this pattern before. Last year, fraudsters used an AI copy of a government minister’s voice to ask business leaders for money, and the businessman Massimo Moratti transferred about €1 million, as Reuters also recalls. In 2024, an employee of the engineering firm Arup in Hong Kong joined a video call with what looked like his CFO and colleagues; all of them were deepfakes, and about US$25.6 million left the company (CNN; see also our overview of the Arup case).
Each case retires another kind of evidence. “It came from his number” went first. “I heard his voice” is gone. “I saw him on the video call” is going. Fideuram adds a new one: “the lawyer confirmed it.” If the attacker controls the confirmation, confirmation proves nothing.
This was not a hack, and that matters for your budget
Headlines will call it a hack. It was not, and the distinction decides where you spend money. Firewalls, endpoint security and email filtering all protect systems. This attack went around every one of them by targeting the person with payment authority, through channels that are not supposed to carry payment instructions at all: a messaging app and a phone call.
If your fraud controls assume that a payment instruction arrives through the payment system, the Fideuram case is a warning that the real instruction now arrives in a WhatsApp chat.
A verification protocol that breaks this chain
The fix is not more vigilance. Vigilance is a mood, and professionals are good at changing moods. The fix is a mechanical protocol that works the same way on a calm Tuesday and on a panicked Friday:
- Never verify on a channel the requester gave you. A call from “the lawyer” that the “CEO” set up is part of the same attack. Hang up and call back on a number from your own records.
- Independent second approver outside the chain. Large or unusual transfers need a second person who was not contacted by the requester and can say no.
- No exceptions for the group CEO. The higher the name on the request, the stricter the check. Make that a standing order from the top.
- Treat urgency plus secrecy plus new foreign accounts as a stop sign. Any one of them can be normal. All three together describe almost every case in this article.
- Hold first payments to new beneficiaries. A short hold on first-time foreign transfers costs little and would have given someone time to ask one question.
- Agree a challenge in advance. Senior people who may ever instruct payments should share a way to prove identity that a cloned voice cannot reproduce, set up in person, not over the channel being checked.
For the full checklist, including how to make refusing safe for the person on the receiving end, see our payment verification protocol against CEO fraud. The same logic protects families against cloned voices; we wrote about that in our guide to a family safe word against AI voice cloning.
If the money has already left
The Fideuram numbers carry a hopeful lesson: more than half of the money came back, because banks, prosecutors and authorities in several countries moved together. Speed is everything. Call your bank’s fraud desk immediately and ask them to recall the transfer and alert the receiving bank. Report to the police the same day. Preserve every message, call log and email header. And do not make the victim the story; people who fear blame hide mistakes, and hidden hours are exactly what recovery cannot afford.
Verifying the human, not the channel
Every control above works around one missing piece: two people on a call cannot prove to each other who they are. Inside an organisation, that is the gap Hongi Work closes, and it is available for pilots: colleagues check each other with no pairing step; each phone is set up once with a work account, and on a call each side reads a short code that only the two phones can compute, new every 30 seconds. A copied voice, however convincing, does not know the codes. A chairman who receives a message from “the group CEO” can call back on a known number and check in about ten seconds, before acting on exactly the kind of message this story began with.
Hongi does not replace dual approval or callbacks, and I will not pretend it does. It closes the specific gap they leave open: the familiar voice on the phone. Organisations can read how this extends to customers and staff on our page for organisations and our security page.
Frequently asked questions
What happened at Intesa Sanpaolo and Fideuram? In February 2026, fraudsters impersonated Intesa Sanpaolo CEO Carlo Messina in a WhatsApp message and used an AI-cloned lawyer’s voice to confirm the request. About €95 million was transferred out of Fideuram, the group’s private banking arm, Reuters reported.
How much money was recovered? Roughly €53 million has been recovered with the help of authorities in China, Portugal and Italy. About €36 million, converted into cryptocurrency, is still missing.
Was Fideuram hacked? No systems were reported as breached. It was social engineering: a fake message and an AI-generated voice persuaded an authorised person to approve the transfers.
How can a company protect itself against AI voice cloning fraud? Never confirm a request on a channel the requester provides, call back on a number from your own records, require an independent second approver, and agree a way to prove identity in advance that a cloned voice cannot copy.
Sources: Reuters, “AI messaging scam costs Italy’s top bank Intesa millions, sources say” (25 September 2026); il Giornale, “La voce clonata che ha ingannato Fideuram” (25 September 2026). Figures are as reported and may change as the investigation continues.