AI voice-cloning scam drains €95 million from Italy's biggest bank
Fraudsters used a cloned executive voice and a fake WhatsApp message to trick Intesa Sanpaolo's private bank into wiring millions overseas.
What happened: In February, Paolo Molesini, then chairman of Fideuram (Intesa Sanpaolo's private banking arm), got a WhatsApp message that looked like it came from group CEO Carlo Messina, asking for urgent help with an overseas transaction. A follow-up phone call from someone posing as a senior law firm partner backed up the request, using a voice that had been cloned with AI. Believing it was real, Molesini told the finance team to wire the money, mostly to accounts in China and Hong Kong. In total, €95 million went out before anyone caught on.
Why it matters: This is now one of the largest deepfake fraud cases on record. It shows that voice cloning has gotten cheap and convincing enough to fool people at the very top of a major bank, using nothing more than public interview or video clips. It also shows that a standard safeguard, calling back to confirm, doesn't help when the callback itself can be answered by a fake voice built from the real person's speech patterns.
How it works, plainly: Scammers scrape a few seconds of someone's recorded speech, feed it into voice-cloning software, and generate new sentences in that person's voice on demand. Paired with a spoofed message claiming urgency and secrecy, it creates pressure to act fast without checking through a second, independent channel. Fideuram did notice irregularities and alert authorities relatively quickly, which is why some money was traced at all.
The rollout: Investigators in China, Portugal and Italy managed to recover about €53 million; roughly €36 million is still missing, moved through overseas accounts and converted into crypto. Molesini resigned in March citing personal reasons and is not under investigation; Milan prosecutors are instead investigating a foreign national living outside Europe. Security firms are now pushing banks to require multi-person, multi-channel sign-off on large transfers and to set up spoken code words for emergencies.
