Cloned voice, fake WhatsApp: scammers con Italian bank out of €95 million

What happened

Scammers took one of Italy's largest private banks for around €95 million, roughly $108 million. Their key weapon was most likely a voice cloned with artificial intelligence. The victim is Fideuram, the private banking arm of Intesa Sanpaolo, Italy's biggest lender. Private banking means wealth management for affluent clients. Reuters cited two people familiar with the matter, and the story was also picked up by Gulf News, Gadget Review and Yahoo, among others. The fraud began in February 2026 and became public in September.

According to Reuters, Intesa Sanpaolo and Fideuram declined to comment. That means every detail comes from anonymous sources. There is no official confirmation from the bank.

How the scam worked

The attackers came in through two channels at once. Paolo Molesini, then chairman of Fideuram, received a WhatsApp message. It appeared to come from Carlo Messina, CEO of parent company Intesa Sanpaolo. The supposed Messina asked for urgent help with a transaction abroad.

Shortly afterwards, a man called claiming to be a senior partner at a well-known law firm and confirmed the request. According to Reuters' sources, the criminals used AI to imitate this lawyer's voice. With voice cloning, software learns from audio recordings what a person sounds like and can then say anything in that voice. Gadget Review notes that it hasn't been made public which tool was used or where the voice samples came from.

Molesini believed the instructions were genuine and had Fideuram's finance department carry out a series of transfers. The money went mainly to accounts in China and Hong Kong.

Gadget Review explains why the trick worked. The request seemed to come from two independent, trusted sources: in writing from the group CEO and by voice from the lawyer. The bank's systems were never breached. The AI made a fake instruction look real to a person who was already authorized to approve such payments. This scheme is known as CEO fraud: criminals pose as senior executives to get employees to send money.

How much money came back

Fideuram later spotted irregularities in the transfers. The bank alerted the receiving banks and authorities in several countries. Thanks to cooperation between agencies in Italy, China and Portugal, around €53 million was recovered, according to Reuters.

The final loss is still unclear. Gadget Review suggests treating the figure as provisional. The roughly €36 million was routed through a network of foreign accounts and converted into cryptocurrency. Once that happens, money is much harder to trace and freeze than in a regular bank account.

Resignation and investigation

In March 2026, a month after the fraud began, Molesini resigned as chairman of Fideuram. He cited personal reasons, and the bank gave no further details at the time. The timing invites speculation. But Gadget Review stresses that the reports establish no official link between the resignation and the fraud. According to Reuters' sources, neither Molesini nor any other Fideuram executive is under investigation.

According to one source, Milan prosecutors are investigating at least one foreign national living outside Europe on suspicion of computer fraud. As of September, the investigation was ongoing.

Not an isolated case

Italy has seen this before. Reuters reports that last year, scammers used AI to imitate the voice of an Italian government minister. They convinced businessman Massimo Moratti to wire almost €1 million to a foreign account. That money was later recovered. The Fideuram case, however, is nearly a hundred times bigger.

What companies can learn from this

Gadget Review sums up the key lesson: a familiar voice no longer proves who's on the line when voices can be synthesized. Executives and prominent lawyers often leave plenty of material behind in public speeches, interviews and conference recordings, all of which can be used to clone a voice. Organizations that treat recognizing a caller's voice as sufficient verification are exactly the ones exposed to attacks like this.

The outlet recommends some general safeguards, noting that these don't refer to any confirmed failures at Fideuram:

• Treat urgent payment requests via informal channels like WhatsApp as unverified by default.
• Verify through a second channel (out-of-band confirmation): call back on a known, separately verified number, not the number the call came from.
• Four-eyes principle: large payments must be approved independently by two people.
• Pre-approved payee lists: money only goes to accounts that have already been vetted.

The case also shows how much speed matters. According to the reports, more than half the money came back because the bank noticed the irregularities and authorities in several countries worked together. Once the money has been converted into crypto, recovery gets much harder.

The bigger picture

The Fideuram scam is among the largest known cases in which an AI voice is said to have played a role. It shows how the threat has shifted. The attackers didn't need to hack any IT systems. All it took was one person with payment authority and two seemingly independent confirmations. The technology to pull that off is now cheap and easy to get.

It's also worth being clear about what hasn't been established. All details come from anonymous sources. The bank and its parent company aren't talking. We don't know which software was used, how convincing the voice actually was, or why no internal control stopped the payments in time. The final damage isn't settled either.

Still, the message for companies of every size is clear: a familiar voice on the phone is no longer proof of identity. The same goes for your private life, for example the so-called grandparent scams that use cloned voices of family members. If you double-check unusual, urgent requests for money through a second, independent channel, you take much of the sting out of this kind of fraud.