A Familiar Voice Is No Longer Enough to Approve a Payment

What changed

Reuters reported on Friday, September 25, that fraudsters using AI to impersonate senior executives stole €95 million (about $108 million) from Fideuram, the private-banking arm of Intesa Sanpaolo, Italy's biggest lender. The report, citing two people familiar with the matter, says the scheme began in February, when Fideuram's then-chairman Paolo Molesini received a WhatsApp message that appeared to come from Intesa Sanpaolo CEO Carlo Messina, asking for urgent help with an overseas transaction. A follow-up phone call, apparently from a senior partner at a well-known law firm, confirmed the instructions. According to Reuters' sources, the callers used AI technology to clone that lawyer's actual voice.

Believing the request was genuine, Molesini had Fideuram's finance department arrange a series of transfers to accounts overseas, mostly in China and Hong Kong. Fideuram caught the irregularities quickly and alerted banks and authorities in several countries. Roughly €53 million was later recovered through cooperation between authorities in China, Portugal, and Italy, but about €36 million is still missing, reportedly moved through a chain of foreign accounts and converted into cryptocurrency. Milan prosecutors have opened a computer-fraud investigation into a foreign national living outside Europe. Neither Molesini, who resigned as chairman in March for what were described as personal reasons, nor any other Fideuram executive is under investigation.

The honest nuance

Intesa Sanpaolo and Fideuram declined to comment when Reuters asked about the incident, and the entire account is attributed to two unnamed sources familiar with the matter, not to an official bank statement. That doesn't make the story unreliable, but it means some specifics, like exactly how the voice was cloned or how much audio the fraudsters needed, aren't independently confirmed.

It's also worth being precise about what actually caused the loss. This was a very large transfer at a major private bank, not a typical small-business payment, and voice cloning was only one piece of a longer con: a spoofed WhatsApp message, a sense of urgency from someone believed to be the CEO, and a phone call that matched a name the chairman already trusted. Take away any one of those elements and the scheme is much weaker. The lesson isn't that AI voice cloning is now unstoppable. It's that a familiar voice or a message that looks like it's from someone you know is no longer, by itself, good evidence that the request is real.

Why it matters for your business

Small businesses often run on exactly the kind of trust this scam exploited. Owners, bookkeepers, and staff frequently know each other's voices, phone numbers, and writing style well enough to skip formal verification, especially when a message looks urgent and comes from someone senior. That informality is efficient day to day, but it's also the weak point fraudsters are now equipped to target, because cloning a voice convincingly enough for a short, high-pressure phone call no longer requires special resources.

You don't need a private bank's transfer volumes to be a worthwhile target. A single wire transfer, payroll change, or updated vendor bank account is enough, and small businesses typically have fewer layers of approval standing between a convincing request and money actually moving.

What to actually do

Put one simple rule in place: no unusual payment or bank-detail change gets approved based on a message, call, or voice alone, no matter how familiar it sounds. Instead, require an independent verification step before the money moves, using contact information you already have on file, never a number or link provided in the request itself, plus sign-off from a second authorized person for anything above a set dollar amount.

For example, if someone claiming to be your business partner texts or calls asking you to urgently wire money to a new account or change where a vendor gets paid, don't act on that channel. Call your partner back on the number already saved in your phone, or ask a specific question only they would know the answer to, before anyone touches the transfer. This costs a few extra minutes on the rare occasion it comes up, which is trivial compared with a fraudulent transfer that's already gone through.

From Kindloom Labs

Before you can write a verification rule, it helps to know where AI already changes the odds for scams like this one. The free Quick Read Small Business AI Checklist covers basic safeguards to put in place now, including who needs to sign off before an AI-assisted or urgent request is allowed to move money.

Sources

• AI messaging scam costs Italy's top bank Intesa millions, sources say (Reuters, via KSL)
• Una truffa basata su messaggi generati dall'intelligenza artificiale costa milioni a Intesa (Reuters, via MarketScreener Italia)