The most sophisticated AI fraud in European banking history started with a WhatsApp message.
In February 2026, Paolo Molesini, the chairman of Fideuram — the private banking arm of Intesa Sanpaolo, Italy’s largest financial institution — received a message on his personal phone. It appeared to be from Carlo Messina, the CEO of Intesa Sanpaolo, asking for urgent help facilitating a large overseas transaction. Molesini, presumably cautious, needed more than a text message to act on a request of that scale. So he waited for a follow-up call.
The call came. It was Paolo Nastasi, a senior partner at A&O Shearman, one of the most prestigious international law firms with deep ties to Italian finance. Nastasi’s voice confirmed everything: the request was real, the money needed to move, time was short. Molesini trusted his ears, told his finance department to proceed, and authorized the transfer.
Paolo Nastasi, the real one, had never made that call. Neither had Carlo Messina. The voice on the phone was an AI-generated replica, trained on publicly available audio of the lawyer. The entire operation was a fraud — and by the time Fideuram’s finance team flagged anomalies in the outgoing wire transfers, €95 million was already moving through a chain of accounts in China and Hong Kong.
The Anatomy of a €95 Million Heist
What makes the Fideuram case remarkable is not just its scale — though €95 million ($108 million) is the largest AI-assisted financial fraud in European history — but the precision of its engineering. The attackers did not simply spoof an email address or fake a phone number. They studied their targets, selected the right impersonation vector, and used AI to clear the one verification hurdle that stood between them and nine figures of someone else’s money.
The sequence was deliberate:
First, establish authority. A WhatsApp message from the CEO’s apparent number created the context. It was not asking Molesini to do anything yet — just setting up a cover story about a sensitive overseas deal that needed a trusted intermediary.
Then, provide confirmation. When the chairman needed more assurance, a voice call arrived. The attackers had scraped audio of Paolo Nastasi — likely from conference recordings, investor briefings, legal webinars, or media appearances — and used an open-source generative model to replicate his voice closely enough to pass real-time scrutiny by a person who likely knew him.
Finally, route the money quickly. The funds moved to multiple accounts in China and Hong Kong and were rapidly dispersed. Approximately €36 million was converted into cryptocurrency, making recovery structurally impossible once the coins left those wallets. The blockchain does not negotiate with prosecutors.
Fideuram’s internal controls detected the anomalies relatively quickly, and the bank immediately contacted counterpart banks and law enforcement in several countries. Italian prosecutors, working with authorities in Portugal and Chinese banking regulators, managed to freeze and recover approximately €53 million — roughly €40 million came back through Chinese banking channels; another €13 million was seized with Eurojust support in Portugal. But €36 million, converted to crypto and dispersed, is gone.
Milan prosecutors have placed one foreign national — living outside the European Union — under investigation for computer fraud. No charges have been filed. Intesa Sanpaolo and Fideuram have declined to comment publicly. Paolo Molesini resigned as chairman in March 2026, citing personal reasons.
Not a Fluke — A Playbook
The identifAI firm, which published a report on AI deepfake fraud concurrent with the Reuters disclosure of the Fideuram case, frames this incident not as an anomaly but as evidence that a well-documented theoretical attack vector has crossed decisively into operational reality.
The mechanics the Fideuram attackers used are not exotic. They require: a target senior enough to authorize large wire transfers with minimal bureaucratic friction; publicly available audio of a trusted colleague or advisor (LinkedIn, YouTube, conference footage); an open-source voice synthesis model; a plausible business pretext requiring urgency and secrecy; and overseas account infrastructure to receive and disperse funds quickly.
Deloitte estimated in a 2025 projection that generative AI could push U.S. fraud losses alone to $40 billion by 2027. The Fideuram case is a data point suggesting those estimates may be conservative when applied to high-value institutional targets.
The 2024 Arup incident — in which a Hong Kong-based employee transferred $25 million after a deepfaked video call involving a fake version of the company’s CFO and several colleagues — now looks like a preview of what was coming. Where Arup involved a video call with multiple AI-generated participants, the Fideuram attack required only a single cloned voice on a phone call. The technical bar is falling, not rising.
The Defense Problem
What can banks actually do? The identifAI report recommends multi-layered cryptographic media authentication — embedding verifiable digital signatures in legitimate communications so that any message purporting to come from a CEO carries cryptographic proof of its origin. It also recommends continuous behavioral biometric monitoring, flagging when someone who normally never calls from an unregistered number suddenly does so to authorize a nine-figure wire transfer.
These are technically tractable solutions. The harder problem is cultural and operational. The Fideuram attack worked because a senior executive exercised judgment, applied pattern recognition to a voice he may have heard before, and made a reasonable decision under time pressure. That is exactly what banks train their people to do. No amount of security awareness training reliably defeats a sufficiently convincing real-time voice clone of a trusted colleague, because the cognitive process being exploited — “I recognize this voice, therefore this is real” — is not a security failure. It is normal human cognition.
The FTC’s 2024 Impersonation Rule prohibits impersonating businesses or government entities in commercial contexts, but its reach does not extend comfortably to a voice-cloned Italian lawyer calling a Milanese bank chairman. The EU’s AI Act does address deepfakes — providers of general-purpose AI models capable of synthetic media generation face transparency obligations — but enforcement lags years behind the attack surface.
The practical implication for financial institutions is stark: voice verification, long considered the most personal of authentication factors, has been compromised at the high end. If you can be deceived by a real-time phone call in which someone you know sounds exactly like themselves, you have lost the one authentication mechanism that bypassed every institutional control at Fideuram.
The attackers understood that. The bank is still explaining how it happened.
Sources: Reuters, TechSpot, Biometric Update, identifAI Threat Intelligence Report, Gulf News, Cryptoimpact Hub.
