Deepfake CEO Fraud: The Fideuram Case and How to Stop It

Image: Unsplash.

A fake WhatsApp and a cloned voice got Italy's leading private bank to wire tens of millions abroad in a few hours. If a bank with a treasury department and fraud systems fell for it, a ten-person company paying invoices from a shared inbox will too. The fix is not a detection tool. It is a written rule about how money leaves the company, and it costs nothing.

What happened at Fideuram

The fraud took place in February 2026; Corriere della Sera's Milan edition first reported it on September 25, 2026. The details below come from that report, from ANSA, which quotes the Milan court order, and from Reuters.

1. The message. On February 23, Paolo Molesini, then chairman of Fideuram, received a WhatsApp from a number he did not know. The sender claimed to be Carlo Messina, CEO of the parent group Intesa Sanpaolo. The story: Intesa wanted to buy an international bank but could not do it directly, because a leak would get the deal stopped by Consob, Italy's market regulator. Fideuram had to do it instead, and a lawyer would call.
2. The lawyer. The call came in the voice of Paolo Nastasi, managing partner of A&O Shearman Italia, a lawyer Molesini knew. Nastasi had nothing to do with it; the fraudsters had recreated his voice with AI. The fake lawyer had Molesini sign a confidentiality agreement and a special power of attorney that appeared to be signed by Messina, eleven documents in all.
3. The paperwork. Emails made to look like they came from the law firm carried the names of the companies and the foreign accounts to pay.
4. The second fake. The same day, Fideuram's head of treasury and payments got a call from someone posing as Fideuram's CEO, saying the chairman would ring with urgent, confidential transfers.
5. The transfers. Fideuram's CFO, instructed by the chairman, sent the money, mostly to China and Hong Kong. Corriere says it all happened in a handful of hours.

Then the bank's own security systems flagged the transfers, and Fideuram turned to international interbank channels and filed a complaint. A bank in China froze a large share and sent it back; Milan prosecutors, working with Lisbon under Eurojust, froze more in Portugal. The rest moved through foreign accounts and was converted to bitcoin. Molesini resigned on March 12 "for personal reasons" and is not under investigation. A 48-year-old Israeli citizen is, though Corriere's follow-up says prosecutors are still checking whether that identity belongs to a real person. Intesa Sanpaolo and Fideuram declined to comment to Reuters.

Image: Pexels.

The numbers, by source

The outlets agree on the shape of the fraud and disagree on the totals. We list each figure with the outlet that gives it.

Not just Fideuram

Milan prosecutors have at least three similar cases open, ANSA reports:

• Banca Ifis, May 2026. A manager in the tax department moved about 24 million euros after emails from what looked like a colleague's mailbox. Money went through Spain, Singapore, Hong Kong and Bahrain; a court froze part of it in Barcelona, and about 20 million came back. Neither Corriere nor ANSA describes a cloned voice in this case, although ANSA files it with the AI frauds.
• A smaller bank lost about 2 million euros, partly recovered in Croatia.
• A non-bank company of the BPER group was hit by an "identical" scam using the same lawyer's name, for much smaller sums.
• 2025: fraudsters used an AI copy of Defence Minister Guido Crosetto's voice to get businessman Massimo Moratti to send nearly 1 million euros abroad. That money was recovered.

Outside Italy, the reference case is still Arup: in 2024 an employee in Hong Kong paid out 25 million dollars after a video call with deepfaked executives, as Biometric Update recalled on October 15. Milan deputy prosecutor Eugenio Fusco told companies to stop believing "a noi non possa mai capitare" ("it could never happen to us").

Why it worked

The AI part was one link in a chain, and every link vouched for the next. The CEO's message announced the lawyer. The lawyer's familiar voice confirmed the CEO. The signed documents and law-firm emails made it look like a real deal file. The fake call to the treasury head prepared the people who would push the button. Nobody in the chain had to believe a single unlikely thing.

Europol's CEO fraud leaflet, written in 2018 before cheap voice clones, lists the same script: a caller posing as the CEO, a "sensitive situation" such as a merger or acquisition, a demand for urgency and absolute confidentiality, and a request to skip the normal authorisation steps.

Screenshot: Europol, CEO/BEC fraud leaflet (PDF), captured October 19, 2026.

Italian readers on r/ItaliaPersonalFinance went straight to the procedure. u/Laxardalur wrote: "Le procedure usuali prevedono di effettuare una call-back (i.e. chiamare l'interno del diretto interessato) e, da quanto ho letto sinora, il soggetto in questione si è fatto chiamare invece di chiamare lui." (Usual procedure is a callback, calling the person's own extension, and from what I've read he let them call him instead.) u/OrangeCatBread added the part small teams forget: "Una volta raggirata una persona ai vertici le persone sotto per quanto gli riguarda ricevono istruzioni "legittime"." (Once someone at the top is fooled, the people below are just receiving legitimate instructions.)

https://www.reddit.com/r/ItaliaPersonalFinance/comments/1wqlhcl/truffa_da_95_milioni_a_fideuram_ex_presidente/

The payment verification rule

Write this down, get the founder or CEO to sign it, and apply it to the founder or CEO first. A rule the boss can waive is how Fideuram's money left.

1. No payment on a message, email or call alone. That covers new payees, changed bank details and "urgent, confidential" one-off transfers, whoever appears to be asking.
2. Call back on a number you already hold. Use the phone number in your contacts or vendor file, never one from the message, the email signature or the caller. Waiting for "them" to call you back is not a callback.
3. Two people above a threshold. Pick an amount that would hurt in a bad week. Above it, a second person approves, and the second person checks with the requester on their own, not through the first approver. Any new payee or changed bank detail needs both, whatever the amount.
4. A code word for real emergencies. Agree it in person, keep it out of chat and email, and change it when someone leaves. A request that claims to be urgent and cannot give the word waits.
5. No approvals in WhatsApp or personal messaging. Chat apps are fine for "call me". They are not where a payment gets approved.
6. Secrecy is a stop sign. "Don't tell finance yet", "the deal is confidential", "the regulator can't know" are the Europol warning signs. Treat them as a reason to slow down, not to skip steps.

Security firms quoted by Trending Topics give the same two rules: never confirm a large transfer through a single channel, and agree code words for emergencies.

Copy-paste clauses

Add this to your AI acceptable use policy, under the section on AI-generated content:

Synthetic voices and video in payment requests. Staff must not treat a voice, video, message or email as proof of who is asking for money. Any request to pay, add a payee or change bank details is verified by calling back on a number already on file, before any money moves. Payment approvals are never given in WhatsApp or other personal messaging apps.

Add this as a scenario in your AI incident response plan:

Scenario: suspected deepfake payment fraud. Trigger: a payment was made, or nearly made, on a request that may have used a cloned voice, video or a spoofed message. First hour: call our bank's fraud line and ask for a recall of every transfer; freeze further payments to the same beneficiaries; save the messages, call logs, numbers and emails. Same day: file a police report and notify our insurer. Owner: [name]. Backup: [name].

Train the people who can move money

Fifteen minutes is enough. Walk everyone who can pay, approve or change bank details through the Fideuram chain above, then run one drill: someone senior sends a fake "urgent and confidential" payment request from a new number, and you see who calls back on the number on file. Repeat it when someone new gets payment rights.

If money has already left

Speed decides how much comes back. Fideuram's own systems caught the transfers fast and the bank went straight to its correspondent banks; that is how a large share was frozen in China and Portugal. Ifis recovered most of its loss because, Corriere says, the first hours were decisive. So call your bank's fraud line before you do anything else, then the police, then your insurer. Europol's advice is to report attempts to the police even when no money was lost.

What the law does, and doesn't

Article 50(4) of the EU AI Act, which applies since August 2, 2026, says: "Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated." A cloned voice of a real lawyer fits the Act's definition of a deep fake. A criminal will not label it. The transparency rules help with honest synthetic media; they do nothing for your payment desk. Our Article 50 guide covers what those duties do require, and the TAKE IT DOWN Act, Washington's likeness law and Denmark's deepfake bill cover the consent and takedown side.

In the US, FinCEN's alert FIN-2024-Alert004 of November 13, 2024 already described this scheme: criminals using generative AI to impersonate "an executive or other trusted employee" and instruct staff to transfer large sums. It is written for financial institutions, which it asks to tag suspicious activity reports "FIN-2024-DEEPFAKEFRAUD". If you are not a bank, the useful part is that your bank is watching for the same pattern, so call it early.

Screenshot: FinCEN, FIN-2024-Alert004 (PDF), page 5, captured October 19, 2026.

What we could not confirm

We found no statement from Fideuram, Intesa Sanpaolo, Banca Ifis or the Milan prosecutor's office on these frauds; Banca Ifis's press releases of September 25 and October 1 do not mention it. The amounts come from press reports, and they differ (see the table). We could not retrieve the text of the heise report that brought this story to many English-language readers, so this article rests on Corriere, ANSA and Reuters, read directly. Whether the Ifis fraud used a cloned voice is not stated in the reports we read.

Related Reading

• AI Acceptable Use Policy Template for Small Teams
• AI Incident Response Plan Template
• EU AI Act Article 50: Chatbot and Deepfake Disclosure
• Denmark Deepfake Bill: Consent Record and Takedown Templates
• Washington AI Likeness Law (SSB 5886): Consent Checklist
• TAKE IT DOWN Act Compliance Checklist for Platforms