How a Cloned Lawyer's Voice Moved 95 Million Euros Out of Fideuram

Fraudsters moved 95 million euros out of Fideuram, the private banking arm of Italy's largest lender Intesa Sanpaolo, by cloning the voice of a lawyer who did not work there. Corriere della Sera and Reuters reported the loss on 25 September 2026; about 53 million euros has been recovered and roughly 36 million is still missing, converted into cryptocurrency. Some coverage has called this a CEO voice deepfake. It was not. The chief executive's identity arrived as a WhatsApp message, which carries no biometric at all. The synthetic voice belonged to an external law-firm partner whose only role was to confirm that the request was genuine. The attackers did not clone the person asking for the money. They cloned the person verifying it, at the step where the only check available was whether the chairman recognised the voice. He did.

Fraudsters moved 95 million euros out of Fideuram, the private banking arm of Italy's largest lender Intesa Sanpaolo, by cloning the voice of a lawyer who did not work there. Corriere della Sera first reported the loss on 25 September 2026, and Reuters followed the same day, citing two sources familiar with the matter. About 53 million euros has since been recovered through cooperation between Italian, Chinese and Portuguese authorities (Il Sole 24 Ore puts the figure at 59 million). Roughly 36 million is still gone, routed through overseas accounts and converted into cryptocurrency.

Some coverage of this case has called it a CEO voice deepfake. It was not one, and the difference is the whole mechanism. The chief executive's identity arrived as a WhatsApp message, which is text, carries no biometric, and costs nothing to fake. The synthetic voice belonged to someone else entirely: an external law-firm partner, known to the chairman, who vouched for the request and then, by forged email, supplied the accounts to pay.

The attackers did not clone the person asking for the money. They cloned the person verifying it. That inversion is what separates this case from the familiar deepfake patterns the industry has been preparing for.

‍

What actually happened at Fideuram

The sequence began in February 2026. Paolo Molesini, then chairman of Fideuram, received a WhatsApp message that appeared to come from Carlo Messina, chief executive of Intesa Sanpaolo, asking for urgent help with an overseas transaction. A phone call followed. The caller presented as Paolo Nastasi, managing partner of A&O Shearman Italia, a lawyer Molesini knew personally and who had no involvement in the fraud and confirmed the instruction. AI was used to replicate that lawyer's voice.

Molesini accepted the request as genuine and instructed Fideuram's finance department to arrange a series of transfers to foreign accounts, mainly in China and Hong Kong. Forged emails followed, apparently from the law firm, carrying the company details and foreign account coordinates for the payments. According to Corriere della Sera, the whole sequence played out within a few hours. Fideuram’s internal security systems raised the alert, and the bank activated international interbank cooperation. More than 40 million euros was frozen in China and about 13 million by Portuguese authorities. Part of the remainder has been traced to two Bitcoin wallets, which is why slightly more than half the money came back. The remainder moved through a network of overseas accounts and into cryptocurrency, where it has stayed.

Molesini resigned on 12 March 2026, one month after the fraud, citing personal reasons and offering no further explanation at the time. Neither he nor any other Fideuram executive is under investigation. Milan prosecutors have placed a foreign national living outside Europe under investigation on suspicion of computer fraud. Intesa Sanpaolo and Fideuram declined to comment.

Much of what would normally anchor an account of a fraud this size is still absent from the public record. Nobody has said how many transfers there were, what approvals each passed, what triggered Fideuram’s internal alert, or whether anyone checked the email domain or called the firm back on a known number. Those gaps are marked below wherever they bear on an argument.

‍

The cloned voice was not the CEO's

Two identities are in play and some coverage collapses them into one. Corriere della Sera, which broke the story, and Reuters are consistent: the WhatsApp message impersonated Messina, and the voice that was synthesised belonged to the lawyer on the follow-up call. At least one technology outlet reported instead that the criminals called Molesini using AI to mimic Messina's voice. That version is the one that travelled, because it fits the shape of the story everyone already knows from the Arup and Ferrari cases.

Read the two versions as attack designs and they are not variants of each other. Where the CEO's voice is cloned, the attacker spends its most expensive capability on the originator, and the defence is obvious: compare the voice to a person the bank employs and can reach on a number it controls. In the version Corriere and Reuters describe, the originator is authenticated by nothing at all. A display name in a messaging app is not evidence. The expensive capability goes one step downstream, onto a referee, and a referee external to the organisation is precisely the party against whom no enrolled comparison is possible. The only check left is whether the listener recognises the voice, and that is exactly what a clone is built to pass.

If you take the wrong version away from this case, you will go looking for executive voiceprints and conclude you are covered. The attack did not go anywhere near an executive voiceprint. The same misreading affects video: a cloned public figure on a video call and a cloned adviser on an audio call demand different answers.

‍

Which step tested whose identity

Lay the instruction's path out step by step and ask of each one a question that payment-fraud controls rarely ask explicitly: not whether the step is a control, but whose identity it puts to the test, and whether the receiving side holds anything to compare that evidence against.

‍

Five steps, and the answers are all different.

‍

The first step carries an identity claim with no biometric attached. The second carries no identity evidence at all. The third carries the only biometric in the entire chain, and it lands on a party the bank could never enrol, leaving only the chairman’s ear as a reference.

The fourth step is the one worth sitting with. It is the only genuine authentication in the sequence, and it worked. Fideuram's finance department correctly established that the instruction came from its own chairman, who genuinely held the authority to give it. That control did not fail. It performed exactly as designed, on the right person, giving the wrong instruction, and the money left.

This is the structural lesson and it generalises past this bank. Payment controls are overwhelmingly built to answer "is this person who they claim to be, and are they allowed to do this?" Both answers here were yes. The question nobody's control was positioned to ask was whether the context that person had been given was real, and the context was manufactured one step upstream, in a place with no identity infrastructure pointed at it.

‍

Why outside counsel is the target

Choosing an external lawyer as the voice to synthesise looks eccentric until you cost it out, at which point it looks close to optimal.

Seniority is the first property. A partner at a prominent firm, confirming that a transaction the chief executive has raised is in order, closes the question rather than reopening it. Lawyers appear in exactly this role in genuine cross-border transactions, which is why the pretext does not feel strange. The attacker is not asking the victim to believe anything unusual, which is the same economy of plausibility that makes fabricated endorsements effective.

Externality is the second, and it is the one that does the work. Every identity control a bank operates points inward or downward: at its employees, at its customers, at counterparties it has onboarded through KYC checks that attackers already target. Outside counsel at another firm sits in none of those populations. No voiceprint is enrolled. No authentication factor is issued. In this case there was a relationship: the chairman knew the partner. That made the clone more persuasive, not less, because familiarity is the reference a clone is designed to match.

Availability of training audio is the third. Senior partners at prominent firms speak at conferences, record webinars and give interviews. Published research on voice synthesis has for several years reported workable cloning from a few seconds of clean reference speech, and conference audio is far cleaner than the telephone recordings that supported the Greek voice-cloning ring that harvested samples from victims' relatives. No source has established what audio was used in this case.

The external professional adviser is therefore an unusually efficient target:

high authority, zero enrolment, free training data and, as here, often a voice the target already trusts. The same reasoning covers auditors, correspondent bankers and transaction counsel. None sits inside anyone's identity perimeter, and all are routinely asked to vouch for things.

‍

Why the callback rule did not fire

Ask a treasury team what stops voice-based payment fraud and the answer is usually a callback: when an unusual instruction arrives, telephone the originator on a number already held on file. It is good advice. It did not apply here, for a reason worth being precise about.

A callback is a rule about who dials. Its security property comes entirely from the fact that the defender selects the number from records the attacker cannot edit. The confirming call in this case arrived inbound. Nobody at Fideuram chose it, looked it up, or dialled it. An inbound call and inbound emails confirming an inbound message are not corroboration, because all three channels were supplied by the same party.

That distinction also explains why a better detector would not obviously have changed the outcome. Telephone audio is narrowband and heavily compressed before any analysis touches it, the asymmetry examined in DDG's work on where anti-spoofing stops working. Call direction is a property of the call record rather than the audio, and it survives compression perfectly.

The FBI has published this rule in almost exactly those terms. Its public service announcement on generative-AI fraud, I-120324-PSA of 3 December 2024, tells people to "verify the identity of the person calling you by hanging up the phone, researching the contact of the bank or organization purporting to call you, and call the phone number directly." Every operative verb there belongs to the defender: hang up, research, call. None of them was available to someone accepting an inbound confirmation.

The practical form of the rule is narrower than most corporate policies state it. It is not "verify unusual instructions by phone". It is: no confirmation counts unless the defender chose the number, from a record the requester did not supply, and reached the person the instruction is actually attributed to. On that reading, the confirming call at Fideuram was not a weak verification. It was not a verification at all.

‍

What a bound authenticator requires

There is a published standard that already says why the confirming call could not have worked, and it is not a payments standard.

NIST’s Digital Identity Guidelines, SP 800-63B-4 (Revision 4), draw a line that payment-fraud discussions tend to skip. Authentication there means demonstrating control of an authenticator bound to a subscriber account, where binding is the dated, recorded association between a specific authenticator and a specific account. Nothing becomes an authenticator by being persuasive. It becomes one by being enrolled.

The same document is blunt about biometrics. "Biometric characteristics do not constitute secrets," it states, noting that they can often be obtained without consent, which is why it permits biometric authentication only alongside a bound physical authenticator rather than on its own. That constraint is the same one separating liveness checking from deepfake detection: The current revision goes further for voice specifically: “Biometric comparison based on voice SHALL NOT be used.” A voice is not something NIST will accept as an authenticator even when it has been enrolled.

Apply that vocabulary to the confirming call and the analysis stops being a judgement call. The voice on the line was not a bound authenticator for any account at Intesa Sanpaolo, because no binding event had ever occurred for that person. There was no enrolled sample, no record, no date. What the voice provided was recognisability, which is a property of the listener rather than of any registry. It was measured against something: the chairman’s memory of a voice he knew. It passed. NIST’s framework has no category for that kind of check, because a human ear is not a bound authenticator, however familiar the voice.

Stated that way, the headline of this incident changes. A verification step did not fail at Fideuram. A step that was never capable of verifying anything was treated as though it were, and that is a design question rather than a detection question.

‍

How big 95 million is against FBI data

The scale of this single instruction is easiest to grasp against a national dataset, and the FBI publishes a usable one.

‍

The FBI's 2025 Internet Crime Report records 1,008,597 complaints and 20.877 billion dollars in losses, a 26% rise on 2024. Business email compromise accounts for 3,046,598,558 dollars of that. For the first time the report carries a dedicated artificial-intelligence section: 22,364 complaints and 893,346,472 dollars in reported losses, with the observation that "voice cloning can also be used to request wire payment". Against BEC specifically, it states that in 2025 "businesses reported losses over 30 million dollars to BEC scams involving AI".

Fideuram's 95 million euros is 108 million dollars. One instruction, at one bank, in one month, is up to roughly three and a half times everything American businesses reported to the FBI for AI-enabled business email compromise across the entire year. The 36 million euros still missing, about 41 million dollars as Cybernews reported, likely exceeds that national total on its own.

Read this as a statement about reporting coverage rather than about geography. IC3 counts voluntary complaints from US victims, and Fideuram is Italian, so this incident appears nowhere in those totals. The useful inference is how thin the aggregates are. A single European case that no American dataset captures outweighs an entire national category, which is a reasonable measure of how far these figures sit below the real number, and a reason to treat any "AI fraud cost X last year" statistic as a floor.

‍

What Italy's 2025 case did differently

Italy has had a comparable fraud inside the last two years, and the comparison is unusually clean: same country, same prosecutors in Milan, twelve months apart, and one deliberate difference in design.

In early 2025, fraudsters used AI to mimic the voice of Italian defence minister Guido Crosetto, telephoning business figures including Giorgio Armani, Patrizio Bertelli and Massimo Moratti with a story about Italian journalists kidnapped in the Middle East who needed ransom money the government could not be seen to pay. Only Moratti sent anything, roughly a million euros across two payments, and Italian police traced and froze the full amount in a Dutch account.

‍

The design difference is the whole result. Cloning the person who wants the money produces a request that is strange on its face, which is why most of the 2025 targets declined and why the one payment was reversible. Cloning the person who confirms the request produces something that feels like diligence working. The 2026 version moved ninety-five times more money and a large part of it is unrecoverable.

Read against DDG's coverage of cloned political figures used in investment scams and a cloned head of state endorsing a fraudulent scheme, the pattern holds: synthetic media aimed at the originator of a request is the version that gets questioned.

‍

Where the reporting still disagrees

Three disagreements are live in the coverage, and none of them should be repeated without its qualifier.

Whose voice was cloned. Reuters and the outlets carrying its wire say an outside law-firm partner. At least one technology outlet says Carlo Messina. This article follows the Reuters account because it matches Corriere della Sera, which broke the story, it names both parties in distinct roles, and the outlets that corroborate it do so independently. The alternative version is noted rather than dismissed, and if it turns out to be correct the central analysis here changes.

How much was recovered. The Reuters-sourced accounts give roughly 53 million euros. Il Sole 24 Ore and ITdaily report 59 million. Both describe the same recovery operation.

How much is still missing. Most accounts say about 36 million euros. Dexerto reports 42 million. That second figure is exactly 95 minus 53, which suggests it was derived by subtraction rather than reported, and it is the reading under which the arithmetic closes.

The arithmetic does not otherwise close. 53 million recovered plus 36 million missing is 89 million, not 95. Under the Il Sole 24 Ore figure of 59 million recovered, the sum closes exactly, which suggests the 53 million figure may omit a later recovery. No source reconciles the two explicitly.

‍

What is executive impersonation fraud?

Executive impersonation fraud is a payment attack in which someone poses as a senior figure, usually a chief executive or finance director, to induce a staff member with genuine authority to move money. It is the subcategory of business email compromise that the FBI describes as using "chat generators" to produce "official-sounding emails mimicking a company's CEO or other officials", now increasingly paired with cloned audio.

The defining property is that no system is broken into. In this case no Intesa Sanpaolo system was compromised; every transfer was executed through normal channels by authorised staff following what they understood to be a legitimate instruction. The attack targets the context in which an authorisation decision is made, not the authorisation mechanism itself.

Synthetic audio changes the economics rather than the structure. The pretext, the urgency and the appeal to seniority are decades old. What AI supplies is a cheap way to add a confirming channel, which is the component that historically limited how far these schemes could be pushed. The companion pattern in consumer fraud appears in DDG's analysis of a cloned mayor's voice used to authorise payments and in a voice-conversion ring indicted in Taipei.

‍

Four controls that would have fired

Grading controls against this specific sequence, rather than against executive-impersonation fraud in the abstract, produces a shorter list than most policy documents contain.

‍

Only the fourth control answers this attack cleanly, and it is the cheapest of the four. It requires no biometric infrastructure, no vendor and no model. It requires a rule that an instruction attributed to a named person is confirmed with that named person, through a channel the organisation selected, before money moves. A third party vouching for the instruction is not a substitute, however senior that third party appears, because their identity is not the identity the instruction depends on.

Two supporting changes follow. Treat any referee external to the organisation as unauthenticable by default, because the enrolment that would make verification possible does not exist and cannot be improvised mid-call. And record call direction as a control attribute in payment procedures: whether the defender dialled is checkable from the call record, survives compression, and does not depend on anyone hearing a synthetic voice.

‍

What this case does not tell us

The public record is thinner than the scale of the loss suggests, and several appealing conclusions are not available from it.

Whether Fideuram's payment controls were weak is unknown. No account describes the authorisation thresholds, the approval chain, or which policies applied to a transfer of this size. A chairman instructing a finance department is reported; what that department was required to check is not. Nor is anything on the record about how the call reached the network, which would matter for any technical account of the audio.

Whether any voice comparison was possible is also unknown. No reporting addresses whether Intesa Sanpaolo enrols voiceprints for anyone. The argument made here is narrower and does not depend on the answer: external counsel sits outside any enrolment boundary a bank plausibly maintains, so the absence of an enrolled reference at that step holds regardless of internal policy. The one comparison that did happen was human: the chairman knew the lawyer’s voice, and the clone passed.

Detection is described only in outline: internal security systems raised the alert, and interbank cooperation froze funds in China and Portugal. What triggered the alert is not reported. That matters, because detection is what recovered the money. That matters, because detection is what recovered 53 million euros, and it is the only part of this story that worked.

The quality of the clone is unknown, and no recording is public. DuckDuckGoose has not analysed any audio connected to this case and makes no claim about the material involved. Anyone asserting that the voice was or was not detectable is speculating.

‍

Frequently asked questions

Was the Fideuram fraud a deepfake of the CEO?
No, according to Corriere della Sera and Reuters. The chief executive, Carlo Messina, was impersonated in a WhatsApp message, which is text. The synthetic voice on the confirming phone call was that of a senior partner at an outside law firm. At least one outlet has reported it as a clone of Messina's voice; that version conflicts with the Reuters account followed here.

How much money was lost and how much came back?
95 million euros, about 108 million dollars, was transferred. Roughly 53 million euros was recovered through cooperation between Italian, Chinese and Portuguese authorities. About 36 million euros remains missing after being moved through overseas accounts and converted into cryptocurrency. Il Sole 24 Ore reports 59 million, under which the figures sum to 95.

Is anyone being prosecuted?
Milan prosecutors have placed a foreign national living outside Europe under investigation on suspicion of computer fraud. Neither Paolo Molesini nor any other Fideuram executive is under investigation. Molesini resigned as chairman on 12 March 2026, citing personal reasons.

Would voice biometrics have stopped this?
Not at the step where the synthetic audio was used. A voice comparison needs an enrolled reference, and no bank enrols the voice of another firm’s lawyer. The only comparison available was the chairman’s own recognition of a voice he knew, and the clone passed it. Under NIST SP 800-63B-4, recognition is not authentication, and the current revision rules out voice comparison for authentication altogether.

What single control answers this attack?
Out-of-band confirmation with the person the instruction is attributed to, on a channel the organisation selected rather than one the requester supplied. Contacting Messina directly would have broken the chain. Accepting a confirming call from someone offered as a referee did not. This is a procedural fix rather than a detection one.

Why does it matter who was cloned?
Because it determines where defences go. If the chief executive's voice were cloned, the answer is executive voiceprints and internal callbacks. Since a third party's voice was cloned, the answer is a rule about which identities are permitted to settle a payment question at all.

‍

Methodology and sources

Facts about the incident come from accounts read directly in two groups. Corriere della Sera, which first reported the case, is cited as carried by Il Sole 24 Ore, MilanoToday, Fanpage, Today.it, Bluerating and L’Unione Sarda; these supply the lawyer’s identity, his acquaintance with Molesini, the forged emails, the timeline, the internal alert and the resignation date. The Reuters wire is cited as carried by Euronext, Gulf News, AML Intelligence, IBTimes UK, Trending Topics and Private Banker International via Yahoo Finance, with Cybernews and Dexerto also read directly. ITdaily was consulted and its divergent account reported rather than used. Reuters’ own page returned HTTP 403 to automated requests during this work, so the wire is cited through outlets reproducing it. Reuters attributes the report to two sources familiar with the matter, and Intesa Sanpaolo and Fideuram declined to comment, so nothing here is confirmed by the bank. Details of the 2025 Crosetto impersonation are from Reuters as carried by Cyprus Mail, and that case is used for comparison only.

Loss and fraud aggregates are quoted directly from the FBI’s 2025 Internet Crime Report, a primary document, including its artificial-intelligence section. Identity vocabulary, the binding requirement, the statement that biometric characteristics do not constitute secrets and the prohibition on voice comparison are taken from NIST Special Publication 800-63B-4 (Revision 4), Sec. 3.2.3 (Use of Biometrics) and Sec. 4.1 (Authenticator Binding), also primary, and the quoted verification guidance from FBI public service announcement I-120324-PSA. The 41 million dollar equivalent of 36 million euros is as reported by Cybernews.

Where sources disagree, both readings are given, and the figure carries its disagreement everywhere it is used. No name, figure or date appears in this article that was not read in one of the listed sources. DuckDuckGoose has not analysed any media connected to this case.

Last update: Q4 2026.