The theft of approximately 95 million euros from Fideuram, the private banking arm of Intesa Sanpaolo, demonstrates how artificial intelligence is changing financial fraud from a problem of forged documents into a problem of manufactured trust. Fraudsters reportedly impersonated senior executives through messaging and then used an AI-generated voice during a follow-up call to reinforce the deception. More than half of the money was subsequently recovered, but approximately 36 million euros remained missing.

The incident is significant because the fraud did not apparently depend on breaking into the bank’s core technology systems. Instead, it targeted the people authorised to move money. That distinction is increasingly important as artificial intelligence makes it easier for criminals to reproduce the voices, writing styles and communication patterns of senior executives. The attack shows that financial institutions can have sophisticated cybersecurity systems while remaining vulnerable to manipulation of human decision-making.

The Attack Worked by Creating a False Chain of Trust

The reported scheme began with a message that appeared to come from Intesa Sanpaolo chief executive Carlo Messina and requested urgent assistance with an overseas transaction. A subsequent phone call appeared to come from a senior partner at a major law firm and was reportedly supported by AI-generated voice technology. The combination was designed to create a believable chain of confirmation.

That method is important because financial fraud traditionally relies on one deceptive communication being accepted as genuine. In this case, multiple apparently independent signals reinforced one another. A message from a senior executive established the initial instruction. A phone call from an apparent legal professional then made the transaction appear legitimate. The use of different communication channels created the impression that the request had been independently verified.

The weakness was therefore not simply technological. It was procedural. If employees rely on the apparent identity of a caller or message rather than an independent verification system, increasingly convincing AI-generated communications can bypass traditional warning signs.

Artificial Intelligence Makes Impersonation Cheaper and More Convincing

Senior executives have always been targets for impersonation, but artificial intelligence lowers the technical barrier for criminals. Creating convincing written messages, generating realistic voices and maintaining a consistent identity across multiple communications can now be accomplished much more easily.

The technology does not need to be perfect. It only needs to be convincing enough to survive a short interaction and encourage the target to follow an established procedure. That creates a particularly difficult challenge for financial institutions. Banking employees are trained to detect suspicious transactions, but a payment can appear legitimate if the person requesting it appears to be a senior executive acting within normal authority.

The problem becomes more serious when criminals combine public information with AI. Executives’ names, professional roles, photographs, corporate structures and business relationships are often publicly available. Criminals can use that information to construct believable scenarios before making contact.

More than half of the stolen funds were reportedly recovered, demonstrating that international financial controls and investigative mechanisms can sometimes trace and freeze fraudulent transfers. However, the fact that tens of millions of euros remained missing illustrates how quickly stolen money can become difficult to recover once it moves across jurisdictions and financial systems.

Reports indicate that the money was transferred to overseas accounts, including accounts in China and Hong Kong, before some of it was recovered. That international dimension increases the complexity of investigations because different legal systems and financial institutions become involved. The recovery process can also be time-sensitive. Once money moves through multiple accounts, investigators face a race against further transfers, conversion into other assets and attempts to conceal ownership.

For banks, prevention is therefore more valuable than relying on recovery after the event.

Traditional Verification Systems Need to Change

The incident highlights why banks increasingly need verification systems that do not depend on voice recognition or messaging identity. A senior executive’s voice should not by itself be treated as proof that a transaction has been authorised. Independent confirmation through a known corporate channel can provide an additional layer of protection. For example, a payment request received through a messaging application could require confirmation through an internal banking system before funds are released.

The principle is simple: the same communication channel should not be allowed to establish both the identity of the requester and the authenticity of the transaction. This is particularly important for large international transfers because the financial consequences of one successful deception can be enormous. The wider significance of the Intesa incident is that cybersecurity is increasingly becoming a problem of human trust. Firewalls, encryption and network monitoring remain essential, but they do not prevent an authorised employee from willingly initiating a transaction after being deceived.

Artificial intelligence makes that deception more scalable. A criminal group can potentially target several executives or employees simultaneously, creating different communication identities and adapting responses in real time.

Banks therefore need to treat identity verification as a technological and organisational problem. Employees must be trained to assume that a familiar voice, message or video can be fabricated. Procedures need to make independent confirmation routine rather than optional. The incident also demonstrates why urgency is a powerful weapon in financial fraud. A request framed as confidential, time-sensitive and personally authorised by a senior executive can discourage employees from following normal verification procedures.

The central lesson is not that artificial intelligence makes banking unsafe. It is that the technology changes the methods criminals can use to exploit existing weaknesses.

Financial institutions will continue investing heavily in technological security, but protecting money increasingly requires securing the decision-making process itself. If criminals can manufacture convincing identities, banks must ensure that financial authority depends on verifiable procedures rather than convincing appearances.

(Adapted from NDTV.com)

Categories: Economy & Finance, Regulations & Legal, Strategy