Fideuram voice deepfake — Sep 2026
Fideuram bank lost 36 million euros after a chairman was deceived by a fake WhatsApp message and an AI-cloned voice impersonating a trusted lawyer
- Reported date
- Sep 25, 2026
- Target
- Fideuram
The exact incident date was not established. This entry is dated by its source report.
In February 2026, Fideuram, a subsidiary of Intesa Sanpaolo, suffered a massive financial loss after its then-chairman, Paolo Molesini, was targeted by a sophisticated social engineering attack. Believing he was acting on an urgent request from the parent group's CEO, Carlo Messina, Molesini authorized a series of transfers totaling approximately 95 million euros. While international cooperation and legal interventions allowed for the freezing of some assets, at least 36 million euros remain unrecovered, having been converted into cryptocurrency.
What happened
The attack utilized a multi-layered approach to bypass standard security protocols. It began with a fraudulent WhatsApp message appearing to originate from Carlo Messina, which emphasized the extreme urgency of transferring funds for an operation abroad. To solidify the deception, the attackers orchestrated a follow-up phone call featuring a synthetic voice replica of Paolo Nastasi, a managing partner at A&O Shearman Italia and a lawyer well-known to Molesini. Nastasi was entirely unaware of the incident and had no involvement in the scheme. The attackers leveraged the lawyer's public presence, utilizing existing audio recordings to train an AI model capable of mimicking his voice with high fidelity. Following the call, the bank details for the transfers—directed to accounts in China and Hong Kong—were delivered via email. Molesini subsequently instructed the chief financial officer to execute the payments. The incident is currently under investigation by Milan prosecutors, who are utilizing international letters rogatory to track the stolen funds. While authorities successfully froze over 40 million euros in China and 13 million euros in Portugal, the remaining 36 million euros were moved through cryptocurrency channels, complicating recovery efforts. This case highlights the vulnerability of high-level executives to AI-driven impersonation, where the combination of perceived authority, manufactured urgency, and realistic synthetic audio can override established institutional caution.