Scammers Allegedly Used an AI-Cloned Lawyer's Voice to Defraud Italian Private Bank Fideuram

Scammers allegedly used an AI-cloned lawyer's voice to validate a WhatsApp request impersonating the CEO of Italian bank Intesa Sanpaolo. Fideuram, its private-banking subsidiary, reportedly transferred about €95 million overseas after its chairman accepted the instructions. Part of the money was recovered, but tens of millions reportedly remained missing. Milan prosecutors opened a fraud investigation.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involved scammers using AI voice cloning to impersonate a trusted lawyer to execute a high-value financial fraud against a bank executive.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was initiated by human scammers who intentionally deployed a voice cloning AI tool post-deployment to commit financial fraud.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system used is an AI-generated content tool (deepfake/voice clone). The EU AI Act classifies AI-generated content such as deepfakes under Limited Risk, requiring transparency obligations, though in this case, it was used maliciously by bad actors.

AI system and alleged parties

• AI system: None named
• AI purpose: Voice Generation; Text Style Replication
• Behaviour type: Tool
• Alleged developer: Voice cloning technology developers, Synthetic media generation technology developers, Synthetic audio generation technology developers, Deepfake technology developers
• Alleged deployer: Voice cloning impersonation scammers, Synthetic media creators, Scammers targeting Fideuram, Scammers, Impersonation scammers, Deepfake creators
• Alleged harmed parties: Victims of voice cloning impersonation scams, Victims of impersonation scams, Privacy, Paolo Nastasi, Paolo Molesini, Lawyers, Intesa Sanpaolo, Financial scam victims, Fideuram, Epistemic integrity, Banks

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Substantial, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The reports explicitly describe a financial loss of 95 million euros, of which 36 million euros remains missing. This occurred in 1 primary incident, making the average loss per occurrence 95 million euros initially, with a net permanent loss of 36 million euros.

Directly caused: The fraudulent transaction directly caused Fideuram to transfer 95 million euros to overseas accounts, with 36 million euros currently unrecovered.

Inferred additional harm: The bank and its parent company likely incurred additional indirect financial costs related to legal fees, internal investigations, and security audits following the incident.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 2

Potential causes

Management

• Inadequate Risk Assessment: Failed to evaluate risks associated with AI-driven social engineering.
• Lack of Executive Training: Executives were not trained to recognize voice cloning or deepfakes.

Technology

• AI Voice Cloning: Replicated a known lawyer's voice to confirm fraudulent instructions.
• WhatsApp Spoofing: Impersonated Intesa CEO via chat to initiate the contact.
• Email Spoofing: Perfectly crafted emails made to look like they came from a real law firm.

Data Inputs

• Voice Data Availability: Target's voice was accessible enough to train the AI cloning tool.
• Corporate Context Leakage: Knowledge of failed Generali acquisition made the scam highly credible.

Human Factors

• Authority Bias: Chairman complied due to believing the request came from the group CEO.
• Urgency Manipulation: Fraudsters induced panic and demand for speed to bypass normal checks.

Process and Methods

• Weak Out-of-Band Verification: Lack of independent verification of the identity of the calling lawyer.
• Flawed Transfer Approvals: Finance department executed huge transfers based on verbal instructions.

Regulatory Environment

• Weak AI Safety Regulations: Lack of regulatory guardrails on the deployment of voice cloning tools.
• Crypto Regulatory Gaps: Allowed rapid conversion of stolen fiat currency into untraceable crypto.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from multiple reputable sources (ANSA, Corriere della Sera, Reuters) are highly consistent regarding the core facts: the date, the target (Fideuram/Molesini), the amount stolen (95 million euros), the amount recovered, and the use of AI voice cloning to impersonate a lawyer. There is very little ambiguity about the sequence of events.
• Ambiguities identified: Minor discrepancies exist regarding the exact amount recovered and currently missing (some reports mention 39.5 million missing, others 36 million), but the overall scale is clear.
• Alternative interpretations: None. It is clearly a case of AI-enabled financial fraud.

International scammers used AI voice cloning to impersonate a lawyer, defrauding an Italian private bank of 95 million euros (36 million euros unrecovered). While a highly sophisticated financial crime representing an evolved AI threat capability, the incident has minor national security implications as it did not target critical infrastructure, government functions, or economic stability.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: Italy
• Other affected: China, Portugal
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The active crisis has concluded, but the incident represents an ongoing strategic concern regarding AI-enabled financial fraud capabilities.
• Autonomy: Human-controlled. The voice cloning AI was used as a tool directly controlled and deployed by human fraudsters to execute the social engineering scheme.
• Novelty: Evolved capability. While voice cloning fraud is an established threat, the scale of the financial target and the sophistication of the multi-stage social engineering represent an evolved capability.

Impact by dimension

• Physical security: Negligible. No physical assets, critical infrastructure, or human safety systems were targeted or affected by this AI-enabled financial fraud.
• Information security: Negligible. The incident involved highly sophisticated spear-phishing using cloned voices, but was aimed at criminal financial gain rather than state-sponsored intelligence compromise or mass disinformation.
• Sovereignty: Negligible. The attack targeted a private banking institution and did not compromise state authority, electoral systems, or core government operations.
• Economic security: Minor. The unauthorized transfer of 95 million euros (with 36 million euros unrecovered) from a major private bank represents a significant financial loss, but does not threaten national economic stability or strategic industries.
• Societal stability: Negligible. The incident had no widespread impact on civil liberties, social cohesion, or public safety, though it led to the resignation of the bank's chairman.