BLOG

Source: Reuters, “AI messaging scam costs Italy’s top bank Intesa millions, sources say”, 25 September 2026

In September, Reuters reported that fraudsters using AI to impersonate senior executives had taken €95 million from Fideuram, the private banking arm of Intesa Sanpaolo. It is one of the largest AI voice clone fraud cases reported to date, and the most instructive for private offices, because nobody broke into anything. A genuine decision-maker, persuaded by a counterfeit message and a counterfeit voice, used real authority to move real money. That pattern applies just as well to a family office with a small team and a principal whose word is final.

This commentary summarises what has been reported, explains why the case matters for families and private offices, and sets out practical steps worth reviewing now.

What was reported

According to Reuters, citing two sources familiar with the matter, the scheme began in February 2026, when the then chairman of Fideuram received what appeared to be a WhatsApp message from the chief executive of the parent group, asking for urgent help with an overseas transaction. A phone call followed that appeared to come from a senior partner at a prominent law firm, confirming the instruction. The sources said the callers used AI to replicate the lawyer’s voice.

Believing the request was genuine, the chairman instructed the finance department to arrange a series of transfers to foreign accounts, mainly in China and Hong Kong. Fideuram detected irregularities quickly and alerted banks and authorities in several countries. Roughly €53 million was later recovered through cooperation between authorities in China, Portugal and Italy. About €36 million was not traced after passing through overseas accounts and being converted into cryptocurrency. Intesa Sanpaolo and Fideuram declined to comment, and the account rests on unnamed sources. Reuters also noted that no Fideuram executive is under investigation, and that the scheme was first reported by Corriere della Sera.

The same Reuters report recalled an earlier Italian case, in which fraudsters used AI to mimic the voice of a government minister and persuaded a businessman to transfer nearly €1 million abroad. That money was later recovered.

Why this AI voice clone fraud matters for private offices

Executive impersonation is an old fraud. Three features of this case are worth dwelling on.

The target was the most senior person in the room. Controls in many organisations are designed to stop a junior employee from acting on a strange request. They are rarely designed to stop the person at the top. In a family office, the principal or a senior family member often sits above every written procedure, and staff are understandably reluctant to slow down an instruction that appears to come from them.

The “confirmation” was part of the attack. A careful person asked to move a large sum on the strength of a text message would want confirmation. In the reported scheme, the fraudsters supplied it themselves, in the voice of a trusted adviser. A call that arrives to confirm a request is not verification, because the other side chose the channel, the timing and the witness.

A familiar voice is no longer a credential. Anyone who speaks at conferences, gives interviews or appears in recorded meetings should assume their voice can be imitated. That includes principals, family members, lawyers, bankers and trusted advisers.

Speed decided the recovery

The reported outcome also carries a positive lesson. More than half of the money came back, and on the reported account it came back because irregularities were spotted quickly and banks and authorities in several countries were alerted promptly. The portion that reached cryptocurrency was not traced.

For a private office, the equivalent question is simple: if a fraudulent payment left your account this evening, who would notice, who would they call, and do they have the numbers? An office without a written escalation route, including out-of-hours bank fraud contacts, loses the hours that matter most. Our guide on what a crisis advisor does in the first 48 hours covers the wider response.

Practical steps to review now

1. Make verification apply to everyone, including the principal. Agree with the family, in writing and in advance, that any payment instruction above a set threshold will be verified, whoever it appears to come from. The principal’s explicit backing protects staff who follow the rule.
2. Call back on a number held on file. Never verify on the channel the request arrived on, or on a number supplied in the request. Use a directory maintained independently and checked periodically.
3. Treat incoming “confirmation” calls as unverified. A lawyer, banker or colleague who calls to confirm an instruction you did not expect is part of the request, not a check on it.
4. Use dual authorisation that a single person cannot override. For new beneficiaries, foreign transfers and amounts above a threshold, require two people, through separate channels.
5. Agree on challenge words or questions. A simple pre-agreed phrase or question, known only to the people who give and act on instructions, defeats a cloned voice cheaply.
6. Be suspicious of urgency and secrecy together. Requests to act fast, keep the matter confidential and bypass normal channels are the classic signature of impersonation fraud.
7. Write down the first hour. Keep a short escalation sheet: your banks’ fraud lines, including out-of-hours contacts, your legal adviser and who inside the office leads. Rehearse it once a year.
8. Brief the wider circle. Assistants, household staff and outside advisers should know the verification rules, so they are not the weak point.

For a fuller treatment of verification routines, see our guide on how family offices verify instructions against voice-clone and deepfake fraud, and our family office security checklist.

What this case does not tell us

The public reporting does not describe which approval steps the transfers passed through, and neither bank has commented. It would be wrong to draw conclusions about this institution’s internal controls. The value of the case is in the pattern it illustrates, not in judging the people involved.

Frequently asked questions

How does AI voice clone fraud work?

Fraudsters use short samples of a person’s recorded voice to generate speech that sounds like them, then use it on a phone call, often alongside a fake message, to make an urgent request appear genuine.

Can a family office be targeted the same way as a bank?

Yes. The conditions are often more concentrated: a small team, a principal whose instruction carries great weight, and payments that may be authorised by phone rather than through a formal process.

What should we do if we suspect a fraudulent transfer has gone out?

Contact your bank’s fraud team immediately, using a number you already hold, and ask them to attempt a recall. Then involve your legal adviser and report to the authorities. Speed matters more than anything else.

Does insurance cover this kind of loss?

It depends entirely on the policy wording. This is a question for your broker and legal adviser; we can help you frame it as part of a wider review.

8Dimension advises a small number of principals, families and private offices by referral, through our family office advisory and crisis and high-risk advisory work. If you would like a discreet review of how your office verifies instructions and responds to fraud, we would be glad to arrange a private introduction.