The case: apparent authority overcame context
According to Reuters and ANSA, a fraud against Fideuram in February 2026 used messages falsely attributed to Intesa Sanpaolo’s CEO and an AI-cloned call impersonating a lawyer. Transfers of about €95 million were sent abroad; a significant part was later recovered or blocked. Sources report different residual-loss figures in their reporting, so the useful lesson is not a single number but how a chain of plausible signals created enough trust to authorise action.
Reuters, ANSA and Rai News reconstructed the case on 25 September 2026. At that date, an investigation by Milan prosecutors was reported. No published primary investigative document was used: named facts are therefore attributed to concordant reporting, conflicting residual-loss figures are not presented as a single certain amount, and the article does not establish individual responsibility.
The vulnerability was not only the voice
A familiar voice can reinforce a story already made credible by authority, urgency and narrative consistency. Risk rises when several signals depend on the same story but are mistaken for independent verification.
- Apparent authority: the request seems to come from someone entitled to instruct.
- Familiarity: voice, names and context reduce the instinct to challenge.
- Urgency: time becomes part of the attack and compresses verification.
- Constructed consistency: message and call corroborate each other narratively, but they are not two independent sources.
The control that breaks the chain
In the age of voice cloning, “I recognised the person” cannot be a sufficient control. A sensitive instruction must survive verification that does not depend on the channel through which it arrived.
- Callback to a pre-existing trusted contact point independent from the incoming request.
- Second channel or organisational confirmation for exceptional instructions.
- Four-eyes and escalation thresholds proportionate to amount, destination and deviation from normal process.
- Verification of economic rationale and actual authority, not only apparent identity.
- A real ability to stop the transaction when context or evidence is insufficient.
AI vs AI: the endpoint remains human
Detection can flag anomalous communications or a destination outside the normal process. The practical question remains specific: which independently authorised person may validate or stop this instruction, and what evidence supports that action? A second approver relying on the same incoming message is not an independent corroboration.
Practical test
Take a high-impact authorisation process and assume that voice, video, email and messaging can all be synthetic. If the process has no verification point independent from the attacker and no owner empowered to stop the action, the control still relies too heavily on appearance.
- Which channel is genuinely independent?
- Which event forces a second approval?
- Who can say stop without being overridden by urgency?
- What evidence remains after the decision to show what was verified?
Sources and references
Case reporting: Reuters, ANSA and Rai News, 25 September 2026. FATF provides the deepfake risk framework; it does not confirm the named case. No published primary investigative document was used: named facts remain attributed to concordant reporting.
Informational content. It does not replace an assessment of a specific case.
Reuters — AI messaging scam costs Intesa/Fideuram millions, 25 September 2026ANSA — Fideuram fraud involving WhatsApp and voice cloning, 25 September 2026Rai News — Fideuram WhatsApp and AI fraud report, 25 September 2026FATF — Horizon Scan AI and Deepfakes