CEO Fraud Goes AI: What a Voice-Clone Bank Heist Teaches

Fraudsters stole about 95 million euros out of Fideuram, the wealth-focused unit of the bank Intesa Sanpaolo, using a WhatsApp message and a cloned voice, according to a report on CEO fraud and deepfakes published October 15. The case traces back to a Reuters story from late September. It is a vivid reminder that impersonation scams now sound real.

Running a company is stressful enough without worrying that your own voice could be copied. Still, small teams are exposed to the same tricks. If you have read our piece on scams targeting small businesses, consider this the next chapter.

How the Fideuram Scam Unfolded

The scheme began with a WhatsApp note that appeared to come from group chief executive Carlo Messina. Its target was Paolo Molesini, who chaired Fideuram at the time, and it pressed him to help with a time-sensitive foreign payment. Soon after, a phone call reinforced the story, this time in a synthetic copy of a senior attorney’s voice from a partner law firm.

Molesini then instructed his finance team to wire several payments, and most of the money landed in Chinese and Hong Kong accounts. Investigators later clawed back roughly 53 million euros. The balance moved abroad. Prosecutors in Milan are probing a suspect based outside Europe over alleged computer fraud.

Why Small Teams Face the Same Playbook

You might think a big bank is a different animal. It is not, at least in this respect. The scam relied on urgency, a trusted name, and a second voice that made the first message feel verified. Those ingredients work on any team with a founder who approves payments quickly.

The same report recalls Arup, which in 2024 lost $25 million when a staff member sat in on a video meeting full of fabricated executives. Together, the two cases show that attackers are layering channels. A message, then a call, then a video all feel like proof.

There is a human cost too. The person who authorizes a fraudulent payment often carries guilt for months, even when the scam was nearly flawless. A blame-free culture helps staff speak up the moment something feels off, which is when fast action can still claw money back.

Build a Callback Rule Before You Need One

Here is the fix that costs nothing. Adopt a written rule that no payment request over a set amount is approved in the channel where it arrived. Instead, your team calls back on a number already in your records.

• Require two approvers for new payees and for changed bank details.
• Agree on a private code phrase for urgent executive requests.
• Pause any request that stresses secrecy or a tight deadline.

Speed matters after a scam as well. In this case, roughly 53 million euros came back, which shows that quick reporting can save a large share. Call your bank immediately, then file reports with law enforcement and keep every message and call log.

Impersonation also arrives through collaboration tools. Our coverage of Microsoft Teams phishing shows how fake support contacts build trust inside familiar apps. Train your team to treat every unexpected request the same way.

Where Attackers Find Your Voice and Face

Cloning needs raw material, and public posts supply it. The report, citing identifAI, lists the platforms where impersonation content shows up most often. The figures below are that firm’s breakdown, not an independent count.

Executives are prime targets because their words and faces are everywhere. Still, the same breakdown shows private individuals at 18.2% and corporate entities at 15.8% of tracked targets, while business executives sit at 4%. In other words, attackers cast a wide net, and a smaller company is no safer for being less famous.

You do not need to vanish from social media. However, you can limit long, clean voice recordings and review who can see your videos. Pair that with basic small business cybersecurity habits such as multi-factor sign-in.

Finally, rehearse. Run a ten-minute drill each quarter where someone sends a fake urgent request and the team practices the callback. Practice turns a policy into a reflex, and reflexes hold up under pressure.

Questions Founders Ask About Voice-Clone Fraud

Is impersonation fraud illegal?

Yes. The FTC’s impersonation rule lets the agency pursue scammers who pose as businesses or government bodies.

How big could the problem get?

Deloitte, as cited by identifAI, expects US losses from fraud to climb to $40 billion by 2027 as generative AI spreads. Treat that as a projection, but plan as if it is close.

If you handle payroll or vendor payments yourself, this matters even more. A single approver is a single point of failure, and scammers know it. Adding a second set of eyes costs minutes and can prevent a loss that no insurance policy fully covers.

The calm takeaway is this: a good process beats a good ear. Write the callback rule today, share it with whoever moves your money, and practice it once.