Italy's largest bank, Intesa Sanpaolo, has fallen victim to a sophisticated AI-assisted fraud scheme that cost it approximately €95 million, in what appears to be one of the largest known cases of so-called CEO fraud targeting a financial institution. The attack exploited deepfake voice technology alongside forged digital communications to deceive a senior executive into authorising a series of international wire transfers.
The fraud began in February, when Paolo Molesini, the chairman of Fideuram — Intesa Sanpaolo's private banking subsidiary — received a WhatsApp message that appeared to come from the bank's CEO, Carlo Messina, urgently requesting assistance with a foreign transaction. Shortly afterwards, Molesini received a phone call from someone presenting themselves as a senior partner at a well-known international law firm, seemingly confirming the request. The caller used artificial intelligence to replicate the voice of a lawyer already known to Molesini. Bolstered by additional forged emails, the deception was convincing enough that Molesini authorised a series of international transfers totalling around €95 million, directed primarily to accounts in China and Hong Kong.
Intesa Sanpaolo's internal security systems detected the irregularities relatively quickly. Working in coordination with authorities in Italy, China, and Portugal, the bank managed to recover approximately €59 million. The remaining €36 million has not been traced and is believed to have been moved through a network of foreign accounts before being converted into cryptocurrency, making it significantly harder to recover. Milan prosecutors have opened an investigation into the case, with reports indicating that a suspect living outside Europe is in their sights on suspicion of computer fraud. The bank has stressed that its own IT systems were never hacked.
Molesini resigned from his position in March, just weeks after the incident, citing personal reasons. Neither he nor other Fideuram executives are reported to be under investigation. The scale of the attack is a stark illustration of the growing threat posed by AI-generated fraud in the corporate world. Intesa Sanpaolo's head of security has revealed that the bank routinely faces CEO fraud attempts and has already identified and removed around 5,000 fake videos featuring the likeness of CEO Messina since the beginning of the year alone.
Why this matters: the Intesa Sanpaolo case signals a worrying escalation in the use of generative AI as a tool for financial crime. Prosecutors have urged all banks not to assume they are immune to such attacks. As deepfake audio and video technology becomes increasingly accessible, even experienced executives at major institutions can be deceived — raising urgent questions about verification protocols and the resilience of corporate security procedures worldwide.