A Cloned Lawyer’s Voice Helped Move €95 Million Out of Intesa Sanpaolo’s Private Bank

Reuters reported on 25 September 2026, citing two sources, that Fideuram, the private-banking arm of Intesa Sanpaolo, had transferred about €95 million to accounts in China, Hong Kong and elsewhere in February after its then-chairman, Paolo Molesini, was deceived by an impersonation of the group’s chief executive. The approach began with a WhatsApp message purporting to be from Carlo Messina, seeking urgent help with an overseas transaction. A phone call followed in what sources described as the AI-cloned voice of Paolo Nastasi, managing partner of A&O Shearman’s Italian practice, confirming the request. Nastasi was not involved.

Molesini resigned in March citing personal reasons. Milan prosecutors have placed a foreign national living outside Europe under investigation for computer fraud; neither Molesini nor other executives are under investigation. Roughly €53 million to €59 million has been recovered, by differing accounts, and about €36 million to €42 million is still missing. Intesa Sanpaolo and Fideuram declined to comment. Related attempts at two other Italian banks were reported by the OECD’s incident monitor.

The message from the CEO was the pretext. The call from the lawyer was the control that failed. A chairman asked to move €95 million on a text message would ask for confirmation, and the fraud supplied it in the voice of a person he knew, from a firm the bank uses, reportedly with eleven forged documents including a power of attorney. The corpus filed at 26-0510 the statistic that synthetic-voice fraud had become; this file is the individual case at the top of the distribution, and the mechanism is the same as the vishing at 26-0526 with the voice no longer a stranger’s.

The transfers happened in February. The chairman left in March. The public learned in September, from Reuters, not from the bank. There is no obligation on a bank to disclose a fraud against itself, and Intesa has not confirmed the figure or the method. The file is graded medium for that reason: the account is consistent across outlets and traces to a wire service with two sources, and no party with first-hand knowledge has spoken on the record.

The recovery of more than half is the notable number. Bank-to-bank transfers can be recalled if the receiving institution acts, and the fraction that was not recalled went through accounts that had already emptied. For the remainder the loss is the bank’s, and the person who authorised it has left. No customer funds were reported affected.