AI Impersonators Trick Bank Into $108M Transfers

Fraudsters impersonated senior leaders at Intesa Sanpaolo using WhatsApp and an AI-cloned voice call to convince Fideuram’s chair to authorize urgent overseas transfers. The finance team then sent multiple payments to foreign accounts (mainly China and Hong Kong), and only part of the money has been recovered.

Key findings

• Attack began with a WhatsApp message impersonating Intesa Sanpaolo CEO Carlo Messina and requesting urgent help with an overseas transaction.
• A follow-up phone call used an AI-cloned voice mimicking a senior lawyer to reinforce legitimacy and urgency.
• Victim leadership instructed finance to send a series of transfers to foreign accounts, mainly in China and Hong Kong.
• About €53 million was reportedly recovered; the remaining funds were sent overseas and converted to cryptocurrency.
• Article notes attackers can scrape executive audio/video (e.g., from LinkedIn) to build convincing impersonations at scale.

Who’s being targeted

• Commonly targeted roles: Executive leadership, Finance/Treasury, Accounts Payable, Fraud/AML teams, Executive assistants.
• Affected industries: Banking, Private banking, Financial services.
• Attack channels: whatsapp, vishing.
• Impersonated: Intesa Sanpaolo CEO Carlo Messina (message) and a senior lawyer at an associated law firm (call).

Awareness takeaways

• Treat WhatsApp (and other chat apps) as high-risk for executive payment requests; verify using a known, independent channel before acting.
• Do not rely on voice alone to authenticate callers, assume “voice can be faked” and require a second factor (e.g., call-back to a known number or internal approval workflow).
• Add friction to high-risk transfers (especially overseas): require out-of-band verification and multiple approvers for ‘urgent’ executive requests.
• Assume attackers can build deepfakes from public executive media; reduce exposure and train executives that their public audio/video can be weaponized.

Red flags to watch for

• Urgent request involving “overseas transaction” pressure
• Unusual payment destination (foreign accounts) and rapid “series of transfers”
• Identity ‘verified’ via voice only, which can be AI-cloned