A voice clone cost this bank €95 million. What that means for your business.
An Italian bank lost €95 million after fraudsters used AI to clone a lawyer's voice — which means any business that approves payments by phone needs new rules, now.
- €95M
- transferred to fraudsters in a single AI voice-clone attack
- €36M
- still missing after being converted to cryptocurrency
- $25M
- stolen from Arup in 2024 using the same deepfake technique
- $40B
- projected annual AI fraud losses in the US by 2027
In February 2026, a senior executive at Fideuram — the private banking arm of Italy's biggest bank — received a WhatsApp message that looked like it came from his CEO, then a phone call that sounded like a trusted lawyer. Both were fakes. The voice on the call was generated by AI. He transferred €95 million to accounts in China and Hong Kong. A phone call from a familiar voice is no longer proof it is really that person.
This is not a one-off. In 2024, a finance employee at engineering firm Arup in Hong Kong wired $25 million after a video call with what appeared to be several company executives — all AI-generated deepfakes. Intesa Sanpaolo, Fideuram's parent company, says it has blocked thousands of AI-generated scam attempts targeting its CEO since January this year. Fraud specialists project that AI-driven fraud could cost US businesses $40 billion a year by 2027. The attack gets cheaper to run as the targets get bigger.
The fraud worked because the whole process rested on a single phone call. That was enough when faking a voice required expensive studio equipment. It is not enough any more. A few minutes of audio — scraped from a conference call, a podcast, or a LinkedIn video — is all an attacker needs to clone a voice convincingly. Any business that approves large transactions or sensitive decisions by voice alone has a gap it needs to close.
The fix is not complicated. Use a second channel: if someone calls to authorise a large transfer, call them back on a number you already know. Agree on a code word with key colleagues for unusual requests. Require written confirmation from a verified email for anything above a set threshold. Of the €95 million stolen, about €53 million was recovered — the remaining €36 million was converted into cryptocurrency and is gone. Better verification costs almost nothing; skipping it can cost millions. If your team still approves significant actions over a single phone call, that procedure needs to change today.