Yassineh PourebrahimSenior Technology Executive
ENفا
All articles
Deepfake FraudVoice CloningBanking SecurityFraud Prevention

Deepfake fraud in banking 2026: what the €95 million voice-cloning case teaches banks about authorizing payments

In September 2026 Reuters reported that fraudsters using an AI-cloned voice and fake WhatsApp messages took €95 million from Fideuram, the private banking arm of Intesa Sanpaolo, and Milan prosecutors opened two more cases. In October, new research showed how badly voice deepfake detectors degrade on real phone calls, while Hong Kong banks reported sandbox results. What deepfake fraud in banking really exploits, why detection alone will not stop it, and a practical defense playbook for bank technology leaders.

By Yassineh Pourebrahim · · 8 min read

For years, the textbook example of deepfake fraud in banking was a case from 2024, in which an employee of the engineering firm Arup transferred $25 million after a video call with deepfaked executives. In autumn 2026 the industry got a new reference case, and this time the victim was a bank. According to Reuters, fraudsters using AI to impersonate senior executives took €95 million from Fideuram, the private banking arm of Italy's largest lender, Intesa Sanpaolo. Within weeks, Milan prosecutors were investigating two more similar cases, researchers published new evidence on how voice cloning fraud defeats detection over real phone lines, and Hong Kong banks presented results from deepfake detection trials. Read together, these events say less about clever AI and more about how banks authorize money movement.

What happened in the Fideuram case

Reuters reported on 25 September 2026, citing two sources, that the scheme began in February. Fideuram's then-chairman received what appeared to be a WhatsApp message from Intesa Sanpaolo's CEO asking for urgent help with an overseas transaction. A follow-up phone call appeared to come from a senior partner at a prominent law firm confirming the instruction; according to the sources, the callers used AI to replicate the lawyer's voice. Believing the request was genuine, the chairman instructed the finance department to arrange a series of transfers to foreign accounts, mainly in China and Hong Kong.

Two details matter for anyone who designs controls:

  • Fast detection limited the damage. Fideuram quickly detected irregularities in the transfers and alerted banks and authorities in several countries. Roughly €53 million was recovered through cooperation between authorities in China, Portugal and Italy.
  • What escaped became hard to trace. The remaining €36 million or so passed through a network of overseas accounts and was converted into cryptocurrencies, according to the sources.

On the same day, Italy's ANSA news agency reported that Milan prosecutors were investigating two further alleged frauds against credit institutions using similar schemes built on messages, email, AI and voice cloning. In one, a bank manager authorized transactions of more than €23.8 million in May after receiving emails from a mailbox that appeared to belong to a colleague; the money was routed through Spain, Singapore, Hong Kong and Bahrain, and part of it was frozen in Barcelona. In the other, involving a smaller institution, about €2 million was taken and partly recovered in Croatia. People following the investigations pointed to moments of vulnerability in which important instructions were trusted even though they arrived over messaging apps such as WhatsApp.

Why CEO impersonation fraud works on banks

None of these cases broke cryptography or hacked a core banking system. They exploited a much older weakness: authority by recognition. A message that looks like it comes from the CEO, followed by a voice that sounds like a trusted adviser, creates urgency and social pressure that bypasses ordinary process. Generative AI simply makes the recognition cues (a familiar name, a familiar voice, a confident tone) cheap to fake.

The raw material is easy to find. A deepfake report from the Italian provider identifAI, summarised by Biometric Update in October 2026, notes that attackers use platforms like LinkedIn to scrape high-fidelity audio and video of senior leadership and feed it into open-source generative models. The same report cites a Deloitte projection that generative AI could drive United States fraud losses to $40 billion by 2027.

The lesson for a technology executive is uncomfortable but useful: in CEO impersonation fraud the target is the authorization path, not the IT perimeter. Seniority is exactly what attackers borrow, so any process that lets seniority shortcut verification is the vulnerability.

What new research says about deepfake detection

The instinctive response is to buy a detector. October's research suggests that detectors help, but cannot be the gate.

1. Detectors that work on clean audio degrade on real calls

RealComm, from The Chinese University of Hong Kong, Shenzhen and Huawei, pairs digital speech with recordings of the same utterances transmitted through real mobile calls, covering speakerphone and handset use, different devices and phone-side noise suppression. Existing detectors showed substantial degradation after call transmission, even models with strong performance on digital audio, and playing the fake audio through a loudspeaker into the caller's phone was particularly challenging. Adapting detectors with simulated call effects and real-call training helped: for one detector, Teffic-Audio, the equal error rate fell from 37.94% to 22.37%. That is a real improvement, and still far from a level at which a single score should release a payment.

2. New voice generators outpace older detectors

VoxENES 2026, from the University of South Florida, tested eight pretrained detectors, without fine-tuning, against 53,628 English and Spanish samples from ten recent text-to-speech and voice-conversion systems, with realistic post-processing such as compression and noise. The best detector reached a 28.98% equal error rate overall, and five of the eight performed at or near chance. Against one zero-shot voice-conversion system, Seed-VC, no detector achieved an error rate below 41%. The authors describe a cat-and-mouse dynamic: detectors learn the artifacts of previous generators while new generators and ordinary post-processing remove them.

3. Image and selfie detection is showing progress, with caveats

Visual deepfakes in onboarding are a different problem from a cloned voice on a call. In the Hong Kong Monetary Authority's GenAI Sandbox, whose second cohort covered 27 use cases from 20 banks and 14 technology firms, Ping An Digital Bank reported detection accuracy of over 96% for forged or manipulated selfies in identity verification, and HSBC said none of around 20 deepfake attempts bypassed its security system. These are encouraging results, but as Biometric Update noted, limited public detail on testing methods makes it hard to compare systems or to know how they would perform against attacks outside the sandbox.

The pattern matches what I wrote about AI agent benchmarks: a score measured in one setting says little about your channel, your devices and your attackers. Any deepfake detection vendor should be tested on your own call paths and onboarding flows, against current generators.

Regulators are moving from detection to accountability

Supervisors are framing the problem as one of governance, not only technology. On 15 October 2026 the HKMA announced its "ART" Framework (Accountability, Resilience and Trust) for responsible AI in banking, with new supervisory guidance drawing on the sandbox and an upcoming discussion paper on agentic AI governance that explores intent-anchored accountability and a registry of material AI agents. In the United States, FinCEN issued an alert in November 2024 after observing an increase in suspicious activity reports describing suspected deepfake media, particularly fraudulent identity documents used to get around identity verification.

Banks are saying the same thing. Speaking at the Global Retail Banking Innovation Summit 2026, Lavy Stokhamer, Global Head of Cybersecurity and Financial Crime Technology at Standard Chartered, put it this way: "Trust has always been the currency of banking. In the age of deepfakes and autonomous AI, maintaining that trust requires us to verify not just transactions, but identities, intent, and authenticity at unprecedented scale." He also stressed that no single bank can address synthetic fraud alone.

A deepfake fraud defense playbook for bank technology leaders

This is the checklist I would bring to a bank's risk committee after the Fideuram case:

  1. Remove voice and chat from the authorization path. A phone call, voice note or WhatsApp message can start a conversation, but never authorize a payment. High-value instructions should only be executable inside the payment system, by authenticated users.
  2. Make seniority irrelevant to controls. Urgent, confidential requests "from the CEO" should face the same dual approval and segregation of duties as any other. Write this into policy so that a junior employee who refuses to skip a step is protected.
  3. Call back on a known number. Verification must use a channel the requester did not supply: a directory number, a registered device or an in-app approval. Confirming a request on the same channel it arrived on proves nothing.
  4. Sign the intent, not just the session. For large or unusual transfers, require cryptographic approval bound to the amount and beneficiary, using strong authentication tied to a registered device. This is the same principle of signed intent that card networks are building for agentic payments.
  5. Treat detection as a signal, not a gate. Use voice and image deepfake detection to raise risk scores and trigger step-up checks, never as the single reason to approve. Re-test vendors regularly against current generators and on real call paths.
  6. Harden the contact centre. Voice biometrics alone is no longer enough for high-risk actions such as changing a beneficiary or resetting credentials. The speech analytics pipeline I described in call center speech analytics can also flag social-engineering patterns such as urgency and secrecy for human review.
  7. Rehearse the recall. Fideuram recovered more than half the money because it detected the problem quickly and alerted banks and authorities in several countries. Pre-agree escalation contacts with correspondent banks, practise rapid freeze and recall requests, and measure time-to-alert.
  8. Train the people attackers target first. Executives, their assistants, treasury and finance teams are the targets. Run realistic simulations, including cloned voices of your own leaders made with consent, and share intelligence with peers and regulators.

Closing thought

The €95 million case is not a story about AI that is too good to detect. It is a story about an authorization model that still trusts a familiar name and a familiar voice. Detection will improve, and generators will improve with it. The durable answer is to make sure that no single message, call or face, however convincing, can move money on its own, and that every high-value instruction carries verifiable proof of who approved it and what exactly they approved.

References

Talk to me

Related articles

Agentic PaymentsBankingAI AgentsPayments Security

Agentic payments in 2026: how banks and card networks are learning to trust AI agents

Within a few days in October 2026, American Express, Mastercard, FIS, HSBC and Ant Digital each addressed the same question: when an AI agent pays, who authorized it, and to do what? How agent identity, signed purchase intent and scoped credentials are reshaping payment authorization, and what bank and fintech leaders should do now.

· 10 min read

Speech AnalyticsLLMCall CenterCustomer Experience

Call center speech analytics: measuring quality with speech recognition and LLMs

How to move from manually reviewing two percent of calls to scoring every call and chat against your own KPIs, using speech recognition, diarization and language models, with the safeguards that make the scores trustworthy.

· 5 min read

AI AgentsAI Agent EvaluationBenchmarksBanking Technology

AI agent benchmarks in 2026: why leaderboards mislead and how banks should evaluate AI agents

In October 2026 Stanford, Salesforce AI Research and a Tencent-led consortium published new research on AI agent benchmarks, while Santander and TD described how they test agents before production. What the new results say about leaderboard reliability, long-horizon work and partial credit, and a practical AI agent evaluation playbook for banks and enterprises.

· 7 min read