Fideuram's €95M voice deepfake heist: what banks must fix now

A single phone call that sounded exactly like a senior executive reportedly cost Fideuram, the private banking arm of Intesa Sanpaolo, around €95 million (roughly $108 million). According to reporting on the case, attackers used AI-generated voice and messaging to impersonate executives, and the transfers passed internal checks before anyone realised the voice was not real. For fraud and security leaders, it is the clearest signal yet that voice deepfake fraud has moved from proof of concept to nine-figure losses.

What the Fideuram case tells us

Operational details are still thin, but the pattern is familiar: business email compromise, updated for the era of voice cloning. Instead of a spoofed email asking for an urgent payment, the request arrives as a voice that employees already trust. Authority, urgency and familiarity do the rest.

The case landed in the same week that identity-verification vendor identifAI published a report estimating deepfake-enabled fraud at about $40 billion. That figure is a vendor estimate rather than an audited number, but the underlying mix is telling:

• Video synthesis (42.7%) and audio voice cloning (21.9%) together account for roughly 65% of observed attacks.
• Synthetic media is behind about 1 in every 100 failed identity verification checks worldwide.
• Attackers harvest executive audio and video from public platforms such as X and LinkedIn.

Why traditional controls fall short

Most payment-approval processes were designed around a simple assumption: if you can hear the person, you can trust the person. Voice cloning breaks that assumption with only a few seconds of source audio.

Human judgement is not a control

Employees cannot reliably tell a cloned voice from a real one, especially under time pressure. Training helps awareness, but it cannot be the last line of defence for high-value transfers.

Legacy biometrics are being bypassed

The identifAI report also points to fraud-as-a-service tooling and virtual-camera injection that sidestep older biometric checks. Passive voiceprint matching alone, with no liveness or synthetic-speech analysis, can be fooled by a high-quality clone replayed or injected into the channel.

A practical defence stack for banks

No single control stops this threat, but layered defences make an attack far harder to complete. We recommend security teams prioritise:

1. Real-time deepfake detection on calls and video meetings that analyses the audio and video signal itself, so a convincing voice is flagged before funds move.
2. Out-of-band verification for high-value or unusual requests, using a pre-registered number or channel, never details supplied in the request.
3. Dual approval and cooling-off periods for large transfers, so no single phone call can authorise a payment.
4. Multimodal identity checks that combine voice, face and behavioural signals, making it much harder for an attacker to fake every factor at once.
5. Executive exposure reviews to understand how much public audio and video of leadership is available to clone.

From reactive to real-time

It also reframes the business case. A single successful impersonation can erase the budget of an entire fraud programme, and regulators are increasingly asking banks to show that their authentication and payment controls account for AI-generated media. Institutions that can demonstrate real-time detection, documented escalation paths and tested out-of-band checks will be far better placed, both operationally and in front of supervisors, than those relying on call-backs and staff vigilance alone.

The lesson from Fideuram is not that banks lacked controls; it is that the controls were built for a world where hearing was believing. Detection has to move into the conversation itself, working in real time and across voice and video, rather than relying on after-the-fact investigation.

Corsound AI's Deepfake Detect identifies synthetic audio and video as it happens, helping banks and financial institutions stop impersonation attempts before money moves. To see how it fits into your fraud stack, explore our solutions for banking and finance or request a demo of Deepfake Detect.