Paolo Molesini ran a private bank in Italy. Back in February, he got a WhatsApp message that looked exactly like it came from his boss. Then, a phone call from a lawyer, vouching for the whole thing. Neither one was a real person. He authorized €95 million in wire transfers anyway.
What actually happened
Molesini was chairman of Fideuram at the time, a private bank owned by Intesa Sanpaolo, one of Italy's biggest banking groups. The WhatsApp message appeared to come from Carlo Messina, the parent company's CEO, asking for help with an urgent transaction. A few minutes later, a call came in from someone claiming to be a managing partner at a well-known law firm, confirming it was all legitimate. That voice was AI-generated.
Over the next few days, the scammers sent eleven fake documents — confidentiality agreements, a power of attorney, with Messina's forged signature on each document. Unfortunately, Molesini wired the money: €95 million, split across accounts in China and Hong Kong.
The company caught it faster than you'd think. They noticed the transfers looked off, alerted banks and authorities in multiple countries, and clawed back €53 million. However, €36 million was gone, already converted to crypto.
Why this actually matters
Banks moving billions of dollars a day are big targets, but so are businesses your size. The FBI's latest crime report counted $893 million in AI-enabled fraud losses in 2025 — and congressional researchers estimate fewer than 5% of voice-clone scam victims ever report it, so the real total is almost certainly a lot higher. Pindrop, which tracks fraud across corporate call centers, found deepfake fraud attempts went from about one a month to roughly seven a day in a single year — a jump of more than 1,300%.
Amazingly, these tools don't need much to work. About three seconds of clean audio — a voicemail greeting of you saying, "hi, you've reached...", or a clip from a webinar, — is enough to build a voice that'll fool someone on a phone call. Every leader who's ever recorded an all-hands meeting, done a podcast interview, or left a voicemail has already handed out the raw material.
What to do about it
The question isn't whether someone could clone your voice or your boss's. Assume they can. It's whether your team has a way to catch it when someone tries.
- Does your finance team have a rule that any payment request arriving through a new channel — a text, a WhatsApp message, a surprise call — gets confirmed by calling a number you already have on file, never one given in the message itself?
- Is there a dollar threshold above which a transfer needs a second person's sign-off, no exceptions, no matter how urgent it sounds?
- Is your team educated about these potential scams? Make sure your team has heard of voice cloning before the day someone tries it on them.
The bottom line
Scammers will continue using technology that makes it easier to fool your team into making a bad decision. Have a process in place to verify the caller and call back on a number you already know. Make sure your team is getting regular security training that will keep them informed of potential scams like these. Your people are your best and, in some cases, only real defense.
Talk to us about how we provide weekly, monthly and annual Security Awareness Training messaging, videos and webinars that will help your team avoid making an expensive mistake.
— Rick