Deepfake Financial Fraud: Cloned Bosses Steal €95 Million

Staff at an Italian private bank joined a video call with their senior executives. The faces looked right. The voices sounded right. So they approved the transfers. According to FinanceX Magazine, none of those executives was actually on that call, and the people behind it walked away with ninety-five million euros.

The bank is Fideuram

The bank is Fideuram. It belongs to Intesa Sanpaolo, one of Italy's biggest banking groups. The attackers didn't break through a firewall or crack a password. They built synthetic copies of trusted bosses, in voice and in video. Then they asked for money, and real employees said yes. If you've ever trusted a familiar face on a screen, this story is about you. That's an unsettling thought, and it's okay to feel it. So if a face on a video call can't prove who someone is anymore, what can?

Start with that call. Why didn't anyone question it? FinanceX argues the fakes didn't need to be perfect. They only needed to be good enough. Pair a good-enough face with urgency and a senior title, and people stop asking questions. Video calls make it worse, because we treat seeing someone as proof. Inside a company, that's a boss requesting a wire transfer. At home, it's a call from someone who looks exactly like your son, saying he's in trouble and needs money now.

Fideuram isn't alone. In Hong Kong, the engineering firm Arup lost about twenty-five million dollars after a staff member sat through a video call full of fake colleagues. Two video calls. Well over a hundred million dollars gone. According to FinanceX, deepfakes now make up about one in every fifteen fraud attempts worldwide. Three years ago, it was closer to one in a thousand. The magazine projects deepfake fraud will grow nearly sixfold this year. And security firm Keepnet Labs found that more than six in ten organizations faced a Janhvi Kapoor Deepfake Any Face Online Can Be Faked attack in the past year.

The tactics are shifting, too. Criminals used to target the moment you open an account. Now they're moving into conversations that already feel verified. The voice on the line really is the customer, or the colleague. Until it isn't.

Then there's the price tag

Then there's the price tag. FinanceX reports that a deepfake good enough to fool a bank's identity check costs about five dollars to make. Banks spend around forty euros verifying each new customer. Five dollars. That's less than a sandwich. The attacker spends pocket change, and the defender pays the bill.

Regulators have noticed. Europe now enforces a law called DORA, the Digital Operational Resilience Act. In plain terms, it holds banks responsible for how well they handle technology risk. National regulators are already reviewing banks, and FinanceX expects decisions before the year ends. Serious breaches can bring fines of up to a tenth of a bank's yearly global revenue. Critical tech suppliers that fall short can face penalties of one percent of their daily revenue. Every single day. For compliance teams, deepfake defense just moved from a wish list to the boardroom. For you, it means your bank may finally answer for attacks you could never have spotted yourself.

The banks have a fair counterpoint. They say no system stops a patient attacker who spent months researching the target. FinanceX agrees with them. Every extra security step also frustrates customers, and some just give up. But the article argues the goal isn't stopping every fake. It's stacking defenses so the attack stops paying off. That means liveness checks, which test whether a real person is in front of the camera. It means confirming requests on a second channel, like calling back a number you already know. And it means software that flags transfers that don't fit someone's normal habits.

The real failure at Fideuram wasn't the technology. It was a habit. Almost everyone knows the rule: hang up, and call back on a number you trust. Under pressure, from someone who looks like the boss, almost nobody does it. The attackers counted on that.