Deepfake Impersonation: Cloned Voice Drains €95M From Bank

Police in Milan say someone at an Italian private bank got WhatsApp messages that appeared to come from the company's chief executive. Then came a phone call from a lawyer, ready to close the deal. That lawyer's voice was built by A.I. And by the time anyone realized it, ninety-five million euros had left the bank and gone overseas.

Ninety-five million euros

Ninety-five million euros. From a voice that didn't belong to anyone. If you've ever posted a video of yourself talking, or left a voicemail, this story touches you too. It's unsettling to learn that the sound of someone you trust can be copied. That feeling is reasonable. So let's look at what actually happened, and what actually stops it. According to BigGo Finance, the bank was Fideuram, the private banking arm of Italy's largest bank. The scammers used two channels. Text messages posing as the boss built trust. A cloned voice on the phone sealed it. CryptoNews reports that about thirty-six million euros of that money got converted into cryptocurrency. It hasn't been recovered. So if hearing a familiar voice no longer proves who's on the line, what does?

Start with how little it takes. According to research gathered by Polygraf A.I., modern cloning tools can build a convincing copy of a voice from about three seconds of clear audio. Three seconds. That's shorter than saying your own name and where you work. Executives give away far more than that. Earnings calls. Conference talks. Podcasts. LinkedIn videos. For a company, that means every public appearance doubles as raw material for a forger. For the rest of us, it means a birthday video on social media could be enough to fake your voice on a call to your mom.

How often is this happening? Contact center data compiled by StingRay shows deepfake fraud attempts jumped from roughly one a month to about seven a day during twenty twenty-four. Allure Security says scams impersonating chief executives now target at least four hundred companies every single day. And this didn't start with voice alone. In early twenty twenty-four, the engineering firm Arup lost about twenty-five million dollars. One employee joined a video call with what looked like a room full of colleagues. Every single person on that call, except the victim, was a deepfake. Picture sitting in that meeting, nodding along, the only real human in the room.

The banks have noticed

The banks have noticed. According to the American Bar Association, about nine in ten U.S. banks are rethinking whether to use voice verification for their major customers. That's the "say your passphrase" check many of us have used to reach our own accounts. The industry spent years treating your voice like a key. Now the people who built that lock are admitting someone can copy the key. Which, honestly, is better than pretending it still works.

Analysts at Gartner describe these attacks as coordinated. Fake emails, fake messages, stolen personal details, and synthetic voices all get layered together. The Fideuram case followed that playbook exactly. No single message would've fooled anyone on its own. For investigators and insurance fraud teams, the old standard of "I heard it straight from them" can't carry a case anymore. Proof of identity now has to come from somewhere other than a voice or a face on a screen. For everyone else, it means a call that sounds exactly like someone you love deserves a second check.

And that check works. In twenty twenty-four, an employee at the password company LastPass got WhatsApp voice messages from what sounded like the C.E.O. The messages pushed urgency. They came through an odd app, outside business hours. That employee didn't act. They reported it. The scam went nowhere.