AI voice cloning fraud cost Fideuram approximately 95 million euros in a single February operation, with around 36 million euros still unrecovered and part of the funds traced to two Bitcoin wallets, according to reporting by Corriere della Sera and ANSA. The then-president of Fideuram, Paolo Molesini, authorized the transfers after being deceived by a fake WhatsApp message and an AI-cloned voice mimicking people he personally knew. This case deserves attention not only for the sophistication of the deception, but for the role cryptocurrency played in the final concealment phase.
One clarification before anything else: Paolo Molesini is the victim here, not a suspect. The people whose identities were impersonated, including Intesa Sanpaolo CEO Carlo Messina and a well-known corporate lawyer, had no involvement and no knowledge of being used as tools of the fraud.
How the Fraud Unfolded
According to the Corriere della Sera reconstruction, Molesini received a WhatsApp message that appeared to come from Carlo Messina, CEO of Intesa Sanpaolo, urgently requesting wire transfers to seize an international financial opportunity. To make the request credible, the fraudsters staged a phone call. The voice on the line sounded like Paolo Nastasi, managing partner of the Italian office of international law firm A&O Shearman, presented as the legal intermediary for the operation. Molesini knew Nastasi personally, and the voice struck him as genuine.
In reality, as reported by Corriere della Sera, the voice had been reproduced using AI-based vocal cloning tools trained on publicly available recordings, interviews, conference appearances, and corporate videos. Convincing emails with apparently authentic documents and bank coordinates followed. Molesini ultimately authorized the transfers, directed primarily toward accounts in China and Hong Kong.
Part of the funds was subsequently recovered by the Milan Prosecutor's Office. The amount still missing, however, remains substantial. Most sources cited by the Italian press indicate approximately 36 million euros; a separate reconstruction published by ANSA reports 39.5 million euros. Both figures are cited here pending a definitive and unified statement from investigators.
The Money Trail: Offshore Accounts and Bitcoin Wallets
According to Corriere Milano, the funds were routed through accounts opened in Malta, Luxembourg, and the Netherlands, as well as through a Canadian money transfer platform, before landing in two Bitcoin wallets. The route follows a pattern now familiar to anyone tracking international money laundering investigations: an initial pass through the traditional banking system across multiple jurisdictions, followed by a conversion into digital assets that are harder to trace and freeze once the money exits regulated intermediaries.
International letters rogatory are currently underway, according to judicial sources cited by the Italian press, targeting the cryptocurrency trail before any conversion to cash. That race against time is common to many investigations of this type. At least one name appears in the Milan Prosecutor's register of suspects, linked by some accounts to an Israeli citizen who may correspond to a fictitious identity. At this stage, that individual remains a suspect, not a convicted person, and the investigation continues.
Case Summary
What we know. Sources: Corriere della Sera, ANSA, Il Post, 2026
- The deception: fake WhatsApp message plus an AI-cloned voice of a lawyer the victim knew personally.
- The funds: approximately 95 million euros transferred, with 36 to 39.5 million euros still missing according to various sources.
- The route: Malta, Luxembourg, Netherlands, a Canadian transfer platform, and two Bitcoin wallets.
Not an Isolated Case: Other Italian Banks Targeted
Fideuram was not the only institution hit with a similar mechanism in the same period. According to ANSA, a manager at Banca Ifis authorized operations totaling approximately 24 million euros in May, with funds diverted across Spain, Singapore, Hong Kong, and Bahrain. Around 20 million euros from that case were recovered through a preventive seizure. A third incident, smaller in scale, involved a cooperative credit institution for roughly 2 million euros, with part of the funds later located in Croatia.
Three separate episodes, different amounts and jurisdictions, but united by the same core scheme: forged communications exploiting personal trust in a known figure, reinforced by AI voice cloning to bypass standard internal controls on high-value transactions. This connects directly to growing scrutiny of suspicious financial flows linked to crypto, a topic we explored when analyzing the Bitrace report on high-risk addresses.
The Bigger Picture
Beyond the specific gravity of this case, the Fideuram fraud exposes a structural vulnerability affecting the entire financial sector. AI-based voice cloning tools are, according to multiple sector analyses, now freely available, require no advanced technical expertise, and can be deployed near-anonymously. Anyone with a public profile, from conference speakers to executives who appear in corporate videos, is potentially exposed to this type of attack.
Technological deepfake detection is not yet reliable enough to serve as a primary defense. The most effective protection remains procedural: never authorize transfers on the basis of a single communication, always verify through a separate channel established beforehand (not the one referenced in the suspicious message), and require multi-person approval for high-value operations.
For anyone observing the financial crime landscape, two lessons stand out. First, three separate Italian financial institutions were hit with the same scheme within a few months, suggesting either an organized campaign or a technique now replicated independently by multiple criminal groups. Second, the routing of funds through Bitcoin wallets at the final concealment stage confirms a pattern visible in other investigations: cryptocurrency is increasingly used as the last link in a laundering chain that originates in traditional banking, not as the starting point of the fraud. SpazioCrypto will continue tracking developments in this investigation, particularly the outcome of international letters rogatory on the funds still unaccounted for.
