Your director's voice can be faked: Fideuram deepfake lessons for company payment controls

The message arrived on WhatsApp. It appeared to come from Carlo Messina, CEO of the Italian banking group Intesa Sanpaolo. The recipient was Paolo Molesini, then chair of Fideuram, the group's private banking arm. It asked for urgent help with an overseas transaction. A follow-up phone call came from a "senior lawyer" at an associated law firm, in a voice that turned out to be cloned with AI.

According to Reuters, as reported by Biometric Update on 15 October 2026, Molesini believed the request was genuine and instructed his finance department to arrange a series of transfers to foreign accounts, mainly in China and Hong Kong. The total was 95 million euros, about 108 million US dollars. Around 53 million euros has been recovered. The rest had already been moved overseas and converted into cryptocurrency.

This case matters not because the technology was clever. It matters because what got breached was not a server but the chain of command behind a payment.

The pattern keeps repeating

Fideuram is not the first case. The identifAI deepfake report, summarised by SecurityBrief on 14 October 2026, lists several others. At Arup, a finance worker transferred HKD 200 million (about 25.6 million US dollars) across 15 transactions after joining a video call in which every participant, including the CFO, was a deepfake. At Ferrari, attackers allegedly used a cloned version of the CEO's voice in WhatsApp audio messages to request an unauthorised currency hedge. At ABN AMRO, fraudsters used identity morphing and deepfake liveness bypasses to open 46 fraudulent accounts before they were detected.

Figures from the same report show where the threat is heading:

• Video synthesis accounts for 42.7% of observed deepfake fraud cases and voice cloning for 21.9%, a combined 64.6%.
• Identity fraud makes up 17.6% of incidents, and synthetic media now causes 1 in every 100 identity verification check failures worldwide.
• The raw material comes from social media. X accounts for 42.1% of reconnaissance activity and LinkedIn for 14.5%, drawing on interviews, podcasts and public appearances by senior executives.

Kate Burns of identifAI put it plainly: "Fraud used to need your password. Now it needs your face and a few seconds of your voice - and for most people, both are already online."

Most companies feel ready, fewer can stop the money

A survey of 230 senior financial leaders by Certos, the fraud prevention unit of Early Warning Services (reported by Payments Dive on 8 October 2026), shows the corporate side. Respondents came from Fortune 500 companies, venture-backed companies and charities, not banks or fintechs.

• 81% said their company had experienced an attempted fraud that involved, or appeared to involve, AI-generated or AI-enhanced content or techniques in the past year.
• The biggest concern was payment diversion (43%), followed by lagging controls or detection gaps (38%). Executive deepfake impersonation was cited by 21%.
• 84% said AI-enabled fraud is harder to detect. While 87% felt prepared, only half were confident they could identify a fraud attempt before money leaves the organisation.

That gap between "feeling prepared" and "being able to stop the money" is the point. Deepfake detectors can help, but the most reliable defence is process: who may request a payment, through which channel, and who must check it before money moves.

What this means for businesses in Indonesia

In many companies, from distributors and factories to startups and private clinics, day-to-day instructions really do run through WhatsApp and phone calls. That is practical. The risk appears when a message from "the director" is enough for finance staff to send money, especially when it is urgent, confidential and outside office hours. Photos and videos of executives on LinkedIn, Instagram and YouTube are enough raw material for a clone.

Seven steps you can start this week:

1. Write down that a message or call is never enough for a transfer. Set your own amount threshold. Above it, payment requests must come through an official system (ERP, procurement app or internal form) with supporting documents, no matter who sends them.
2. Call back through a second, registered channel. Ring the number in your internal directory, not the one the sender used. For executives, agree on a verification word or question that never appears on social media.
3. Require two people to approve in internet banking and the ERP. Separate whoever creates a transaction from whoever approves it, and make sure the approver is not the person under pressure from the "urgent request".
4. Tighten new beneficiaries and vendor bank changes. Add a holding period and independent verification for accounts used for the first time, especially overseas ones. Log every change to vendor bank details and review it regularly. Clean data trails also make reconciliation easier, as we covered in rechecking payment reconciliation.
5. Train teams on concrete red flags. Urgent, confidential, bypassing procedure and an overseas destination together should raise suspicion. Include finance staff, executive assistants and anyone holding bank tokens, and run occasional simulations.
6. Secure the accounts used to give instructions. A hijacked executive email or WhatsApp account makes fraud far more convincing. Use phishing-resistant sign-in such as passkeys for important accounts.
7. Do not let AI agents or automations pay on unverified input. The identifAI report warns that manipulated media and false inputs could influence AI agents before a payment ever reaches a bank. Limit execution rights and require human approval, in line with access limits for AI agents.

Prepare an emergency path too: who calls the bank, within how many minutes, and what information is needed to ask for a block or recall. In the Fideuram case, part of the money was recovered, while another part had already moved into crypto.

How MarkasDev helps

MarkasDev works as a Technology Partner in three phases:

• Diagnose: mapping how payments are actually requested and approved across the systems and channels in use, including WhatsApp, email, internet banking and the ERP, and marking every point where a single message can move money.
• Deliver: building in-system approval flows, vendor bank change verification, audit logs and permission limits for automations or AI agents, with written acceptance criteria.
• Operate: a retainer with SLAs and monitoring to keep controls running, review logs and refresh training scenarios. We explain how this differs from break-fix work in Maintenance vs Operate.

If you are not sure that a single voice note "from the director" could not move your company's money, book a Diagnose session to review your payment flow.

Sources

• Biometric Update, "Italian bank loses $108M to AI messaging fraud, as identifAI warns of deepfake threat" (15 October 2026, citing Reuters): https://www.biometricupdate.com/202610/italian-bank-loses-108m-to-ai-messaging-fraud-as-identifai-warns-of-deepfake-threat
• SecurityBrief, "Deepfake fraud market hits USD $40 billion, report says" (14 October 2026): https://securitybrief.news/story/deepfake-fraud-market-hits-usd-40-billion-report-says
• Payments Dive, "Finance leaders fight deepfakes" (8 October 2026): https://www.paymentsdive.com/news/finance-leaders-fight-deepfakes-Certos-fraud-prevention/832475/