AI Impersonation Scam Costs Italian Bank Nearly €100 Million

What happened

An AI-driven messaging scam has cost one of Italy's largest banks close to €100 million, according to reporting by TechRadar. The bank's chairman was reportedly convinced he was corresponding with the institution's lawyer, and on the strength of that exchange authorised a substantial wire transfer that ultimately flowed to the fraudsters.

The available reporting does not specify the exact AI technique used — whether voice cloning, deepfake video, or convincingly generated text and documents — but the core mechanism was impersonation: attackers used AI tools to mimic a trusted internal or professional contact closely enough to bypass the chairman's normal scepticism and trigger a high-value financial instruction.

Why it matters

This incident is a stark demonstration of how generative AI has lowered the barrier to convincing, targeted impersonation at the highest levels of an organisation. Where social engineering once relied on generic phishing emails, attackers can now synthesise the tone, style and even voice of a specific named individual — a lawyer, an executive, a regulator — with enough fidelity to fool someone who should, in principle, be alert to fraud.

For leaders in digital transformation and security, the case underlines that identity verification can no longer rest on familiarity or "sounding right." Organisations handling large financial transactions need layered authentication — callback protocols, multi-person sign-off, out-of-band verification — that assumes any single channel of communication, however convincing, could be synthetic.

By the numbers

• Nearly €100 million was lost by the bank as a result of the scam.

The Renascence take

The headline detail here isn't the technology — it's the trust shortcut. A chairman didn't fall for a crude email; he fell for a relationship cue, the sense of "I know this person's voice, tone, style." That is precisely the vulnerability AI-enabled fraud is built to exploit, and it sits squarely in behavioural-economics territory: authority bias and familiarity heuristics, not technical naivety, are what get bypassed.

Most organisations will read this story as a cybersecurity failure and respond with more firewalls and awareness training. The sharper response is to redesign the decision moment itself: build friction — mandatory callback to a known number, dual authorisation, a cooling-off window — into any high-value instruction, regardless of who appears to be asking or how convincingly they ask it. If your control model depends on someone correctly judging, in real time, whether a voice or message "feels right," AI has already made that judgement unreliable, and the fix is procedural, not perceptual.