One of Italy’s most storied private banks is still missing €39.5 million after fraudsters used WhatsApp messages and an AI-cloned voice to impersonate its own executives — and Milan investigators now say at least part of the money was converted into Bitcoin before banks could freeze it.
By Ana Gonzalez | October 2, 2026
The Hook: A Chairman, a Fake CEO and Eleven Wire Transfers
Fideuram, the private banking arm of Intesa Sanpaolo, Italy’s largest banking group, transferred roughly €95 million abroad over just three days in late February 2026 after falling victim to an elaborate impersonation scheme, according to court documents summarized by ANSA and reporting from Corriere della Sera. The case has become a landmark example of how artificial intelligence is supercharging traditional financial fraud — and how cryptocurrency is being used as the exit ramp for stolen funds.
The scheme began on February 23, when then-Fideuram chairman Paolo Molesini received a WhatsApp message that appeared to come from Intesa Sanpaolo CEO Carlo Messina, according to Corriere della Sera. The sender presented the request as a confidential international acquisition and warned that a leak could prompt Italy’s securities regulator, Consob, to block the deal — conveniently explaining why the instructions had to stay off official channels.
The AI Voice Clone at the Center
A second contact then appeared to come from Paolo Nastasi, managing partner of A&O Shearman Italia and a lawyer Molesini personally knew. Nastasi had no involvement in the scheme. Investigators say the caller’s voice had been reproduced using artificial intelligence, and emails designed to resemble law firm communications supplied payment instructions and foreign account details, complete with a confidentiality agreement and a power of attorney bearing Messina’s signature.
The fraudsters did not rely on a single channel. According to the investigation, Fideuram’s treasury and payments manager received a separate call from a person posing as a senior Fideuram executive, who said Molesini would authorize urgent confidential payments. Eleven transfers totaling close to €95 million were ultimately sent abroad between February 23 and February 25, with substantial amounts routed to accounts in China and Portugal.
Where the Money Went — and How Much Came Back
- €95 million — the approximate total wired abroad in eleven transfers over three days.
- €42 million — funds sent to China that were blocked and returned, according to ANSA.
- More than €13 million — seized at a Portuguese bank after a Milan judge authorized the action.
- €39.5 million — the amount still unaccounted for, per the most recent court documents.
- Roughly €4 million — one reconstructed chain that passed through Malta, Luxembourg and the Netherlands, then a Canadian money-transfer platform, before reaching two Bitcoin wallets.
Reuters previously reported that roughly €53 million had been recovered overall, with around €36 million unaccounted for at the time of publication. The difference between earlier figures and the current €39.5 million reflects amounts disclosed at different stages of the investigation and recovery process, as crypto.news noted in its reporting.
The Core Conflict: Crypto as the Exit Ramp
For regular investors, the lesson is uncomfortable: once stolen funds pass through money-transfer platforms and land on public blockchains, recovery depends almost entirely on international cooperation moving faster than the criminals. Milan prosecutors are now investigating a 48-year-old Israeli citizen as a suspected member of the group, after linking him to one of the foreign accounts through which roughly €4 million passed before reaching the two Bitcoin wallets. Authorities are still verifying whether the identity documents tied to the suspect correspond to a real person or another layer of disguise, and international judicial requests are being used to obtain banking and crypto records from other jurisdictions.
No court has established who ultimately controlled the wallets or whether the identified individual participated in the original impersonation scheme — an important caveat in a case built largely on tracing money rather than catching perpetrators.
What Happened to Fideuram’s Leadership
Molesini himself is not under investigation, and Corriere reported that Fideuram has not brought legal proceedings against him. He resigned as chairman of Fideuram and Intesa Sanpaolo Private Banking on March 12 — several weeks after the transfers — citing personal reasons, with Tommaso Corcos taking over the chairman’s functions. The company’s announcement did not publicly connect his departure to the fraud.
The Verdict: AI Fraud Is Now Everyone’s Problem
Milan prosecutors are reportedly investigating other fraud cases that used similar combinations of fake emails, impersonation and voice cloning. The technique is no longer limited to billionaires or bank chairmen — everyday crypto users are being targeted with the same playbook, from fake exchange support calls to cloned voices of family members urging urgent transfers. The Fideuram case shows that even seasoned banking executives, surrounded by compliance staff, can be deceived when AI-generated voices and documents arrive from what look like trusted sources.
The practical takeaway is simple: no legitimate acquisition, investment or urgent payment should ever be authorized through WhatsApp alone, and any request that insists on secrecy and speed deserves maximum suspicion — whoever appears to be making it.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
a bank chairman moving 95 million euro because a whatsapp told him to. every single verification step failed at once
the cloned voice of Messina apparently got the tone right too. no callback procedure saved them, that is the scary part
the no callback part is what gets me. my tiny regional bank makes me verify with a phrase now and a private bank moved 11 wires off a whatsapp and a cloned voice lol
phrase verification only helps if staff refuse to say it to the real exec too. most wont when the voice sounds calm and the deadline is urgent
39.5M euros moved in eleven wires and nobody at Fideuram thought to call the chairman back on a known number. voice cloning still working at private banking level is wild
right? the WhatsApp angle is what got me. execs coordinating transfers over whatsapp with zero callback verification, thats the actual hole
eleven wires in three days and the internal pattern alerts triggered nothing. threshold monitoring exists for exactly this, someone had it tuned way too loose
worked a sepa fraud desk, 11 wires in 72 hours from an account that moves maybe 2 a month should flag instantly. someone whitelisted the beneficiary and the alerts went quiet
this matches what i saw on a corporate desk. whitelisted beneficiaries skip the queue and the limit bump is automatic, nobody audits the list after onboarding
Whitelisting would explain the silent alerts, and once a beneficiary is trusted the amount limits usually get bumped too. Eleven wires in three days makes sudden sense
the automatic limit bump on whitelisted beneficiaries is the smoking gun. 11 wires in 72 hours only clears monitoring if someone pre approved the receiver months ago
39.5 million still missing and part of it was already in BTC before the freeze orders landed in Milan. the exit ramp problem in one case
tracers keep finding the bitcoin wallets but finding and recovering are different sports. once it hits mixers that 39.5M is toast, the bank eats it
finding vs recovering, exactly. though Milan freeze orders did catch part of it before it hit BTC, so the bank is not eating the full 39.5M. the mixer slice though, gone
mixer slice gone is right, but the Milan freeze catching part of the 95M before the BTC leg means someone was awake at the receiving banks. small mercy
95 million euros out the door in three days and nobody at Fideuram thought to call the chairman back on a known number. eleven wires, zero callbacks, unreal
the cloned voice was of Messina specifically. imagine your own group CEO sounding calm and urgent at the same time, i dont fully blame the chair for freezing
callback on a known number has been table stakes in private banking since the 2019 ceo fraud attempts. the procedure exists, people just skip it when the boss sounds panicked
callback procedures fail exactly when the cloned voice says calling back will cost the client millions. duress training needs the ceo on record saying always verify me, most never record it
getting the ceo on record saying always verify me is the cheapest control imaginable. one internal video in the vault beats every duress policy doc nobody reads
39.5 million euros moved by a cloned voice that probably cost 40 bucks a month on some clone app. the ROI on fraud is completely out of control now
39.5M missing but 95M left the building in total. the part that got frozen before conversion is a footnote, the BTC leg is where this money actually died
intesa will absorb some of the loss but the reputational hit of a cloned Messina voice circulating among clients is worse than the missing 39.5M. every private banker in milan got a compliance email this week i guarantee it
tracers finding wallets is nice for headlines but nobody recovers funds past a decent mixer. that 39.5M is a write off, the court case is all thats left
two of those wallets got tagged to a kyc exchange within days tho. mixers slow tracers down, they dont stop them
two wallets tagged to kyc exchanges within days of the conversion. the btc leg bought time, not anonymity, mixers just spread the trail thinner
the chair moved 11 wires on a whatsapp and a cloned messina voice. a private bank charging fiduciary fees should have had a duress phrase, full stop