Deepfake Threat Report, Week of 28 September 2026: A Cloned Voice Helped Move €95M Out of Intesa's Fideuram

Which deepfake incidents were reported between 22 and 28 September 2026?

Five confirmed items came out of this week. Three involve money lost after a faked identity was trusted: Fideuram, two more Milan bank cases, and a Bengaluru investment scam. The other two measure readiness: a study of how well Australians spot political deepfakes, and a vendor survey of security leaders.

Dates below are when the event happened where the reporting gives one, otherwise the date it was first reported.

How did a cloned voice help move €95 million out of Fideuram?

Reuters reported on 25 September, citing two people familiar with the matter, that Fideuram sent about €95 million to overseas accounts after a combined messaging and voice attack in February. Paolo Molesini, then chairman of Intesa Sanpaolo's private banking arm, received a WhatsApp message that appeared to come from group CEO Carlo Messina asking for urgent help with an overseas transaction. A follow-up call then confirmed the request in the voice of a senior partner at a prominent law firm. AI was used to replicate that lawyer's voice.

The attack worked because each step borrowed authority from a different trusted person. The message carried the CEO's name; the call carried a familiar professional voice that heise reports the manager already knew. Molesini then asked the finance department to make a series of transfers, mainly to accounts in China and Hong Kong. This pairing of a text pretext with a cloned voice is the pattern behind most executive impersonation scams we track.

Fideuram noticed irregularities and alerted banks and authorities in several countries. According to the Reuters sources, cooperation among Italian, Chinese and Portuguese authorities recovered about €53 million, while about €36 million was moved through overseas accounts and converted into cryptocurrency. Milan prosecutors placed a foreign national living outside Europe under investigation on suspicion of computer fraud. Molesini resigned in March citing personal reasons; neither he nor other Fideuram executives are under investigation. Intesa Sanpaolo and Fideuram declined to comment.

The control that would most likely have stopped it is procedural: an independent callback to the CEO and the lawyer on numbers held in the bank's own directory before any transfer of that size. On the technical side, real-time analysis of the call audio for synthetic speech gives the approver a second reason to pause. Our guide to voice cloning attacks covers how these voices are built from short public samples.

What other AI impersonation bank frauds are Milan prosecutors investigating?

On the same day, ANSA reported that Milan prosecutors are investigating two more frauds against banks that follow a pattern similar to Fideuram's, using messages, emails, AI and voice cloning. In the larger case, a bank manager authorised transactions totalling over €23.8 million in May after receiving messages from an email address that appeared to belong to a colleague at the same bank. The money passed through accounts in Spain, Singapore, Hong Kong and Bahrain, and part was seized in Barcelona.

heise later named the bank as Banca Ifis and reported that about €20 million was recovered. The second case hit a smaller bank for about €2 million, part of which was recovered in Croatia. Investigators told ANSA that at least three similar cases are open in Milan and that fraudsters exploit the habit of trusting important instructions sent through apps such as WhatsApp.

The published detail for the €23.8 million case describes email impersonation rather than a cloned voice, so the right control there is email authentication and a rule that payment instructions from a colleague are confirmed on a second channel.

How did deepfake videos of Modi and Ambani cost a Bengaluru investor over Rs 7 lakh?

News Karnataka reported on 26 September that a Bengaluru man lost more than Rs 7 lakh after investing in a scheme promoted by deepfake videos that appeared to show Prime Minister Narendra Modi and Reliance executive Anant Ambani endorsing it. The report does not name the victim, the platform or a police case number.

This is a consumer-side version of the same trust transfer: a famous face stands in for due diligence. It belongs to the wider family of investment persona scams, where the fake endorsement only has to work long enough to get the first deposit. Controls sit with platforms and banks: takedown of impersonating ads, and checks on the accounts that receive victim funds, which are often opened with stolen or synthetic identities.

What did the Victorian election study find about spotting deepfakes?

Writing in The Conversation on 27 September, researchers from the University of the Sunshine Coast, Griffith University, the University of Queensland and Swinburne University said AI-generated depictions of events that never happened, such as a machete attack at a petrol station and floodwater pouring down the steps of parliament, had run as paid advertising before the Victorian state election.

Their preliminary experiment showed 411 Australians either an authentic political video, a low-quality deepfake or a high-quality deepfake. About 75% correctly identified the deepfakes. Almost 29% wrongly labelled the real video as fake and a further 18% were unsure. Heavier news consumption helped with low-quality fakes but not sophisticated ones, and made people less accurate on authentic content.

For organisations, the finding that matters is the false-positive side: when people doubt real footage, a genuine statement from a company or agency can be dismissed as fake. Our page on how deepfakes can affect elections sets out response steps for communications teams.

How prepared are security teams for deepfake attacks, according to this week's survey?

Biometric Update reported on 28 September on Pindrop's Deepfake Readiness Index. Pindrop sells voice security, so treat this as vendor research; the report as covered does not give a sample size. It found 93% of security leaders are concerned they are not prepared for a deepfake attack, three-quarters say deepfakes are a problem, and only 10% deploy deepfake detection tools. A quarter of affected organisations reported losing $1 million or more to a single deepfake incident.

In the Italian cases, the decisive step happened on a phone call and a messaging app outside any detection layer.

What should security teams do this week?

Start with payment authority. Any transfer above a set threshold, or to a new beneficiary abroad, should need a callback to a number already held on file and a second approver who was not on the original call or chat. Our high-value payment approval workflow lays out the steps and thresholds to consider.

Then close the channels the attackers used. Tell executives and finance staff in writing that payment instructions never arrive by WhatsApp or personal messaging, and that a familiar voice on a call is not proof of identity. Enforce DMARC on your domains so lookalike internal email is easier to catch.

• Map who in your organisation can release funds above your threshold and confirm each has a callback rule.
• Run a tabletop exercise built on the Fideuram sequence: a CEO message, then a call from a known adviser.
• Add synthetic-speech analysis to recorded or live calls that approve payments or account changes.
• Prepare a statement process for when genuine footage of your leaders is called fake.

Where does Neural Defend fit against this week's attacks?

NeuroCall (Beta) is Neural Defend's voice and call deepfake detection product and fits the Fideuram pattern most directly, by checking call audio for synthetic speech while the call is still useful to stop. A detection result is a signal for the approver and the callback rule, not a replacement for them.

NeuroDetect is a forensic media workspace for investigators. Teams can upload an authorised audio recording, video or document into a case, see explainability views down to regions, frames and audio segments, and download a forensic report with observations, uncertainty and model context for prosecutors or insurers.

NeuroVerify checks a face image, video or audio in one API call across six signals and returns one risk score with signal-level evidence, at under 200 ms p95 on eligible image requests under defined test conditions. It fits account opening, where mule accounts that receive stolen funds are created. On the public VendorBench-100 still-image benchmark, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next vendor; one benchmark author also co-wrote Neural Defend's ARCAS 1B paper, and the corpus is public. That benchmark does not cover audio.