When Even a Voice Is No Longer Proof of Identity: A €95 Million Fraud Exposes a New Weak Point in Digital Trust
Fraudsters targeting Italy’s Fideuram reportedly used deceptive communications and artificial intelligence to imitate the voice of a trusted person. The result: transfers totalling about €95 million. The case exposes a growing problem: if a person’s voice, image and communication style can be convincingly imitated, what should proof of digital identity and authority rely on in the future?
€95 million because the story sounded credible
According to Reuters, fraudsters targeted Fideuram, the private-banking arm of Intesa Sanpaolo. In February 2026, then-chairman Paolo Molesini received what appeared to be a WhatsApp message from Intesa Sanpaolo CEO Carlo Messina seeking urgent help with an overseas transaction. A call followed, apparently from a senior partner at a prominent law firm. Sources cited by Reuters said AI was used to replicate the lawyer’s voice.
Transfers totalling about €95 million were sent mainly to China and Hong Kong. Roughly €53 million was later recovered, while about €36 million remained untraced, according to the sources.
AI is attacking human trust
People normally recognise a face, voice, phone number, writing style and context rather than cryptographically verifying identity. Generative AI can now imitate many of those signals.
“Artificial intelligence can forge evidence that humans understand — a voice, a face or a writing style. The most sensitive digital actions will therefore also need evidence that can be verified independently of human impression.”
— Institute 1. april
A verified identity is still not authority
Verified identity alone does not prove which organisation a person represents, what role they hold, what they are authorised to approve, or whether they actually approved that specific transaction.
“Verified identity tells us who a person is. By itself, it does not tell us what that person is authorised to request or what they actually approved.”
— Institute 1. april
From “this is the CEO” to “the CEO approved this exact action”
IDENTITY VERIFIED – Who is the person?
ORGANIZATION VERIFIED – Which organisation do they represent?
ROLE VERIFIED – What role do they hold?
AUTHORITY VERIFIED – What may they approve?
INTENT VERIFIED – Did they actually request this action?
TRANSACTION BOUND – Is approval bound to the exact transaction?
EXECUTION AUTHORIZED – Are the conditions for execution met?
€20 million must not be just a sentence in a phone call
A stricter model of digital trust would need to prove that a verified person with appropriate authority approved €20,000,000 → to a specified recipient → to a specified account → for a specified purpose. Changing the amount, account or recipient would require a new authorisation.
Where does QEI fit into this question?
At Institute 1. april, through the research concept QEI – Quantized Encrypted Identity, we are exploring a different approach to digital identity and digital trust: verify what is necessary for an action while limiting unnecessary disclosure of personal data.
The research question is: how can identity, role, authority, intent and a specific authorised action be linked in a verifiable way? We do not present QEI as an already implemented banking solution, nor claim it would certainly have prevented this fraud.
Deepfakes are no longer only a fake-video problem
A deepfake can become part of a process whose result is a real action: a money transfer, access to personal data, a permissions change, a contract signature or access to an information system.
COMMUNICATION ≠ IDENTITY ≠ AUTHORITY ≠ AUTHORISATION
“A voice can be cloned. An image can be created. A message can be forged. Authority for an important digital action should therefore not exist only in words — it should be verifiable.”
— Institute 1. april
Humans cannot remain the only line of defence
Employee vigilance remains important, but sensitive systems cannot rely only on a person’s ability to detect a fake. Technical safeguards are also needed: multi-stage authorisation, separate confirmation of high-risk actions, cryptographically verifiable requests, limited authority and transaction-bound approval.
This problem is not limited to banks
The same logic can apply in companies, healthcare, public administration, public procurement and information systems. The key distinction is: is someone merely claiming that an action was approved, or is there verifiable evidence of authorisation?
From trust in a person to verifiable digital trust
The question of the future may no longer be only “Is that really them?” but “Can we independently and verifiably prove that this person, with the correct authority, approved this exact action?”
“Digital trust of the future must not depend only on how convincing someone looks or sounds. It must depend on what can be verified.”
— Institute 1. april
Note: Information about the Fideuram case is based on public media reporting. Reuters attributes several details to sources familiar with the matter; Intesa Sanpaolo and Fideuram declined to comment to Reuters. QEI is a research and development concept of Institute 1. april. This article does not claim that QEI is part of Fideuram or Intesa Sanpaolo systems or that it would certainly have prevented the fraud.
