On 25 September 2026, Reuters reported an impersonation fraud at Fideuram, part of Intesa Sanpaolo, involving transfers of about EUR95 million. The reported scheme began in February. Its relevance for business leaders is immediate: recognising a senior person’s name or voice cannot be the final check before an irreversible action.

What happened

According to Reuters’ sources, an apparent WhatsApp request from Intesa’s chief executive was followed by a call using an AI imitation of a lawyer’s voice. More than half the funds were subsequently recovered, while roughly EUR36 million remained missing at the time of reporting. Intesa and Fideuram declined to comment.

That account should not be treated as a complete forensic reconstruction. It does, however, illustrate a dangerous combination: a credible identity, an urgent instruction and apparent confirmation. The business question is how a process establishes authority when the signals that feel reassuring may themselves be fabricated.

Why it matters

A familiar voice often changes the social pressure around a request. An employee may hesitate to challenge a senior executive, especially when the instruction sounds confidential or time-sensitive. A second convincing interaction can feel like verification even when it arrives through another channel controlled by the same impersonator.

Imagine a finance colleague receiving a request to change a supplier’s bank details before an urgent payment. The colleague should have a defined route to check the change using an independently maintained contact record and an authorised approval workflow. Contact details supplied in the suspicious request cannot provide that independent check.

The important design choice is to make the pause normal. An employee should be able to say that payment controls apply to every request, including the chief executive’s, without needing to win an argument about personal trust. Senior leaders must support that behaviour visibly. A procedure loses force if the people with the most authority routinely demand exceptions.

The bigger shift

AI impersonation puts pressure on the difference between identity cues and authorisation. Hearing a recognisable voice is a cue. Permission to move funds, change access or disclose sensitive information should come from a controlled process with an appropriate record.

That distinction applies beyond finance. A request to reset an executive account, export a customer list or send a confidential presentation can deserve the same separation between the person who appears to be asking and the authority required to act. The controls should be proportionate to the consequence, so routine work does not become an endless approval exercise.

AI governance therefore needs operational detail. Who can pause a request? Which channel is trusted for confirmation? What happens if the authorised approver is unavailable? A clear answer is more useful than a general instruction to remain vigilant.

My take

The response should not be to ask employees to become perfect judges of synthetic voices. Give them a process that works even when an imitation sounds convincing.

Run a short, authorised exercise around one sensitive action. Use a fictional urgent request, then ask the team to demonstrate the verification route without moving money or changing real records. Notice whether the contact information is accessible, whether an escalation owner responds and whether anyone feels that following the process could damage their standing.

The result should be a practical improvement, not a blame session. Make the safe action easy to perform under pressure, and ensure that leaders accept the same checks as everyone else. Trust between people remains valuable; permission to act needs its own evidence.