The request can sound entirely authentic
A report published by Gulf News on 26 September 2026 describes a reported incident at Italian bank Fideuram in which attackers allegedly impersonated senior executives and a lawyer, using cloned voices and spoofed identities to trigger overseas transfers worth €95 million.
The important point is not whether every detail of the report is ultimately confirmed. It is that the fraud pattern is operationally credible: a request appears to come from leadership, the voice is familiar, another trusted person appears to corroborate it, and urgency compresses the time available for challenge.
This is not principally a problem of recognising an artificial voice. It is a problem of whether the organisation allows identity and urgency to override its payment process.
The same weakness appeared in the 2024 Arup case. A finance employee transferred about US$25 million after a video call involving AI-generated recreations of the CFO and colleagues. Arup CIO Rob Greig described the incident as technology-enhanced social engineering. CNN Business, reporting the company’s confirmation, noted that no systems were compromised and no data was affected. The initial contact was a phishing email before the deepfake call.
Test the workflow, not just the caller
A voice check can be useful, but it cannot be the control on which a high-value payment depends. FinCEN Alert FIN-2024-Alert004, issued on 13 November 2024, warns that attackers can generate synthetic audio and video responses to live prompts. The alert endorses live verification while making clear why verification alone is not sufficient.
The control question for a regulated firm is more concrete:
- Can a caller change a beneficiary or approve a payment without an independent callback?
- Does the callback use a trusted number already held in the firm’s records?
- Can one senior person create both the instruction and the approval?
- What happens when the caller says the transaction is confidential, time-critical or required by the board?
- Are staff trained to stop the process without being treated as obstructive?
These are testable conditions. A readiness exercise should reproduce them without putting real funds, customers or counterparties at risk. It should test payment approval, beneficiary changes, VIP servicing and password resets, then preserve the call recordings, decision points, control outcomes and remediation actions.
Evidence of readiness
DeepBlocker’s Vishing Readiness Assessment is a fixed-scope, authorised engagement lasting two to three weeks. An AI red team places controlled vishing calls against agreed staff and workflows. The result is a sealed evidence pack showing who was contacted, what the caller requested, where the process held, and where it broke.
That evidence gives a board, insurer or regulator something more useful than a policy assertion. It shows whether the control works when the caller sounds exactly like the boss. Entry pricing is around £9,500.
The reported Fideuram case should prompt a practical review, not a hunt for a perfect detector. Practical guidance on AI voice-cloning scams is a useful starting point, but regulated firms need evidence from their own people and phone workflows.
Subscribe to the intelligence for the next field note.