The call from your boss was not your boss

The fraud that cost Intesa Sanpaolo’s private banking arm €95 million did not start with a hack. According to Reuters, which reported the case on 25 September, it started in February with a message on a messaging app to Paolo Molesini, then chairman of Fideuram, that appeared to come from the group’s chief executive, Carlo Messina, asking for urgent help with an overseas transaction. A follow-up call came from someone presenting as a senior partner at a well-known law firm, and the callers “used AI technology to replicate the lawyer’s voice.” Molesini instructed his finance department to arrange a series of transfers, mainly to accounts in China and Hong Kong. Roughly €53 million was later recovered, according to Reuters’ sources, and Milan prosecutors have placed one foreign national under investigation for suspected computer fraud. No arrests had been reported as of mid-October, and the banks declined to comment to Reuters. Week 12 described the attacker’s toolkit. This week is the victim’s side, because the pattern in that case is the one a business here will meet, at a smaller number and with the same three ingredients: a trusted name, an urgent reason, and a voice that sounds right. The numbers, and what they do not say Nationwide, the US insurer, commissioned Edelman Intelligence to survey 300 small-business owners and 300 mid-market owners in July. The results, published on 15 September, are the clearest picture yet of how exposed an ordinary business is. Six in ten owners say staff use public AI tools for work. Only 36 per cent have a written policy on AI use, 37 per cent provide training on responsible use, and 27 per cent have rules on what company or customer information can be entered into an AI tool. Thirty-one per cent say the company was targeted by a scam or fraud attempt using generative AI in the past 12 months: 26 per cent of small businesses and 36 per cent of mid-market ones. Eighty-eight per cent say AI-enabled attacks have become more sophisticated over the year. A second survey, by the fraud-prevention firm Certos, part of Early Warning Services, asked 230 senior finance leaders at US companies, from Fortune 500 firms to venture-backed start-ups and charities, in August and reported on 8 October that 81 per cent had seen an attempted fraud that involved or appeared to involve AI-generated content, that 84 per cent found AI-enabled fraud harder to detect than the traditional kind, and that one in five named a deepfake of an executive as their top concern. The top concern overall, at 43 per cent, was simpler: payment diversion. Both are vendor surveys, one by an insurer and one by a company that sells fraud prevention, so read the exact percentages loosely. The official figure is more sober. The FBI’s Internet Crime Complaint Center reported in April that it received more than 22,000 complaints in 2025 where the victim flagged AI involvement, with losses above US$893 million, including more than US$30 million lost by businesses to email compromise involving AI. That counts only cases where someone thought to mention AI, so it is a floor. How the scam actually works Strip the Fideuram case down and it is the same scam that has emptied business accounts for years, with one new part. The old parts are the pretext and the pressure. A message from someone senior. A deal that is confidential, time-sensitive and slightly outside the normal process. A reason the usual person cannot be reached. None of that needs AI, and the most commonly reported attempt among small businesses in the Nationwide survey was still an email impersonating an owner, executive, employee, customer or supplier. The new part is the confirmation. For years the advice has been to pick up the phone and check, and that advice worked because a voice was hard to fake. Now it is not. In the Fideuram case the fraudsters did not wait for the victim to call; they placed the confirming call themselves, in a cloned voice, from the one person the victim would trust to confirm it. In the Arup case in Hong Kong in early 2024, an employee joined a video call on which every other participant, including the chief financial officer, was a deepfake, and paid out about US$25 million. The confirmation step, which used to be the control, has become the attack. That changes the defence. Checking is still right. Checking on a channel the attacker chose is not. The four-line policy A business with eight staff does not need a fraud department. It needs four rules that everyone who can move money knows by heart, written down, and tested once. One: no payment to a new account, and no change to an existing supplier’s bank details, on the strength of a message alone. Every such request is confirmed by a call that we place, to a number we already hold, not a number in the message. If the person cannot be reached that way, the payment waits. Two: urgency is a reason to slow down, not to speed up. Any request that says confidential, today, or do not involve the usual people goes to a second person before it goes anywhere else. The fraudster’s script depends on isolating one employee. Two people on a payment breaks it. Three: a word or a question that is not written anywhere. A short phrase agreed between the owner and the people who can authorise payments, used when a request arrives by voice or video, and changed when someone leaves. It is low-tech and it defeats a cloned voice, because the clone can say anything except the thing it does not know. Four: nothing confidential goes into a public AI tool, and nothing that comes out of one moves money without a person checking it. That is the rule 27 per cent of businesses have and the rest need, and it belongs in the same document because the two risks arrive together. Write the four lines on one page, have every person with payment authority sign it, and put it in the AI permissions register this column set up in Week 16. Test it before they do A policy that has never been tested is a policy nobody remembers under pressure. Once, with the owner’s knowledge, send a plausible fake request to the person who makes payments: a supplier’s new bank details on a convincing letterhead, or a message in the owner’s name asking for an urgent transfer. See whether the call-back happens, whether it goes to the number on file, and whether the second person is told. Then talk about it without blame. In most businesses the four lines do not survive the first believable request, and it is better to learn that from a test. What this does not cover The surveys are American, the samples are small, and both come from companies with something to sell. The pattern is the useful part, not the percentages. Jamaica’s regulators have warned about AI-enabled scams, but mainly the consumer kind. The Financial Services Commission’s May alert on investment scams lists deepfake audio and video and voice cloning among the tactics, and in June a minister of state in the Ministry of Industry, Investment and Commerce had to disown an AI-generated video that used his image and a cloned voice to endorse an investment scheme. No local figure exists for business losses to this kind of fraud, and a business should not wait for one. The four lines protect payments. They do not protect against a supplier whose own email has been compromised sending a real invoice to a wrong account, which is why line one applies to every bank-detail change, not only suspicious ones. And no policy stops a determined owner from overriding it, which is the hardest case: in Fideuram the person who was fooled was the chairman. The rules have to apply to the top of the business or they do not apply at all. What to try this week 1. Write the four lines on one page and have everyone with payment authority sign it. Keep the signed copy with the AI permissions register. 2. Build the call-back list: a phone number you already hold for every supplier and every person who can authorise a payment. Store it somewhere that is not the email system. 3. Agree the verification word or question with the owner and the finance person. Do not write it in the policy, and change it when anyone leaves. 4. Pull the last three months of payments and check how many went to bank details that changed in that period, and whether each change was confirmed by a call you placed. 5. Run one test request within the month and discuss what happened. If the call-back did not occur, that is the finding, not a failure. Case details are as reported by Reuters (25 September 2026), survey figures as published by Nationwide (15 September 2026), Certos (8 October 2026) and the FBI Internet Crime Complaint Center (7 April 2026). The voice on the phone is no longer proof of the person. The number you dialled still is. Peta-Gaye Hardy is the founder of PGH Consulting, LLC, where she helps finance and operations teams adopt AI in practical, low-risk ways. She writes the weekly AI in Finance & Business column and is based between Jamaica and the United States. Learn more at www.pghconsultinggroup.com. Follow on Instagram and YouTube @pghconsultinggroup, and connect on LinkedIn at linkedin.com/in/peta-gaye-hardy. Disclosures: This article is informational and does not constitute investment, tax, legal, security or accounting advice. Readers should consult a qualified professional before acting. The Fideuram case is described as reported by Reuters from unnamed sources; the banks declined to comment to Reuters, one person is under investigation, and no charges or arrests had been reported at the time of writing. Survey findings are reported as published by their sponsors and have not been independently verified. AI tools can produce errors, and every figure, clause, or claim they produce should be verified against a source before being shared or acted upon. The author has no commercial relationship with Nationwide, Certos, Early Warning Services, Intesa Sanpaolo or any product mentioned and was not compensated by them. All product names, logos, and trademarks are the property of their respective owners and are referenced for editorial purposes. The business examples described are illustrative and do not depict any real business.