The bank asks its customers for an extra confirmation. For €95 million, a WhatsApp was enough
25 September 2026, 18:14
February 2026. Paolo Molesini, then chairman of Fideuram, a bank in the Intesa Sanpaolo group, receives a WhatsApp message. It appears to come from Carlo Messina, chief executive of Intesa: an acquisition abroad needs to be closed, quickly and in secret.
Then the phone rings. It is the lawyer Paolo Nastasi, of the firm A&O Shearman, or at least the caller has his voice: according to the accounts published today, it was copied using artificial intelligence. The account details arrive. Molesini asks the chief financial officer to send the transfers.
€95 million leaves the bank's treasury, bound for China and Hong Kong. It was a scam: Messina had never written that message, and Nastasi had never made that call. Part of the money is blocked and recovered; €36 million is still missing, converted into cryptocurrency. In March Molesini resigns, ‘for personal reasons’. The Milan Public Prosecutor's Office is investigating.
Now for the documents the bank writes for its customers. On the Intesa Sanpaolo website: ‘Always be wary of suspicious requests, especially when they are urgent.’ And for every transfer made online, the bank asks the customer for an extra confirmation on their phone, a code or a fingerprint, before the money goes.
For €95 million, the confirmation was a WhatsApp message.
The accounts published today leave out the simplest thing of all: a phone call to Messina's number, the real one, already in the contacts. So the question, for Fideuram and for Intesa Sanpaolo: is that ‘always be wary’ advice for customers, or has anyone ever had it read on the top floor too?
For anyone running a business the lesson is simple. Today a fraudster can write in the owner's name and speak with the owner's voice. So when an urgent payment order arrives, whoever has to make the payment trusts neither the message nor the call received: they hang up and call the owner back themselves, on the number they have always used. If the order is genuine, a minute is lost. If it is fake, the money is saved.
Banks, it seems, ask for the extra confirmation only from their customers.
This article was prompted by a news item published in ANSA.