The call from your boss was not your boss

The fraud that cost Intesa Sanpaolo’s private banking arm €95 million did not start with a hack. According to Reuters, which reported the case on 25 September, it started in February with a message on a messaging app to Paolo Molesini, then chairman of Fideuram, that appeared to come from the group’s chief executive, Carlo Messina, asking for urgent help with an overseas transaction. A follow-up call came from someone presenting as a senior partner at a well-known law firm, and the callers “used AI technology to replicate the lawyer’s voice.” Molesini instructed his finance department to arrange a series of transfers, mainly to accounts in China and Hong Kong. Roughly €53 million was later recovered, according to Reuters’ sources, and Milan prosecutors have placed one foreign national under investigation for suspected computer fraud. No arrests had been reported as of mid-October, and the banks declined to comment to Reuters.

Week 12 described the attacker’s toolkit. This week is the victim’s side, because the pattern in that case is the one a business here will meet, at a smaller number and with the same three ingredients: a trusted name, an urgent reason, and a voice that sounds right.

The numbers, and what they do not say