Fideuram: €95M sent, €53M back, and the rest

In brief. Between 23 and 25 February 2026, about 95 million euros left Fideuram, the private bank of Intesa Sanpaolo, after a fake WhatsApp message and a call with a cloned voice. According to Reuters, 53 million were recovered and 36 million remain to be found, partly converted into cryptocurrency.

Fideuram is the private bank of the Intesa Sanpaolo group. Between 23 and 25 February 2026, within a few hours, about €95 million leaves it.

The bank’s chairman receives a fake WhatsApp message attributed to Carlo Messina, the group’s chief executive. He then gets a call in the cloned voice of a corporate lawyer he knows. According to Corriere della Sera, emails made to look like the law firm’s provide the payment details. The finance director executes the transfers on the chairman’s instructions, while the chairman believes he is carrying out the group head’s request. The money goes to foreign accounts, mainly in China and Hong Kong.

The press focused on the cloned voice. What happened next got less attention: more than half of the money came back.

Where the money is now

According to Reuters, €53 million was recovered. Corriere della Sera gives the detail. A bank in China blocked €40 million and returned it. In Portugal, €13 million was blocked by Milan prosecutors and the Lisbon authorities, with Eurojust.

That leaves €36 million, again according to Reuters. Part of it was converted into cryptocurrency, and investigators are tracing it through international letters rogatory.

The published figures do not add up: 53 and 36 make 89, out of 95. None of the sources explains the €6 million gap. La Stampa, for its part, puts Fideuram’s loss at €39.5 million. The final loss is therefore not established.

What the recovery owed to others

The €53 million depended on a Chinese bank willing to freeze funds, and on three countries cooperating fast. Fideuram decided none of those steps.

Blocked, seized and returned are also three different things. For the €13 million in Portugal, no source says yet that it has been returned. A blocked sum remains subject to proceedings, in a foreign country, on its own timetable.

Recall tools exist. Swift’s stop and recall service halts a payment while it is still moving through the network. Once the funds are credited and moved on, it guarantees nothing. The press does not say whether Fideuram used it.

And for credit transfers, the loss usually stays with the payer. Across the European Economic Area in 2024, payment service users bore around 85% of credit transfer fraud losses, according to the joint report of the European Banking Authority and the ECB published in December 2025. In the United States, the FBI’s Internet Crime Complaint Center counted $3.04 billion lost to business email compromise in 2025.

Three channels, one source

The scenario convinced because it seemed checked three ways: a message from the group’s head, the voice of a known lawyer, emails from the law firm. The fraudsters controlled all three channels. Their consistency was therefore worth less than three independent checks.

The hierarchy pushed the same way. The finance director carried out an order from the chairman, who thought he was carrying out an order from the top of the group. Stopping the chain would have meant questioning the most senior level. Yet the Basel Committee, in its operational risk principles revised in 2021, explicitly lists “management overrides” among the exceptions to follow up.

Nothing in the sources implicates Fideuram’s chairman. According to Reuters, no executive of the bank is under investigation.

Before the transfer, the company decides alone

Every euro recovered depends on how fast the alert goes out and on the goodwill of a bank on the other side of the world. Before the payment leaves, the company decides alone.

That is when an identity check is worth the most: when the request arrives, before anyone approves. Sealfie asks the decision-maker to confirm their identity with a selfie before a transfer or a change of bank details, and each confirmation leaves irrefutable traces, dated and bound to the person. A cloned voice, a fake WhatsApp message or an imitated email does not produce that confirmation. How Sealfie works describes this principle.

Two questions for your next board meeting. If a fraudulent transfer leaves tonight, how many minutes would it take us to launch a recall, and who on the team has done it at least once? And when the order comes from the top, who has the authority to put it on hold?

Sources: Reuters, 25 September 2026; Corriere della Sera, 25 September 2026; La Stampa, 26 September 2026; EBA-ECB report on payment fraud, December 2025; FBI IC3, 2025 Internet Crime Report; Swift, Stop and recall; Basel Committee, operational risk principles, March 2021.