In Italy, the country's largest bank became the target of a fraud that turned artificial intelligence against the very customers it was meant to serve. Intesa Sanpaolo lost millions of euros to a scheme that used machine learning to impersonate the bank's own voice — its tone, its formatting, its procedural logic — with enough precision to deceive even vigilant account holders. The incident is less a story about one institution's misfortune than a signal of how the tools of trust are being quietly repurposed as instruments of deception, at scale and with growing ease.
AI-powered messaging scam drains millions from Italy's largest bank Intesa
Customers of Intesa Sanpaolo were defrauded through AI-generated messaging scams resulting in financial losses.
AI-generated messages sounded exactly like real bank communications
Mark
So the bank itself was the target, or the customers were?
Mimi
Both, really. The scammers used AI to impersonate Intesa's own messages to trick customers into giving up account details or money. The bank lost millions because its customers were defrauded.
Luke
Do we know how many customers were actually hit? The reporting says millions in losses but doesn't specify the number of people affected.
Mimi
That's not clear from what's been disclosed. Sources confirmed the losses but the bank hasn't released customer impact numbers.
Mark
How did they even figure out it was happening?
Mimi
Probably the same way most fraud gets caught—customers noticed unauthorized activity on their accounts, or the bank's monitoring systems flagged unusual patterns.
Luke
And we don't actually know how long this was running before they caught it?
Mimi
No timeline has been reported. It could have been weeks or months.
Mark
What makes this different from regular phishing?
Mimi
The AI part. Instead of obvious spelling errors and awkward phrasing, these messages sounded exactly like real Intesa communications. The language, the formatting, everything matched.
Luke
But we should be careful—we don't know the technical details of how the AI was deployed. Was it a custom system? Off-the-shelf? That matters for understanding how replicable this is.
Mimi
Fair point. The reporting confirms AI was used but doesn't detail the mechanics.
Mark
What happens now?
Mimi
Intesa has to rebuild customer trust while also hardening its systems. And other banks are probably looking at their own defenses right now.
El Pulso
- Criminals trained AI systems on Intesa Sanpaolo's real communication patterns, producing fraudulent messages so convincing that customers had no reliable way to distinguish them from legitimate bank alerts.
- The scam exploited the most durable asset a bank possesses — customer trust — using routine channels like SMS and email to make criminal solicitations feel like ordinary notifications.
- The breach surfaced the way most sophisticated frauds do: through a slow accumulation of anomalies, unusual account activity, and customer complaints, by which point the losses had already reached millions.
- Intesa now faces a compounding problem — it must warn customers that its own communications have been compromised, a message that risks making every future legitimate alert feel suspect.
- The case marks a structural shift in financial crime: AI has lowered the barrier to sophisticated fraud so dramatically that a small operation can now target thousands of customers simultaneously with minimal human effort.
In Italy, the country's largest bank became the target of a fraud that turned artificial intelligence against the very customers it was meant to serve. Intesa Sanpaolo lost millions of euros to a scheme that used machine learning to impersonate the bank's own voice — its tone, its formatting, its procedural logic — with enough precision to deceive even vigilant account holders. The incident is less a story about one institution's misfortune than a signal of how the tools of trust are being quietly repurposed as instruments of deception, at scale and with growing ease.
Intesa Sanpaolo, Italy's largest bank, discovered it had been systematically defrauded through a scheme that turned artificial intelligence against its own customers. The scam cost the institution millions of euros. The method was precise: AI systems trained to replicate the bank's tone, formatting, and procedural logic generated messages — account alerts, security prompts, credential verification requests — that were, to the customers receiving them, indistinguishable from the real thing.
Rather than the crude grammatical errors that typically betray phishing attempts, these messages matched what customers had seen from the bank before. They arrived through standard channels — SMS, email, messaging apps — and exploited the baseline trust that makes routine bank communications effective. Intesa serves millions of customers whose interactions with the bank are frequent and often time-sensitive. That familiarity became the attack surface.
The fraud came to light through unusual account activity and customer complaints — the slow, painful way such schemes typically surface. By then, the damage had accumulated. The exact number of affected customers remains unclear, but the financial losses were significant. The bank now faces the difficult task of reassuring a customer base that its own communication channels were weaponized against them — a message that risks making every future legitimate alert feel uncertain.
The incident reflects a broader and accelerating shift in financial crime. Traditional fraud detection was built to catch human-written deception, which leaves traces. AI-generated content, trained on vast datasets of legitimate communications, evades those defenses and can be deployed at scale with minimal effort. The asymmetry between committing sophisticated fraud and defending against it has moved decisively in the attacker's favor — and Intesa Sanpaolo's breach is an early, costly illustration of where that shift leads.
Intesa Sanpaolo, Italy's largest bank, discovered it had been systematically defrauded through a scheme that weaponized artificial intelligence to impersonate its own communications with customers. The scam cost the institution millions of euros, according to sources familiar with the breach. The fraud worked by generating convincing messages that appeared to come from the bank itself—alerts about suspicious activity, requests to verify account information, prompts to update security credentials. To the customers receiving them, these messages were indistinguishable from legitimate bank communications. They were not.
The sophistication of the attack lay in its use of AI technology to craft language that matched Intesa's tone, formatting, and procedural logic so closely that even cautious customers struggled to identify the deception. Rather than relying on crude phishing templates or obvious grammatical errors, the scammers deployed machine learning systems trained to mimic the bank's actual communication patterns. The messages arrived through standard channels—SMS, email, messaging apps—making them appear as routine notifications rather than criminal solicitations.
What made this particular fraud notable was its scale and the trust it exploited. Intesa Sanpaolo serves millions of customers across Italy and internationally. Its communications are expected, frequent, and often time-sensitive. A customer receiving a message about a flagged transaction or a security update would have little reason to question its authenticity, especially if the language and formatting matched what they had seen before. The AI-generated messages capitalized on this baseline trust, using it as a vector to extract credentials, account details, or direct access to customer funds.
The bank's discovery of the scheme appears to have come through monitoring unusual account activity and customer complaints—the typical way such frauds surface. Once identified, the scope of the damage became clear: multiple customers had been compromised, and the financial losses had accumulated to a significant figure. The exact number of affected customers and the full extent of the breach remain unclear from available reporting, though sources indicate the losses ran into millions.
The incident arrives at a moment when financial institutions globally are grappling with how AI tools are reshaping the threat landscape. Traditional fraud detection systems were built to catch human-written phishing attempts, which tend to contain telltale signs of inauthenticity. AI-generated content, trained on massive datasets of legitimate communications, can evade those defenses. It can also be produced at scale and at speed, allowing criminals to target thousands of customers simultaneously with minimal human effort.
For Intesa Sanpaolo, the breach represents both a direct financial loss and a reputational challenge. The bank must now communicate to its customer base that its own communications channels have been compromised—a message that itself risks eroding the trust that makes future legitimate communications effective. Customers may become more skeptical of bank messages generally, creating friction in routine security procedures. The bank has likely already begun implementing additional verification layers and customer education campaigns to prevent similar attacks.
The case also signals a broader shift in how financial crime operates. As AI tools become more accessible and more capable, the barrier to entry for sophisticated fraud schemes drops. A criminal no longer needs a team of skilled social engineers to craft convincing messages; they need access to an AI system, training data, and a list of targets. The asymmetry between the effort required to commit the fraud and the effort required to defend against it has shifted in the attacker's favor.
Quieres la nota completa?
Lee el original en Reuters ↗
Technology