Deepfake Attack Examples: The Biggest Cases on Record
Deepfake Attack Examples: The Biggest Cases on Record
A WhatsApp message and a cloned voice just moved about EUR 95 million out of a private bank inside Italy’s largest banking group. It is the largest deepfake fraud on public record. Here are the ten deepfake attack examples every security leader should know, how each one worked, and the verification step that held in the cases that failed.
“That could never happen to us” is not a security posture. It is the belief every one of these attacks was built on.
Every security leader has heard it in a boardroom. Our people are too smart. Our controls are too mature. Our executives would never fall for a fake.
The organizations below had every reason to believe that too. A private bank managing hundreds of billions in client assets. A global engineering firm. A multinational with a dedicated finance director. None of them was hacked in the usual sense. No malware, no breached firewall, no stolen passwords. Each one lost money, or came close, because someone acted on a voice or a face they trusted.
We run authorized deepfake simulations for enterprise organizations, so we read these cases the way a red team reads a playbook: what was the pretext, which channel carried it, and which verification step would have stopped it. That last question is the one that matters, and it is the one this list answers.
What is a deepfake attack?
A deepfake attack is social engineering that uses AI-generated or AI-altered media, most often a cloned voice or a synthetic video of a trusted person, to convince a target to take a consequential action such as sending a payment, resetting a credential or granting access. The deepfake is rarely the whole attack. It is the piece that removes the last doubt.
The biggest deepfake attacks on record, ranked by reported loss
Amounts are the sums reported as moved, in the currency reported at the time. Several cases include partial or full recovery, noted where it happened. Two well-documented attempts that failed are listed at the end, because what stopped them is the most useful part of this whole list.
Eight deepfake attack examples with confirmed losses, plus two attempts that were stopped before any money moved.
| Rank | Target | Year | Deepfake used | Reported amount |
|---|---|---|---|---|
| 01 | Fideuram (Intesa Sanpaolo), Italy | 2026 | WhatsApp as the group CEO, cloned voice of a known lawyer, forged documents | About EUR 95 million |
| 02 | Japanese company branch, Hong Kong | 2020 | Cloned voice of the parent company director, forged emails | Up to US$35 million |
| 03 | Arup, Hong Kong | 2024 | Deepfake video conference of the CFO and colleagues | HK$200 million (about US$25 million) |
| 04 | UXLINK | 2025 | Deepfake video calls posing as business partners | More than US$11 million |
| 05 | Massimo Moratti, Italy | 2025 | Cloned voice of Italy’s Defence Minister | Nearly EUR 1 million (frozen) |
| 06 | Businessman, Baotou police case, China | 2023 | Face-swapped video call posing as a friend | 4.3 million yuan (about US$622,000) |
| 07 | Multinational finance director, Singapore | 2025 | Deepfake Zoom call of the CEO and executives | More than US$499,000 (recovered) |
| 08 | UK energy firm | 2019 | Cloned voice of the parent company CEO | EUR 220,000 (about US$243,000) |
| Held | Ferrari, Italy | 2024 | Cloned voice of the CEO over WhatsApp | Stopped. No loss |
| Held | WPP, United Kingdom | 2024 | Cloned voice and video footage of the CEO in a Teams meeting | Stopped. No loss |
Sources for every case are listed at the end of this article. Currency conversions are approximate and as reported at the time.
1. Fideuram and Intesa Sanpaolo: about EUR 95 million (2026)
The largest deepfake fraud on public record hit Fideuram, the private banking arm of Intesa Sanpaolo, in February 2026. It is nearly three times the next-largest reported case and roughly four times the Arup case that defined the threat in 2024. The details below come from a seizure order issued by a Milan investigating judge, first reported by Corriere della Sera in September 2026.
The opener
On February 23, 2026, Fideuram’s then chairman received a WhatsApp message that appeared to come from Carlo Messina, chief executive of Intesa Sanpaolo.
The story
The fake CEO described the acquisition of an international bank. Because of an information leak and the threat of intervention by Consob, Italy’s market regulator, Intesa could not run the deal itself. It had to go through Fideuram. Quietly, and urgently.
The deepfake
A call followed from the managing partner of a major international law firm’s Italian office, a lawyer the chairman knew personally. Except it was not him. His voice had been cloned with AI, and it confirmed every word of the request.
The paper trail
Documents followed: a confidentiality agreement, a power of attorney bearing what appeared to be Messina’s signature, and transfer instructions on the law firm’s letterhead. The deal now looked real on paper too.
The money
Between February 23 and 25, the chairman and the head of treasury released a series of transfers to accounts mainly in China and Hong Kong, with others in Portugal. Total: about EUR 95 million.
The response
Fideuram raised the alarm, and authorities in Italy, China and Portugal froze or returned more than EUR 50 million. The chairman stepped down in March. At least EUR 36 million is still missing, reportedly converted into cryptocurrency.
Why two seasoned executives acted on it
These were not junior staff clicking a bad link. This was the chairman of one of Europe’s largest private banks and his head of treasury. That is exactly the point. The attack was built to beat experience, not exploit inexperience.
Authority. The request came from the top of the parent group. Nobody wants to be the executive who slowed down the CEO’s deal.
Secrecy as a weapon. A leak, a regulator, a confidential acquisition. According to the judge, the two executives did not contact Fideuram or Intesa leadership because they believed they were bound by a confidentiality agreement. The attackers made verification feel like a betrayal before anyone thought to verify.
A trusted voice confirming it. Careful people look for independent confirmation. The attackers supplied it, in the cloned voice of a lawyer the chairman already trusted. That is what a deepfake does in a real attack: it erases the last doubt.
Synthetic normalization. We hear AI-generated voices every day now, and a slightly flat tone no longer sets off alarms. We call this synthetic normalization: plausibility beats fidelity. The call did not need to be perfect. It needed to be plausible, and it was.
The good news matters too. Intesa has said no IT systems were hacked, and Fideuram’s controls raised the alarm quickly enough for international recovery to claw back most of the money. Intesa has also reportedly logged thousands of AI-generated scam attempts impersonating its CEO since the start of 2026. The bank’s technology did its job. The gap was in the approval path. We walk through the full chain, step by step, in our Fideuram executive impersonation fraud analysis.
2. Japanese company branch, Hong Kong: up to US$35 million (2020)
A branch manager took a call from a voice he recognized: the director of the parent company. The director said an acquisition was under way and transfers needed authorizing. A lawyer was supposedly coordinating the procedures, and emails from both men confirmed the details. The manager authorized transfers of up to US$35 million. The case surfaced in 2021 through a court filing in which investigators from the United Arab Emirates asked US authorities to help trace part of the money.
The pattern. An acquisition. A lawyer. Confirming paperwork. Six years before Fideuram, the script was already written.
3. Arup, Hong Kong: HK$200 million (2024)
A finance employee in the Hong Kong office of Arup, the global engineering firm, received a message that appeared to come from the UK-based chief financial officer about a confidential transaction. Any doubt faded on a video conference where the CFO and several colleagues appeared and spoke. Every one of them was a deepfake. The employee made 15 transfers totaling HK$200 million, about US$25 million. Arup confirmed the incident and said its internal systems were not compromised.
The lesson is the one most organizations still have not written down: a video call is not verification when the attacker sent the invitation. Our conference call phishing simulation recreates exactly this scenario.
4. UXLINK: more than US$11 million (2025)
According to the company’s own incident review, attackers spent months impersonating business partners on deepfake video conferences, compromised the personal devices of several people who held keys to the company’s multisignature wallet, and drained more than US$11 million. This one matters because it shows deepfakes are an initial access tool, not only a payment fraud tool. We covered it in depth in our UXLINK breakdown.
5. A cloned minister, Italy: nearly EUR 1 million (2025)
Callers posing as defence ministry officials, followed by an AI-cloned voice of Italian Defence Minister Guido Crosetto, asked prominent business leaders for urgent funds to free kidnapped journalists, with the promise of reimbursement and the warning that the government could not be seen to be involved. Several were targeted. Former Inter Milan owner Massimo Moratti sent nearly EUR 1 million across two payments before police traced and froze the money in a Dutch account. Secrecy was the lever again, and fast reporting is what got the money back.
6. Face-swapped video call, China: 4.3 million yuan (2023)
Police in Baotou reported that a businessman transferred 4.3 million yuan, about US$622,000, after a video call with a close friend who needed money for a bid deposit. The friend was a face swap generated with AI. The target saw a familiar face, heard a familiar request, and acted. Recognition was the only check, and recognition is exactly what the deepfake was built to pass.
7. Deepfake Zoom call, Singapore: more than US$499,000 (2025)
A finance director at a multinational was contacted on WhatsApp by someone posing as the company’s CFO, then called by a purported lawyer, then pulled into a Zoom meeting where the CEO and other executives were deepfakes. The pretext was a confidential restructuring, and the director was asked to sign a non-disclosure agreement. More than US$499,000 moved. The fraud surfaced only when the scammers asked for another US$1.4 million, and police in Singapore and Hong Kong recovered the full amount. Fast reporting and interbank cooperation worked. The approval path did not.
8. UK energy firm: EUR 220,000 (2019)
One of the first deepfake attack examples ever reported. The chief executive of a UK energy company took a call from what he believed was the chief executive of the German parent company, asking for an urgent transfer of EUR 220,000, about US$243,000, to a Hungarian supplier, with reimbursement promised. He paid. The money moved on to Mexico and elsewhere. Suspicion arrived only on a later call, when the promised reimbursement had not appeared and the caller asked for more. Seven years later, the voice clones are far better. The script has barely changed.
Two deepfake attacks that failed, and what stopped them
Ferrari, July 2024. An executive received WhatsApp messages from an unfamiliar number posing as CEO Benedetto Vigna: a confidential acquisition, a non-disclosure agreement, complications in China, an urgent currency hedge. Then a live call in a cloned voice. The executive noticed something slightly off in the intonation, but what ended the call was a question: what was the title of the book Vigna had recommended to him a few days earlier? The caller could not answer and hung up. No loss.
That question would have worked against a flawless clone. It does not evaluate the voice at all. It checks something only the real person knows, through a step the attacker did not design.
WPP, May 2024. Fraudsters built a WhatsApp account using the photo of WPP chief executive Mark Read and used it to set up a Microsoft Teams meeting with a senior executive, combining a cloned voice with public video footage to ask for help setting up a new business. The attempt failed because staff did not treat a familiar face and voice as proof. Read’s message to staff afterwards made the point directly: a familiar photo on an account does not prove who is behind it.
In the cases that failed, nobody out-listened the deepfake. Someone ran a check the deepfake could not pass.
What every deepfake attack example has in common
Line the ten cases up and the technology changes every year. The playbook does not.
A confidential deal
Six of the ten cases leaned on confidentiality: an acquisition, a restructuring, a non-disclosure agreement, a government that could not be involved. Secrecy turns verification into disloyalty.
Someone senior asking
A group CEO, a CFO, a parent company director, a minister. The more senior the voice, the more reasonable it feels to skip the step that would slow them down.
A second voice inside the story
A lawyer on the phone, colleagues on the video call, paperwork on the right letterhead. Confirmation that arrives from inside the story is not verification. It is part of the story.
There is a fourth thread too. Fideuram, Singapore, Ferrari and WPP all started on WhatsApp, a channel that sits outside the email gateways and payment controls most security programs measure.
Complacency is the real vulnerability
Here is the uncomfortable truth from the biggest case on the list: Intesa’s systems worked. No IT systems were hacked. Its controls flagged the transfers. Recovery teams clawed back most of the money. And it still lost tens of millions of euros.
That is what complacency costs. Organizations invest in firewalls, email gateways and endpoint tools, then assume the human layer will sort itself out. They run annual awareness training, watch click rates fall, and decide they are covered. But nobody clicked anything in any of these cases. The attacks ran on WhatsApp, phone calls and video meetings, outside the controls most programs measure, and they targeted the people with the most authority, not the least training.
“It could never happen to us” is the exact belief attackers are counting on. No organization on this list expected to be on it.
What would have stopped these deepfake attacks
Not better eyesight. Not a sharper ear. Expecting an executive to catch a high-quality voice clone mid-call is a losing bet. What stops these attacks is procedure that holds under pressure.
No deal is too secret to verify
Write it into policy: confidentiality never overrides verification. That single rule breaks the lever the attackers pulled hardest in six of the ten cases above.
Call back on a number you already have
Any request to move money, change bank details or grant access is confirmed through a known, independent channel, never through the contact, meeting link or document that delivered it.
Make the second approval independent
At Fideuram, two executives approved together, inside the same story. A second approver who verifies on their own, through their own channel, is what turns dual approval into a real control.
No payment instructions over personal messaging
If a request starts on WhatsApp or another personal channel, it does not move money until it is re-requested through an approved channel and verified there.
Rehearse it before attackers test it
A policy no one has practiced under pressure is a document, not a control. Run realistic deepfake simulations against executives, finance and treasury, and measure who verifies, not who clicks.
Why spotting the fake is not the control
Look at who recognized the voice in these cases. The UK chief executive recognized his parent company’s CEO. The Hong Kong branch manager recognized his director. The Fideuram chairman recognized a lawyer he knew personally. Recognition did not protect any of them, because recognition is the exact test a deepfake is built to pass. Training people to spot the fake is a decaying control: it gets weaker every time the generators get better.
A verification step does not have that problem. A callback to a number already on file returns the same answer against a crude fake and a perfect one. So did the Ferrari executive’s book question. Technical controls earned their keep here as well: fraud monitoring, payment recall and interbank cooperation recovered money at Fideuram, in Singapore and in Italy. The strongest programs layer both, and test both.
Precise about the claim. A better deepfake does not break a verification step directly. It raises the pressure to waive it. Fideuram shows exactly how: a confidentiality agreement made skipping escalation feel like the responsible choice. That is why we measure how often a required check is skipped or granted as an exception, rather than claiming any procedure is unbreakable.
How to find out whether your organization would hold
Every case on this list was a live test nobody signed up for. Breacher.ai lets you run that test on your own terms. The OSES™ engine recreates scenarios like these as authorized, fully automated simulations, end to end: the WhatsApp opener, the cloned voice of a trusted contact holding a live two-way conversation, the follow-up documents, the pressure to act fast. Orchestration means each stage adapts to what the target did in the last one, the way the Fideuram sequence did. Each run stops at the verification boundary, before anything moves.
You see exactly where your process held, where it broke, and how you compare to your peers on the OSES™ Risk Index. Findings are named against the procedure, never against a person, and the Secure Behavior Management platform turns them into training built from your own policies in minutes. For the scenarios above, start with a CEO fraud simulation, a deepfake simulation across voice and video, or an executive tabletop simulation for the leadership team, all running on the Breacher.ai simulation platform.
Does a written step exist?
Most organizations verify outbound wires and little else. Coverage shows which consequential actions have no verification requirement at all.
Did the step fire under pressure?
Verification executed through an independent channel, over verification required. This replaces click rate as the headline.
How often was it waived?
Checks skipped or granted as an exception, over checks required. This is the number that moves as deepfakes improve.
The deepfakes keep getting better.
The callback does not have to.
Thirty minutes. We will show you how a deepfake executive request runs against your approval chain, and what we measure when it does.
Book Your DemoFrequently asked questions
The biggest deepfake attack examples on record include the 2026 Fideuram case in Italy, where about EUR 95 million was transferred after a WhatsApp message posing as the Intesa Sanpaolo CEO and a cloned lawyer voice; a 2020 Hong Kong case of up to US$35 million using a cloned company director voice; the 2024 Arup case, where HK$200 million moved after a deepfake video conference; and the 2019 UK energy firm case, where a cloned CEO voice moved EUR 220,000.
The Fideuram case from February 2026 is the largest deepfake fraud on public record. About EUR 95 million left Fideuram, the private banking arm of Intesa Sanpaolo. Authorities froze or returned more than EUR 50 million, and at least EUR 36 million is still missing. The next-largest reported case, from 2020, involved up to US$35 million.
A WhatsApp message posing as Intesa Sanpaolo CEO Carlo Messina described a confidential acquisition that had to run through Fideuram. A follow-up call used an AI-cloned voice of a lawyer the chairman knew personally. Forged documents, including a confidentiality agreement, completed the story, and two executives released the transfers without contacting group leadership.
A finance employee in Arup’s Hong Kong office received a message about a confidential transaction, then joined a video conference in which the UK-based CFO and several colleagues appeared. All of them were deepfakes. The employee made 15 transfers totaling HK$200 million, about US$25 million.
Bind verification to the request, not the person asking. Any payment, credential change or access grant requested over a call, video meeting or messaging app is confirmed through a channel the requester did not supply, such as a callback to a number already on file. Make confidentiality explicitly unable to override verification, make the second approver verify independently, and rehearse the procedure with realistic simulations.
Any organization where one or two people can approve a large transfer on a convincing request is exposed, regardless of size or maturity. Fideuram, Arup and a Singapore multinational all had mature controls. The only way to know how your approval chain holds under pressure is to test it with a realistic, authorized deepfake simulation.
Sources
- it-daily.net: Fideuram deepfake, seizure order details (German)
- ITdaily: Major Italian bank defrauded of EUR 95 million
- Il Sole 24 Ore: The former boss of Fideuram was scammed via WhatsApp
- TechRadar: Italy’s top bank hit by an AI messaging scam
- Dutch IT Channel: Italian bank loses EUR 36 million to deepfake fraud (Dutch)
- Forbes: Fraudsters cloned company director’s voice in US$35 million heist
- Computing: Deepfake fraud costs engineering giant Arup
- Odaily: UXLINK security incident review
- StratNews Global (Reuters): Italian police freeze cash from AI voice scam
- Reuters: Deepfake scam in China fans worries over AI-driven fraud
- Singapore Police Force: Singapore and Hong Kong police recover over S$670,000 in a scam
- Trend Micro: Unusual CEO fraud via deepfake audio steals US$243,000 from UK company
- Fortune (Bloomberg): Ferrari exec foils deepfake attempt with a security question
- Campaign Asia: WPP chief exec Mark Read targeted by deepfake scammers
Find Out Before Someone Else Tests Your People
The attackers in every one of these cases never broke in. They needed one convincing story and one person willing to act. Find out whether your approval chain holds, before someone else tests it for real.
Book Your DemoLatest Posts
Table Of Contents
About the Author: Jason Thatcher
support@breacher.ai
