{"schema_version":"0.8.0","id":"LR-2026-0167","record_version":6,"title":"Fideuram (Intesa Sanpaolo private banking) deepfake voice/video executive impersonation fraud","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.84,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-12","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":null,"lifecycle_stage":"production","integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-12","incident_class":"other","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: A live production compromise at a European private bank, with a stated loss of close to 95 million euros.","harm_class":["financial"],"affected_description":"Fideuram, the private-banking arm of Intesa Sanpaolo","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.financexmagazine.com/post/a-95-million-euro-deepfake-a-495-fraud-surge-and-dora-with-its-gloves-off","publisher":"news search (Google News index)","date":"2026-10-12","type":"press","title":"95M Deepfake Fraud: DORA Hits Financial Services","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.lifecycle_stage":"D","system.deployment_context":"D","system.developer":"D","system.autonomy_level":"D","event.adversarial_actor":"C","event.incident_class":"D","event.summary":"D","event.date_disclosed":"A","event.trigger":"D","event.detection_method":"D","impact.harm_class":"C","impact.affected_description":"C","impact.severity":"D","context.industry":"D","context.regulatory":"C","context.denominator_available":"D","context.country":"D","impact.severity_because":"D"},"field_citations":{"system.deployment_context":[{"source_index":0,"quote":"According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers."}],"system.lifecycle_stage":[{"source_index":0,"quote":"According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers."}],"event.adversarial_actor":[{"source_index":0,"quote":"According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers."}],"impact.harm_class":[{"source_index":0,"quote":"According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers."}],"impact.affected_description":[{"source_index":0,"quote":"According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers."}],"context.industry":[{"source_index":0,"quote":"According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers."}],"context.country":[{"source_index":0,"quote":"According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers."}],"context.regulatory":[{"source_index":0,"quote":"The EU's Digital Operational Resilience Act (DORA) is now being enforced in earnest."}],"event.summary":[{"source_index":0,"quote":"According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers."}],"impact.severity":[{"source_index":0,"quote":"According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers."}],"impact.severity_because":[{"source_index":0,"quote":"According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-12"}],"event.incident_class":[{"source_index":0,"quote":"According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers."}]},"notes_on_gaps":"No source states the model name, version, developer, harness, tools granted, permissions scope, autonomy level, guardrails present, integration type, intended use, safeguard state, production intent, date occurred, failure class, trigger, detection method, root cause, responsible party, input provenance, operations paused, remediation, precursor events, direct loss USD, remediation hours, records exposed, third parties affected count, protected class, data categories exposed, loss range, reversibility, downstream exposure count, org size band, denominator, systemic exposure, shared model id, upstream incident id, incident evidence, or coverage. The incident is a deepfake impersonation fraud against bank staff, not an autonomous AI agent failure, so failure_class is null and agent_involved is false. The 95 million euro figure is stated in euros, not USD, so direct_loss_usd is null. Severity is major because the source states a live production compromise with a nine-figure loss. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-12] system.lifecycle_stage: production. system.deployment_context: production. system.developer: no source names the developer. system.autonomy_level: no source states the arrangement. event.summary: classified from described behaviour. event.trigger: no source states a cause. event.detection_method: no source says who first noticed. context.industry: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: classified from described behaviour. [corrected by Srini Iyer, approved 2026-10-18 in the corrections review: severity reason printed the whole rubric] [corrected by Srini Iyer, approved 2026-10-21 in the corrections review: a figure did not match the source] event.incident_class: other: people used AI-generated video or voice to impersonate someone in a fraud; no source states that an AI system was breached or acted, so no class's test is met. [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: citations to sentences about a different event were removed; impersonation fraud was reclassed: no AI system was breached] Stated loss not stored as a number: the source says Fideuram 'lost close to 95 million euros' (a bound, in euros); impact.direct_loss_usd holds only a stated USD figure and the schema has no field for another currency. [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a stated loss or count the fields cannot hold was recorded in the notes]"},"context":{"industry":"Finance and Insurance","org_size_band":null,"country":"IT","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":{"regimes":["DORA"],"notifications":null,"litigation_status":"unknown","safety_policy_adherence":null},"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Fideuram, Intesa Sanpaolo's private-banking arm, was processing high-value transfers when attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise payments.","quote":"According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Attackers used deepfake voice and video to impersonate executives and advisers, and staff authorised transfers on the strength of that impersonation, breaching the bank's authentication and authorisation controls.","quote":"According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers.","source_index":0,"grade":"C"},{"step":"reached","text":"Close to 95 million euros left the bank through authorised transfers; the bank has not published its own confirmation.","quote":"According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-12","source_urls":["https://www.financexmagazine.com/post/a-95-million-euro-deepfake-a-495-fraud-surge-and-dora-with-its-gloves-off"]}}