A Fake CEO Text and a Cloned Lawyer's Voice Moved About €95 Million: Build the 20-Minute Confirmer List Before It Happens to You
Scammers texted a bank chairman as his CEO, then had a cloned outside lawyer call to confirm. The confirmation call was the scam. Here is the 20-minute list that makes a fake confirmation useless at your company.
What happened: Reuters reported that the private banking arm of Intesa Sanpaolo, Italy's largest bank, sent about €95 million to overseas accounts after a scam that started with a WhatsApp message. The message looked like it came from the group's CEO and asked for urgent help with an overseas deal. Then a phone call arrived that sounded like a senior partner at a well-known law firm, confirming the request. Per Reuters' sources, the lawyer's voice was cloned with AI. More than half the money was recovered. Roughly €36 million was still missing.
Why it matters to you: Most wire-fraud training says "verify with a second person." This scam brought its own second person. The fake boss made the ask, and a fake outside advisor did the verifying. Your lawyer, CPA, banker, and title company are all people whose voices are on public video, podcasts, and voicemail greetings. Any of them can be cloned from a minute of audio.
The rule that stops it: A confirmation only counts if you placed the call, to a number you already had before the request showed up. An inbound call confirming a payment counts for nothing, no matter how real it sounds. And no payment instruction is ever accepted over WhatsApp, text, or any personal messaging app.
The 20-minute move: build your Confirmer List.
- List everyone who could plausibly approve or confirm a payment (5 min). Owners, managers, your bookkeeper, outside lawyer, CPA, banker, title or escrow contact, top two vendors.
- Get each number from an old source (10 min). A signed engagement letter, last year's invoice, your bank's printed statement, the number saved in your phone for over a year. Never from the email or text that asks for money.
- Store it where the team can find it. One printed page in the office and one shared note in your business account. Initials and role only on any copy you paste into AI.
- Paste this into Claude or ChatGPT to write the policy and the team message:
ROLE: You are an office manager writing a one-page payment safety rule for a small business with [NUMBER] staff.
CONTEXT: Scammers now fake a message from the owner, then have an AI-cloned voice of a trusted outside advisor (lawyer, CPA, banker) call to confirm it. We keep a Confirmer List of known phone numbers gathered from old records.
TASK: Write:
1. A one-page rule in plain words. A payment, bank change, or gift-card request is confirmed only when we call out to the number on the Confirmer List. Inbound confirmation calls never count. No payment instructions accepted over text, WhatsApp, or social media messages.
2. A 3-sentence script staff can say to anyone, including the owner, when they pause a request to call back.
3. A short team message announcing the rule that says plainly: you will never get in trouble for pausing a payment to verify it.
FORMAT: Three labeled sections. Under 300 words total. No jargon.
- Tell your outside advisors. One email: "We now confirm every payment request by calling the number we have on file for you. If we call you, that's why."
What it's worth: Twenty minutes, once. The average small business can't absorb a single wrong wire, and banks often can't pull one back after the first day.
Keep it safe: The Confirmer List holds phone numbers, so keep the full version in your own files. Give AI roles and initials only.