Financial institutions have invested heavily in making sure the person accessing a system is really who they claim to be. Multifactor authentication, biometrics, device intelligence and behavioural monitoring have made unauthorised access considerably harder to conceal, but generative AI is exposing a weakness that sits beyond identity verification. A legitimate employee can access the correct system from an authorised device, use valid credentials and follow the required approval process, yet still initiate a fraudulent payment because the instruction behind it was manufactured. A recent multimillion-euro fraud involving the private banking business of Intesa Sanpaolo illustrates why this distinction is becoming important: the emerging challenge for banks is not always identifying an unauthorised user, but recognising when an authorised person has been persuaded to make the wrong decision.
Fraud Without an Account Takeover
Much of modern banking security has been designed around detecting unauthorised access. When credentials are stolen or an account is compromised, the attacker frequently leaves signals that security systems can identify. The device may be unfamiliar, the location unusual, authentication behaviour may change or the user may suddenly perform transactions inconsistent with previous activity.
AI-enabled social engineering can produce a very different scenario because the criminal does not necessarily need to enter the bank’s systems at all. Instead, the attacker can manipulate someone who already has legitimate access and sufficient authority to perform the required action.
A recent case involving Fideuram, the private banking business of Intesa Sanpaolo, demonstrates how serious that distinction can become. Reuters reported that then-chairman Paolo Molesini received communications that appeared to involve senior and familiar individuals before instructing the finance department to make transfers totalling approximately €95 million to overseas accounts. According to Reuters’ sources, AI was used to replicate the voice of a senior lawyer as part of the deception. Intesa Sanpaolo and Fideuram declined to comment on the case.
The incident is significant not simply because artificial intelligence was reportedly used to imitate someone’s voice. The wider issue is that the fraud appears to have resulted in legitimate people using legitimate financial processes to move money for an illegitimate purpose. In this type of attack, authentication can perform exactly as intended while the transaction itself is still based on deception.
Identity Is Only One Part of the Transaction
Banks have spent decades strengthening the connection between identity and authority. An employee who successfully authenticates to a system can access functions according to their assigned permissions, while additional approvals can be required for particularly sensitive actions.
That architecture remains essential, but it cannot determine whether the information influencing an authorised person’s decision is genuine.
A treasury employee could receive instructions relating to an urgent acquisition. A private banker could believe a senior client requires an unusual transfer. A finance executive could be told that confidentiality prevents the normal team from being involved. Each scenario can be made more convincing through synthetic emails, instant messages, documents, voices and video.
The European Banking Authority’s June 2026 Risk Assessment Report shows why the broader problem deserves attention. Fraud was identified by surveyed banks as the second-most relevant driver of operational risk, cited by 52% of respondents, behind cyber and data-security risk. The EBA highlighted social engineering, credential theft, online fraud and payment fraud among the principal threats and noted that social engineering is increasingly being amplified by AI.
This changes the security question. Establishing that the employee is genuine remains important, but banks increasingly also need to understand whether the transaction being requested is consistent with the circumstances in which that employee normally operates.
The Decision Is Becoming Part of the Attack Surface
Cybersecurity teams typically think about attack surfaces in terms of systems, networks, endpoints, identities, applications and data. AI-enabled social engineering introduces another potential target: the decision that takes place before someone interacts with those systems.
If an attacker can influence an authorised decision-maker, bypassing authentication may become unnecessary. The objective is no longer to become the authorised employee but to persuade the authorised employee to perform the required action.
This is particularly relevant to financial services because so many high-value processes ultimately contain a human decision. Payments are released, beneficiaries are approved, limits are changed, exceptions are authorised and customer instructions are accepted because someone with sufficient authority determines that the request is legitimate.
Generative AI increases the amount of context criminals can potentially manufacture around those decisions. Public information can be analysed to understand organisational relationships, convincing communications can be generated quickly, and synthetic media can reinforce the impression that an unusual request originates from someone the employee knows.
INTERPOL’s 2026 Global Financial Fraud Threat Assessment describes AI as a force multiplier for financial crime and says AI-enhanced fraud can be substantially more profitable than traditional methods. Its assessment also points towards agentic AI systems capable of automating more stages of fraud operations, potentially increasing both their sophistication and scale.
The implication for banks is that protecting access may increasingly need to be complemented by protecting the decision-making process surrounding high-risk transactions.
Transaction Context Becomes More Valuable
Fraud technology already uses behavioural information to determine whether activity is unusual, but AI-enabled social engineering could increase the importance of analysing the context surrounding a transaction rather than concentrating primarily on the identity initiating it.
Consider an authorised finance executive making a large international transfer. Their credentials may be valid, their device familiar and their location entirely normal. Yet the beneficiary could have been created hours earlier, the destination country might be unusual for the organisation, the amount could be significantly above the employee’s normal activity and the transaction might have characteristics associated with known impersonation fraud.
Individually, those signals may not prove anything. Collectively, they can provide a very different picture from authentication alone.
This is where behavioural analytics, graph technology and AI-based transaction monitoring could become increasingly valuable. Instead of asking only whether the person making the payment appears legitimate, fraud systems can evaluate whether the combination of employee, beneficiary, amount, jurisdiction, timing and historical behaviour makes sense.
The opportunity for fraud technology therefore extends beyond producing better identity scores. It is about developing a richer understanding of the circumstances surrounding a financial decision.
Banks May Need to Authenticate the Instruction
Another response is to separate authentication of the individual from authentication of the transaction.
An executive could genuinely have authority to approve a payment, but a high-value or unusual instruction could still require confirmation through a predefined digital workflow independent of the communication that initiated it. The authoriser could be presented with the actual beneficiary, account details, jurisdiction, amount and purpose before digitally approving that specific transaction.
This approach matters because synthetic communication is becoming increasingly capable of imitating the human elements surrounding a request. A criminal might reproduce someone’s voice or create a convincing message, but reproducing the person’s cryptographic or system-level authority to approve a particular transaction is a different challenge.
Transaction-level authentication is not a new concept, and many banks and corporate treasury environments already use sophisticated approval controls. What AI changes is the importance of making those controls independent of conversational trust.
A telephone call, email, instant message or video meeting can provide information, but for sufficiently sensitive transactions it may no longer be appropriate for that communication itself to function as proof of authorisation.
Dual Approval Does Not Always Mean Independent Verification
The traditional four-eyes principle also deserves closer examination in an environment where the underlying information can be fabricated.
Requiring two people to approve a payment provides an important safeguard against error, misconduct and unauthorised activity. However, two genuine employees can still make the same wrong decision if both are relying on the same fraudulent premise.
An executive who has been deceived could instruct another authorised employee to process the payment. The second employee may verify that the request genuinely came from the executive and follow the organisation’s approval procedures correctly. Two legitimate participants have now been involved, but the information driving both decisions originated from the same deception.
The distinction is between multiple approvals and genuinely independent verification.
For unusual or high-risk transactions, independence may increasingly require checking the commercial context, beneficiary or originating instruction through a channel that does not depend on the original request. This could make the design of approval workflows almost as important as the number of approvals they contain.
Fraud Technology Could Move Towards Decision Intelligence
This emerging problem creates an interesting opportunity for banks and technology providers because financial institutions already possess many of the components required to build a more contextual defence.
Identity platforms understand the user. Payment systems understand the transaction. Behavioural analytics can understand historical activity. Fraud engines recognise suspicious patterns. Case-management platforms contain previous investigations, while external intelligence can provide information about beneficiaries, entities and emerging fraud typologies.
The next step may be connecting those signals more effectively.
A fraud system assessing an unusual international payment could potentially determine that the employee is correctly authenticated while simultaneously recognising that the beneficiary is new, the jurisdiction is unusual, the amount falls outside the employee’s historical pattern and the sequence of activity resembles a known impersonation scenario.
AI could be useful in assembling and interpreting this broader context, particularly where relevant information is distributed across multiple banking systems. The objective would not necessarily be to block every unusual transaction, but to identify situations where a legitimate action deserves additional scrutiny because the decision behind it appears inconsistent with normal behaviour.
This moves fraud prevention closer to decision intelligence: understanding not simply who is performing an action, but whether the action makes sense within its wider context.
AI Could Industrialise Highly Personalised Fraud
The longer-term challenge is scale.
Sophisticated social engineering has traditionally required significant human effort. Criminals needed to research the target, understand organisational relationships, develop an appropriate pretext and maintain convincing communication throughout the attack.
AI can reduce some of those costs.
INTERPOL’s latest assessment warns that AI is already improving victim profiling, content generation and other elements of financial fraud, while increasingly capable agentic systems could automate additional stages of criminal campaigns. This could allow techniques previously reserved for carefully selected high-value targets to become more repeatable.
For financial institutions, the concern is therefore not limited to whether synthetic media becomes more convincing. It is also whether personalised fraud becomes economical enough to deploy against far more employees, customers and organisations.
The combination of automation and personalisation is particularly important. Traditional mass phishing became successful because criminals could approach enormous numbers of potential victims cheaply. AI could increasingly bring some of the sophistication of targeted social engineering into similarly scalable operations.
Banking Controls Need to Assume That Deception Will Sometimes Work
Employee education remains an important defence. Staff should understand impersonation techniques, deepfakes, unusual payment requests and the importance of independent verification. However, awareness training cannot reasonably be expected to identify every convincing AI-generated interaction.
Financial institutions may therefore need to design controls on the assumption that some deception attempts will succeed.
That changes the objective. Instead of requiring an employee to recognise every fraudulent communication before anything goes wrong, the organisation creates additional opportunities to detect the problem before significant funds leave the institution. Transaction limits, contextual monitoring, independent beneficiary verification, escalation rules and transaction-specific authorisation can all contribute to that resilience.
This is particularly important because generative AI will continue improving. A security model that depends primarily on humans identifying synthetic communication could become progressively harder to maintain as the difference between authentic and generated content narrows.
A more durable model is one in which a successful deception does not automatically produce a successful transaction.
The emerging AI fraud challenge is therefore broader than deepfakes or voice cloning. Financial institutions have spent decades improving their ability to establish that the right person is accessing the right system with the right authority. AI-enabled social engineering introduces another layer that those controls were not necessarily designed to answer: whether the legitimate person is acting on legitimate information.
The payment can be properly authorised and still be fraudulent. Recognising that distinction could shape the next generation of banking fraud controls.
What this means for the industry
- Authentication remains essential but cannot establish intent. A bank can correctly identify an employee while having little visibility into whether the information driving the transaction is genuine.
- Transaction context is becoming more important. Beneficiary history, payment patterns, jurisdictions, amounts and organisational behaviour can provide signals that identity authentication cannot.
- Approval workflows may need stronger independence. Multiple employees approving the same instruction do not necessarily provide independent verification when they are relying on the same fraudulent information.
- Fraud technology could evolve towards decision intelligence. Identity, behavioural analytics, payment monitoring and external fraud intelligence may increasingly need to work together to evaluate the context behind transactions.
- AI could make sophisticated social engineering more scalable. Automation may allow criminals to apply highly personalised techniques to a much larger population of targets.
- Banks should plan for successful deception. Controls should increasingly assume that some employees will encounter synthetic communications convincing enough to fool them and ensure that deception alone cannot release significant funds.
