The call from your boss was not your boss

The fraud that cost Intesa Sanpaolo’s private banking arm €95 million did not start with a hack. According to Reuters, which reported the case on 25 September, it started in February with a message on a messaging app to Paolo Molesini, then chairman of Fideuram, that appeared to come from the group’s chief executive, Carlo Messina, asking for urgent help with an overseas transaction. A follow-up call came from someone presenting as a senior partner at a well-known law firm, and the callers “used AI technology to replicate the lawyer’s voice.” Molesini instructed his finance department to arrange a series of transfers, mainly to accounts in China and Hong Kong.

Roughly €53 million was later recovered, according to Reuters’ sources, and Milan prosecutors have placed one foreign national under investigation for suspected computer fraud. No arrests had been reported as of mid-October, and the banks declined to comment to Reuters. Week 12 described the attacker’s toolkit.

This week is the victim’s side, because the pattern in that case is the one a business here will meet, at a smaller number and with the same three ingredients: a trusted name, an urgent reason, and a voice that sounds right. The numbers, and what they do not say Nationwide, the US insurer, commissioned Edelman Intelligence to survey 300 small-business owners and 300 mid-market owners in July. The results, published on 15 September, are the clearest picture yet of how exposed an ordinary business is.

Six in ten owners say staff use public AI tools for work. Only 36 per cent have a written policy on AI use, 37 per cent provide training on responsible use, and 27 per cent have rules on what company or customer information can be entered into an AI tool. Thirty-one per cent say the company was targeted by a scam or fraud attempt using generative AI in the past 12 months: 26 per cent of small businesses and 36 per cent of mid-market ones.

Eighty-eight per cent say AI-enabled attacks have become more sophisticated over the year. A second survey, by the fraud-prevention firm Certos, part of Early Warning Services, asked 230 senior finance leaders at US companies, from Fortune 500 firms to venture-backed start-ups and charities, in August and reported on 8 October that 81 per cent had seen an attempted fraud that involved or appeared to involve AI-generated content, that 84 per cent found AI-enabled fr…