AI voice scams on WhatsApp: how to stop a fake boss from emptying your account

AI can now copy a voice well enough to fool a bank chairman. The answer for a small business is not to train staff to spot fake voices. It is to make sure no payment or bank detail change can happen because of one message or one call, however real it sounds: call back on a number you already have, have two people approve, and treat "urgent and confidential" as a reason to stop.

What happened at Fideuram

In late September, Reuters reported that fraudsters had taken €95 million from Fideuram, the private banking arm of Intesa Sanpaolo, Italy's biggest bank. According to the sources in that report:

• In February, the then chairman of Fideuram received what looked like a WhatsApp message from the CEO of Intesa Sanpaolo, asking for urgent help with a deal abroad.
• A follow-up call, from someone presented as a senior lawyer, confirmed the request. The sources said the callers used AI to copy that lawyer's voice.
• The finance team made a series of transfers, mainly to accounts in China and Hong Kong.
• The bank spotted the problem quickly and alerted authorities in several countries. About €53 million was recovered. The rest was moved on and converted into crypto.

Intesa Sanpaolo and Fideuram declined to comment, and the sources said no Fideuram executive is under investigation. The report also recalled a similar case last year, where a cloned voice of an Italian minister persuaded a businessman to send nearly €1 million abroad.

Why this matters for a small business

Fideuram is a large bank with a finance department and controls, and it still happened. A small business is an easier target.

In Pakistan and the Gulf, a lot of business runs on WhatsApp. Owners send instructions by voice note, accounts staff get payment requests in chat, and suppliers share bank details as a photo. That is quick, and it is exactly the habit this scam uses. Short clips of someone's voice, from a video, a meeting or old voice notes, can be enough for current AI tools to make a convincing copy.

The warning signs

The voice may sound right. The pattern around it usually does not:

• Urgency. The money has to go today, before a deadline, or a deal is lost.
• Secrecy. "Keep this between us." "Don't tell the others yet."
• A new channel or number. The boss is "on a different phone" or a "lawyer" calls to confirm.
• New bank details. A supplier, partner or the boss suddenly wants payment to a different account.
• Pressure to skip a step. "No time for the usual approval."

Five rules that stop a fake-boss payment

• Call back on a number you already have. End the call or chat and ring the person on the number saved in your phone or company records, never one given in the message.
• Two people approve new payees and changed bank details. One person sets up the payment, a second person approves it. No exceptions for the owner or the CEO, because that is exactly who scammers pretend to be.
• Use a code word for urgent requests. Agree it in person and never send it in chat or email. If the caller cannot give it, nothing moves.
• Treat "keep it quiet" as a stop sign. Real urgent payments can survive one phone call to check. Make it clear that staff will never be blamed for checking.
• Lock down WhatsApp. Turn on two-step verification (Settings, Account, Two-step verification), check Linked devices for anything you do not recognise, and never share the six-digit code WhatsApp sends when a number is registered.

Put the rules into your systems, not just a memo

A rule that lives only in a memo gets skipped on a busy day. The safer place for it is inside the software your team uses, so the system will not let one person move money alone.

That is how we build approval steps for clients. In the fleet system we built in Saudi Arabia, a bot matches fuel-card bills to trips, but nothing is written to the trip portal until an accountant or dispatcher presses Confirm. The workforce ERP we built for a UK security company gives each user only the modules their role needs, through a permission matrix, and signs people out after 20 minutes idle. The same ideas work for payments: a new payee needs a second approver, and a bank detail change is held until someone checks it by phone.

Access matters too. Staff who leave should lose email and WhatsApp Business access on their last day, and shared accounts should not hang on one person's phone.

If it has already happened

• Call your bank straight away and ask them to stop or recall the transfer. Hours matter.
• Report it to the police cybercrime unit and keep every message, number and call log.
• Warn your team and partners, because the same fake identity is often used more than once.
• Change passwords and check linked devices on the accounts involved.

The short version

AI makes a fake voice cheap. It does not make a good process weaker. If your business cannot send money or change bank details on the strength of one message or call, a cloned voice has nothing to work with.

If you want help setting this up, see our IT support services and Microsoft 365 management, read about business process automation with approval steps built in, or talk to us about your payment process.