What did the six banks' September 22, 2026 report demand?

In 'Building Trust in Agentic Commerce' (Sept 22, 2026), Bank of America, Capital One, ING, NatWest, ASB Bank and Commonwealth Bank of Australia called for auditable records of what was instructed, what authority was granted, and what happened before and after payment — plus disclosure whenever an AI agent is involved and transparency over how agents make decisions. The Intesa scam shows the human-side twin of the same gap: no auditable record of who actually authorized what.

SCRIPTMASTERLABS · AGENT COMMERCE · SEP 25, 2026

How the Intesa AI Voice Scam Stole €95 Million — and the Decision Gate That Would Have Stopped It

Q: What happened in the Intesa Sanpaolo AI voice scam?

On Sept 25, 2026, Reuters reported that fraudsters used AI to impersonate senior executives and stole €95 million ($108 million) from Fideuram, the private-banking arm of Italy's largest lender, Intesa Sanpaolo. The scheme began in February when then-Fideuram chairman Paolo Molesini received a WhatsApp message appearing to be from CEO Carlo Messina asking urgent help with an overseas transaction, followed by a phone call appearing to be from a senior law-firm partner whose voice was replicated with AI. Molesini instructed his finance department to arrange transfers to foreign accounts, mainly in China and Hong Kong.

Q: How much of the €95 million was recovered?

Roughly €53 million was recovered through cooperation between authorities in China, Portugal and Italy, according to Reuters' two sources (Sept 25, 2026). About €36 million remains missing after passing through a network of overseas accounts and being converted into cryptocurrencies.

Q: Why did the AI voice scam succeed?

Because one human's belief was the entire authorization layer. A WhatsApp message and a phone call — no independent channel verification, no signed approval record, no scoring of the instruction's anomalies (unverified channel, novel beneficiaries, manufactured urgency). When voice can be cloned from seconds of audio, treating a familiar voice as proof of identity is no longer a control.

Q: How does a decision gate stop AI voice-clone payment fraud?

A decision gate scores each payment instruction before money moves: was the channel verified, is the beneficiary known, was there independent confirmation, is urgency being manufactured? An instruction arriving over an unverified messaging channel to new overseas accounts with no second-channel confirmation scores below 0.50 — the gate escalates: block, log, require human verification through an independent channel. The pattern: ≥0.80 auto-execute, 0.50–0.79 hold for review, <0.50 block and escalate.

Q: What should a company do Monday morning to stop this?

(1) Rule: no payment instruction arriving over an unverified channel can execute without independent-channel confirmation — ever. (2) Score every instruction on channel verification, beneficiary familiarity, urgency flags, and confirmation status; route low scores to human review, don't rely on voice recognition. (3) Keep an approval ledger — Legal Context Protocol style — recording who instructed, who approved, and what happened, so there is always a signed record to check against.

On September 25, 2026, Reuters reported that fraudsters using AI to impersonate senior executives stole €95 million ($108 million) from Fideuram, the private-banking arm of Italy's Intesa Sanpaolo.

The attack worked because a WhatsApp message and one phone call were the entire authorization. That is exactly what a decision-gated payment system exists to catch. This page is the receipts, the anatomy, and the fix — all dated, all verifiable.

The receipts: what Reuters actually reported

Reuters' Emilio Parodi published the story Sept 25, 2026, citing two sources familiar with the matter (first reported by Corriere della Sera). Intesa Sanpaolo and Fideuram declined to comment.

THE SCAM — ONE MESSAGE, ONE CALL, €95M

February 2026: then-Fideuram chairman Paolo Molesini received a WhatsApp message appearing to be from Intesa Sanpaolo CEO Carlo Messina, seeking urgent help with an overseas transaction.
The "confirmation": a follow-up phone call appearing to come from a senior partner at a prominent law firm — with the lawyer's voice replicated by AI, per the sources. (An americanow summary names the lawyer as Paolo Nastasi — that detail is not in the Reuters piece, so treat it as unconfirmed.)
The money moved: believing the request genuine, Molesini instructed his finance department to arrange a series of transfers to foreign accounts, mainly in China and Hong Kong.

THE MONEY — €95M TAKEN, €53M RECOVERED, €36M GONE

€95 million ($108 million) — the total taken from Fideuram, Italy's biggest lender's private-banking arm.
€53 million recovered — Fideuram detected irregularities quickly and alerted banks and authorities; recovery came through cooperation between authorities in China, Portugal and Italy.
€36 million still missing — untraced after passing through a network of overseas accounts and being converted into cryptocurrencies.
The fallout: Molesini resigned as chairman in March, citing personal reasons, with no explanation at the time. Neither he nor any other Fideuram executive is under investigation. Milan prosecutors have placed a foreign national living outside Europe under investigation on suspicion of computer fraud.

Sources: Reuters, Sept 25, 2026 ("AI messaging scam costs Italy's top bank Intesa millions"). Context detail (prior-year Moratti €1M voice-clone case; crypto conversion) also from the Reuters piece. The americanow AI-generated summary adds claims — BEC voice-clone losses over $3B in 2025 (+$250M YoY), a 2024 London engineering firm deepfake video-call loss of $25.6M, a 2019 UK energy firm loss of ~€220k, a 2020 UAE bank manager loss of up to $35M — which we could not independently verify this run.

The single point of failure: belief was the authorization

Strip the AI out and the shape is ancient: someone impersonated an authority figure and manufactured urgency. But AI changes the economics — a cloned voice costs minutes and seconds of audio, and it's indistinguishable enough to fool a chairman. The real failure is structural:

1. Instruction arrives over an unverified channel (WhatsApp) from a claimed sender (CEO)
2. "Confirmation" arrives as a phone call — a medium, not a record
3. A human believes both → instructs finance
4. Money moves to new overseas accounts — no independent check, no signed record, no second channel
5. Nobody can later prove who actually approved what — the "lawyer's confirmation" was ephemeral audio

On September 22, 2026 — three days before this story broke — six global banks (Bank of America, Capital One, ING, NatWest, ASB Bank, Commonwealth Bank of Australia) published Building Trust in Agentic Commerce and demanded auditable records of instruction, authority, intent, and outcome for agent transactions, plus transparency over how decisions get made. The Intesa scam is the human-side twin of the same gap: a payment fired on an unverified instruction with zero authorization discipline. No auditable record of who approved what — because the approval was a phone call. (Read the protocol designed for exactly this: Legal Context Protocol.)

What the news coverage misses (the builder angle)

The top results right now are forensics and rewrites: Reuters has the facts; the syndicated copies (wixx.com, superhits979.com) add literally nothing; americanow's AI summary adds generic advice — "verify unexpected requests through alternative, trusted channels." Correct, and useless as a system: it tells a human to be more careful instead of building the verification into the payment path. None of them answers: how do you make a payment system that refuses to move money on an unverified instruction, even when a human believes it?

The fix: a decision gate between intent and money

A confidence gate scores every payment instruction before money moves — the same pattern as decision-gated machine payments. Run the Intesa instruction through it:

state: instruction_channel=whatsapp_unverified · claimed_sender=CEO
         beneficiary=new_accounts_china_hk · independent_confirmation=none · urgency=manufactured

gate: ≥0.80 execute · 0.50–0.79 hold for review · <0.50 block + escalate

score: unverified channel × novel beneficiary × urgency pressure × no confirmation
       → deep in the <0.50 band → BLOCK, log everything, require human verification
       through an independent channel (signed message, not another voice call)

That's the policy the six banks were asking for: the gate is the auditable record of instruction, authority, intent, and outcome. And the human in the loop only gets the escalations — the gate clears the genuine payments without asking.

Live receipt: the gate refusing a scam-pattern instruction, this afternoon

ScriptMasterLabs runs the gate pattern on a public endpoint. Config pulled live Sept 25, 2026 ~14:19 EDT (/api/harness/status, HTTP 200): harness-core 1.0.0, decider local-heuristic-v1, bands auto_act ≥0.80 / advisory 0.50–0.79 / escalate <0.50, typesafe_wired: false.

Minutes later we fed POST /api/harness/decide a state shaped like the Intesa instruction — unverified WhatsApp channel, claimed CEO sender, urgent transfer to new accounts in China and Hong Kong, no independent confirmation, outside the corporate workflow. The decider returned "no" at 0.8176 confidence and the gate auto-approved the refusal (HTTP 200, settlement: false — the harness only emits an authorization signal; it never moves money).

curl -s -X POST https://scriptmasterlabs.com/api/harness/decide \
  -H 'Content-Type: application/json' -d '{
  "state": {
    "instruction_channel": "whatsapp_unverified",
    "claimed_sender": "CEO",
    "request": "urgent overseas transfer to new accounts",
    "independent_confirmation": false, "corporate_workflow": false
  },
  "questions": [{"id": "pay-now",
    "question": "Should this payment instruction execute now?",
    "type": "noul"}]
}'
# -> {"ok":true,"decisions":[{"id":"pay-now","value":false,
#     "confidence":0.8176,"gate":{"band":"auto_act","action":"auto-approve"},
#     "payment_intent":{"authorized":true,"settlement":false,
#     "note":"Authorization signal only — caller sets amount and settles via its own rail (e.g. x402). Not a completed payment."}}],
#   "meta":{"decider":"local-heuristic-v1","calibrated":false,"typesafe_wired":false}}

Do it yourself: the Monday-morning version

Rule 1 — unverified channel never executes alone. Any payment instruction arriving over an unverified channel (WhatsApp, SMS, voice call) requires independent-channel confirmation before it can move money. Not a policy suggestion — a hard gate rule. This one rule would have caught February's attack at step one.
Rule 2 — score the instruction, not the sender's voice. Channel verification, beneficiary familiarity, urgency flags, confirmation status. New overseas beneficiary + manufactured urgency + no confirmation = escalate, no matter how familiar the voice sounds.
Rule 3 — keep an approval ledger. Record who instructed, who approved, what happened — in a signed, checkable record, not an ephemeral phone call. The Legal Context Protocol pattern exists for exactly this: the "lawyer's confirmation" should have been a verifiable record, not audio.

Honest caveats

The harness demonstration is a hand-crafted state run through a local heuristic (calibrated: false) — a demo of the pattern, not proof it would have caught the real attack. TypeSafe's Jev is not wired in yet (typesafe_wired: false).
The Paolo Nastasi lawyer name comes from an AI-generated americanow summary — it is not in the Reuters piece, and we could not verify it. Same for its BEC/context loss figures.
A gate stops instruction fraud, not every scam — this morning's 600,000-card agent skimming campaign attacked merchants' own checkout code, a different failure mode.
Nothing on this page invents a SML customer, revenue figure, or claimed deployment — the live pieces (the harness endpoint) are curlable right now, and the receipts say exactly what was checked.

FAQ

What happened in the Intesa Sanpaolo AI voice scam?

On Sept 25, 2026, Reuters reported that fraudsters used AI to impersonate senior executives and stole €95 million ($108 million) from Fideuram, the private-banking arm of Intesa Sanpaolo. The scheme began in February: then-chairman Paolo Molesini got a WhatsApp message appearing to be from CEO Carlo Messina asking urgent help with an overseas transaction, then a phone call appearing to be from a senior law-firm partner whose voice was AI-replicated. Molesini instructed finance to arrange transfers to foreign accounts, mainly in China and Hong Kong.

How much of the €95 million was recovered?

About €53 million was recovered via cooperation between authorities in China, Portugal and Italy. Roughly €36 million is still missing, untraced after passing through overseas accounts and being converted into cryptocurrencies. (Reuters, Sept 25, 2026, citing two sources.)

Why did the AI voice scam succeed?

Because one human's belief was the entire authorization layer. No independent-channel verification, no signed approval record, no scoring of the instruction's anomalies: unverified channel, novel beneficiaries, manufactured urgency. When voices can be cloned from seconds of audio, a familiar voice is no longer a control.

How does a decision gate stop AI voice-clone payment fraud?

It scores the payment instruction before money moves: channel verified? beneficiary known? independent confirmation? urgency manufactured? An instruction over an unverified channel to new overseas accounts with no second-channel confirmation lands below 0.50 — the gate blocks it, logs everything, and requires human verification through an independent channel. Policy: ≥0.80 auto-execute, 0.50–0.79 hold for review, <0.50 block and escalate.

What did the six banks' Sept 22, 2026 report demand?

In "Building Trust in Agentic Commerce," Bank of America, Capital One, ING, NatWest, ASB Bank and Commonwealth Bank of Australia called for auditable records of instruction, authority, intent, and outcome, plus disclosure of agent involvement and transparency over decision-making. The Intesa scam is the human-side twin of the same gap: the "lawyer's confirmation" was a phone call, not an auditable record.

What should a company do Monday morning to stop this?

(1) Hard rule: no instruction from an unverified channel executes without independent-channel confirmation. (2) Score the instruction on channel, beneficiary, urgency, and confirmation — don't trust the voice. (3) Keep a signed approval ledger (Legal Context Protocol pattern) so there's always a verifiable record of who approved what.

TRUTH FIRST. PROOF ALWAYS. PAY ONLY FOR ACCEPTED DELIVERY.