Cloned voices, hacker agents: AI takes fraud to an industrial scale

Two cases revealed in September 2026 show how artificial intelligence is transforming fraud. The first is the most classic of scams, “CEO fraud”, made formidably convincing by a cloned voice. The second is of a new kind: a single hacker, helped by three AI agents, compromised dozens of companies and stole hundreds of thousands of bank cards in a few weeks. Together, they sketch the face of cybercrime to come.

€95 million and a lawyer’s voice

According to Reuters, whose reporting was picked up by Numerama, scammers extracted €95 million from Fideuram, the private banking subsidiary of Intesa Sanpaolo, Italy’s largest banking group. The case dates back to February but was only revealed on 25 September.

The scenario is that of CEO fraud. Fideuram’s then chairman, Paolo Molesini, received a WhatsApp message that appeared to come from Carlo Messina, the parent company’s chief executive, asking him to urgently help close a deal abroad. To make the request credible, the scammers then called him, posing as a partner at a major law firm confirming the instruction. According to Reuters’ sources, they allegedly used AI to reproduce that lawyer’s voice.

Convinced, the chairman had a series of transfers arranged to accounts abroad, mainly in China and Hong Kong. The bank quickly spotted anomalies and alerted authorities in several countries. About €53 million was recovered thanks to cooperation between Chinese, Portuguese and Italian authorities, but some €36 million remained untraceable, probably converted into cryptocurrencies. Milan prosecutors have opened an investigation; no executive is implicated.

600,000 cards stolen by three AI agents

The second case was described by the security company Gambit and reported by Clubic. A malicious operator used three open-source AI tools to attack e-commerce sites. The first, Strix, a penetration testing tool, looked for flaws in the targets. The second, Cairn, an autonomous attack agent, carried out intrusions from start to finish. The third, Hermes, coordinated the campaign and carried out direct attacks, with 121 skills, 78 of them offensive. These agents relied on several AI models accessed through the OpenRouter platform, including Z.ai’s GLM 5.2, DeepSeek models and, for Hermes, Anthropic’s Claude Opus 4.6.

The result is staggering. The human operator typed only 1,951 instructions, spread over 260 sessions. When access was obtained, it usually took less than a day, often a few hours. Between 10 and 15 September alone, he launched 105 attack projects and compromised at least 27 companies. Skimming scripts, which copy the card data entered by customers, were confirmed at 19 victims and detected on more than a hundred other sites. In total, more than 600,000 card records were stolen, for an estimated value of $15 million.

The cost to the hacker: $7,005.71 spent on his OpenRouter account over four weeks, and a total campaign cost estimated at between $12,000 and $18,000. A full scan of a target cost about $25 on average. Gambit helped take down the infrastructure together with the Shadowserver Foundation, and card issuers have been notified.

How a skimming script works

The technique used in the second case deserves an explanation, because it affects every online shop. A skimming script, often called a “skimmer”, is a small piece of code hidden in a payment page. When the customer enters their card number, expiry date and security code, the script copies this information and quietly sends it to a server controlled by the hackers, while the payment goes through normally. Neither the customer nor the merchant notices anything.

In this campaign, the scripts were hidden in very widely used code libraries, such as jQuery, or in tracking tags. On the website of an American wine retailer, an automated task reinstalled the script every two minutes after each clean-up, making it almost impossible to remove without finding the way in. The AI agents made it possible to find these entry points much faster than a human could, by methodically testing dozens of sites.

What really changes

Neither case relies on new techniques. CEO fraud has existed for decades, and so has card theft through skimming scripts. What changes is the scale and the cost. Cloning a convincing voice now takes a few minutes of recording. And a single individual with AI agents can carry out attacks that used to require a whole team, on a budget of a few thousand dollars. Fraud becomes more profitable, and with it the number of potential victims grows.

The companies that develop AI models are aware of the problem and say they monitor malicious use and block the accounts they identify. But open-weight models, which can be downloaded and used without any oversight, and the proliferation of access platforms make that control difficult. Defence therefore cannot rely solely on AI providers. The same tools also serve defenders: security teams use AI agents to test their own systems, find flaws before hackers do and analyse incidents faster. The race between attack and defence is speeding up on both sides.

For African businesses

These threats do not stop at European banks and American websites. CEO fraud regularly targets African companies, often via WhatsApp, which is widely used for business communication. E-commerce sites on the continent, which use the same code libraries as everywhere else, are exposed to skimming scripts. The reflexes to adopt are the same: payment approval procedures, monitoring the integrity of website code, fast updates, and training staff to recognise manipulation, even when the voice on the phone sounds familiar.

The message of these two cases is clear: in the age of AI, hearing a voice or reading a message no longer proves anything. Verification through a second, independent channel is becoming the basic rule of financial security. For online merchants, regularly monitoring the code of their payment pages, and using providers that host the card form themselves, greatly reduces the risk of skimming scripts. These precautions cost little compared with the potential losses.