A 95 Million Euro Deepfake, a 495% Fraud Surge, and DORA With Its Gloves Off
Following this week's reports of a near 95 million euro deepfake fraud at Intesa Sanpaolo's private banking arm, the identity layer is no longer the perimeter. It is the breach.
The headline nobody wanted on a Friday
As of this week, European private banking has its first public nine-figure deepfake loss. According to a FinanceX Magazine report sourcing FinTelegram, Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers. The bank has not yet published its own confirmation at the time of writing. Even if the final loss number moves, the method does not.
The scale, by the numbers
Shufti Pro projects deepfake-powered identity fraud will rise 495% in 2026. Sumsub's 2026 report puts deepfake fraud at roughly 6.5% of all fraud attempts globally, up from 0.1% in 2022. Veriff records a 21% increase in deepfake attempts between 2024 and 2025. Pindrop's 29 September 2026 release found that nearly three-quarters of security leaders have encountered, or suspect, a deepfake attack in the past twelve months. Pick your favourite number. They all point the same way.
The 5 dollar problem
Around 5 dollars is now the going rate for a deepfake image capable of bypassing standard biometric onboarding checks. That figure, flagged by the World Economic Forum and cited by FinanceX, is the one that keeps CISOs up on Thursday nights. If a bank spends 40 euros per verified onboarding on identity vendors, and a criminal spends five dollars to defeat it, the economics have already lost. Fourthline's October 2026 commentary is blunt: onboarding cannot be the last line of defence.
Liveness still matters, just not alone
Ping Identity and Veriff both point out that modern facial recognition, enhanced with liveness tests, can still distinguish a live human from a static image or injected video. But passing liveness is not the same as being authorised. A real person can still make a fraudulent request. According to Pindrop's September briefing, the attack trend is moving away from onboarding and toward authenticated session takeovers, where the voice on the call really is a customer, until it isn't.
DORA with its gloves off
The EU's Digital Operational Resilience Act (DORA) is now being enforced in earnest. Industry commentary this week describes mandatory incident classification and reporting on tight timelines, plus muscular ICT third-party risk oversight. Translation: if your deepfake came in through a vendor's SaaS, you still own the incident. Financial institutions are now navigating two simultaneous regulatory loads: DORA's operational resilience regime and the EU AI Act's model governance requirements, while also trying to scale AI-driven fraud detection and biometric onboarding without creating new attack surfaces.
What a DORA-ready response looks like
Separate authentication from authorisation. Layer biometric checks with active liveness and challenge-response, especially for high-value sessions. Mandate out-of-band callback verification for any transfer above an institution-defined threshold, with the callback going to a number of record. Treat voice as untrusted by default: internal I recognised their voice sign-offs for payment instructions must now be banned, not discouraged. Run DORA-aligned third-party reviews on every identity, voice biometric and video verification vendor.
The Finastra echo
An August roundup resurfaced this week describing a 400GB breach at Finastra and a confirmed cyberattack at Bouygues Telecom exposing personal information on 6.4 million accounts. Different attack class, same lesson: the perimeter is porous, and the data that trains the next deepfake is almost certainly already circulating. That is why pattern recognition, not point-in-time verification, is where the better banks are spending budget. Adaptive Security's October brief argues that detection has to shift upstream, into behavioural analytics on authenticated sessions.
The quiet winners
Firms with layered identity, liveness and behavioural analytics (Pindrop, Veriff, Fourthline, Ping Identity, Adaptive Security and a handful of others) are converting board-level anxiety into contracts. Expect Q4 2026 to be the fattest earnings quarter the identity verification sector has ever posted. Several European carriers have signalled, informally, that cyber policies for 2027 will exclude losses from AI-impersonation fraud unless the insured demonstrates layered controls.
What to watch next week
Three signals worth tracking. One: Intesa Sanpaolo's own statement on the Fideuram loss, if and when it drops. Two: the European Supervisory Authorities' next DORA incident-reporting commentary, expected mid-October, which will set the tone for Q4 enforcement. Three: Pindrop and FICO's next data drop on contact-centre deepfake attacks, which has been running at a reported one incident every 46 seconds in US call centres.
The bigger picture
Digital trust has moved from marketing line to operating cost. Banks that still treat identity verification as a one-off onboarding event are, as of this Friday, carrying unpriced risk. Those that treat every authenticated session, every voice call and every executive-sounding video as potentially synthetic are, finally, catching up to the attackers. The 95 million euro question is no longer whether deepfakes work. It is which board asks about them first, and whether their CISO already has an answer.
