ING Groep N.V. · AI used against the institution · severity 1 of 5
In 2024 a senior ING manager received a voicemail that appeared to come from chief executive Steven van Rijswijk, about a confidential project and warning him to expect a call from a lawyer; it was fake. ING's chief technology officer Daniele Tonella disclosed the attempt in June and July 2025 interviews with The Banker and The Paypers, and ING repeated the account on ing.com under the heading of the growing threat of deepfakes. Tonella said it happened about a month after he joined ING in August 2024 and called it "a good learning moment". ING did not say whether any money was requested, and no payment, data loss or customer harm was reported. Tonella used the case to argue that video-call and messaging platforms should do more to stop impersonation scams.
Record last reviewed Oct 21, 2026 · Markdown
Date
2024 · disclosed Jun 18, 2025
Institution
Country
Netherlands
AI system
Voicemail impersonating the voice of ING's chief executive, presented by ING in the context of deepfakes
AI?
Described as AI by the institution or regulator
The institution, a regulator or a court called the system AI.
Category
Status
Confirmed by the institution
Severity
1 of 5
Impact
No customers involved · A targeted impersonation attempt on one senior ING manager; ING reported no payment, data loss or other harm.
What happened?
In a Money20/20 interview published by The Paypers on 15 July 2025, ING chief technology officer Daniele Tonella said that "just a month after I joined ING, one of our senior managers received a voicemail that seemed to come from our CEO. It was supposedly about a confidential project and warned him to expect a call from a lawyer. It sounded real - but it was fake." The Paypers' biography says Tonella joined ING as chief technology officer in August 2024.[3]
The Banker reported the same incident on 18 June 2025, in a profile of Tonella under the heading "A step ahead of AI-enabled fraud": employee training, phishing simulations and filtering technology were among ING's tools "to counter the growing threat of deepfakes", and "last year an ING employee received instructions in a voicemail impersonating the bank's chief executive, Steven van Rijswijk". ING republished the account on its own news site, introducing it with "Speaking on the growing threat of deep fakes".[1][2]
Neither ING nor the interviews said whether the voicemail asked for a payment, how the fake was detected, or which tool was used to imitate van Rijswijk's voice. Tonella presented the case as a test of organisational culture rather than an infrastructure vulnerability: in a resilient culture, he said, people feel empowered to stop and say "Something's not right here".[3]
When did it happen?
- Aug 2024
Daniele Tonella joins ING as chief technology officer, according to The Paypers.[3]
- Sep 2024
About a month after Tonella's arrival, a senior ING manager receives a fake voicemail impersonating CEO Steven van Rijswijk about a confidential project.[2][3]
- Jun 18, 2025
The Banker publishes Tonella's account of the voicemail in a section on AI-enabled fraud and deepfakes; ING republishes it on ing.com on 27 June.[1][2]
- Jul 15, 2025
The Paypers publishes Tonella's fuller description: a confidential project and a warning to expect a call from a lawyer.[3]
What was the impact?
- Customers: No customers involved[1][3]
- Other: A targeted impersonation attempt on one senior ING manager; ING reported no payment, data loss or other harm.[1][3]
Severity 1 of 5: Contained social-engineering attempt on the bank's own staff: no payment, data loss, customer harm or regulatory action has been reported.
How did ING Groep N.V. respond?
ING disclosed the attempt itself. Tonella called it "a good learning moment" and said the tech firms in the middle of such scams, such as video-call platforms, should act more: "I imagine that these providers have more information about who is trying to reach out to whom. But today, I don't have the impression that this is really very actively taken care of." ING said employee training, phishing simulations and filtering technology are among its tools against deepfakes.[1][2][3]
What was the outcome, and did regulators act?
The impersonation did not succeed, according to ING's account. No arrest, prosecution or regulatory action connected to the voicemail has been reported in the sources reviewed as of 2026-10-21.[1][3]
What happened with the fake ING CEO voicemail?
In 2024 a senior ING manager received a voicemail that seemed to come from chief executive Steven van Rijswijk, about a confidential project and warning him to expect a call from a lawyer. It was fake. ING's CTO Daniele Tonella disclosed it in 2025 when discussing the growing threat of deepfakes.
Did ING lose any money to the deepfake voicemail?
No loss was reported. ING's own account and the interviews in The Banker and The Paypers describe the voicemail as a failed impersonation and a learning moment; none of them mentions a payment, data loss or harm to customers, and ING did not say whether money was requested.
Was the ING voicemail made with AI?
ING presented it as an example of deepfakes: its news page introduced the case with "Speaking on the growing threat of deep fakes", and The Banker placed it under AI-enabled fraud. ING did not name the tool used or say technically how the CEO's voice was imitated.
What did ING say should change after the fake CEO voicemail?
Tonella said ING relies on employee training, phishing simulations and filtering technology, and a culture where staff feel free to question unusual requests. He also argued that communication intermediaries such as video-call platforms know more about who contacts whom and should act more against impersonation.
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning