{ "meta": { "exportedAt": "2026-09-22T16:46:25.581Z", "formatVersion": 2, "selection": { "q": "financial-loss", "system": "", "harm": "", "context": "", "country": "", "role": "", "relation": "core", "evidence": "", "year": "", "response": "", "severity": "", "verification": "", "view": "incidents", "sort": "added" }, "totalIncidents": 9, "coverage": { "cases": 9, "countries": 8, "languages": 5, "unknownLocation": 0, "locationPending": 0, "unknownLanguage": 0, "unknownDate": 2, "lawsuits": 0, "regulatory": 7, "minors": 0, "coreRelations": 9, "contextualRelations": 0, "mixedRelations": 0, "unknownRelations": 0, "relationPending": 0, "relationUnknown": 0 }, "countingNote": "Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.", "affectedCountNote": "Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.", "source": "NOPE Incident Tracker", "url": "https://nope.net/incidents", "license": "CC BY 4.0" }, "incidents": [ { "id": "2026-campo-grande-ms-ai-voice-clone-brother-car-purchase-pix-fraud", "caseFacts": { "claims": [ { "id": "c1", "status": "reported", "evidence": [ { "locator": "'os golpistas usaram informações sobre sua família e uma voz clonada para fazê-lo acreditar que estava negociando um automóvel com a ajuda do próprio irmão'; 'Márcio passou o contato do irmão para que ele pudesse verificar o carro presencialmente. Foi a partir desse momento que os criminosos passaram a se fantasiar do familiar'; '\"Entraram em contato comigo como se fosse o meu irmão, falando que já viu o carro, mandou vídeo e que estava tudo certo\"'", "relation": "supports", "source_id": "s1" } ], "assertion": "After the workshop owner passed his brother's contact to a supposed seller in Ponta Porã, the fraudsters contacted him as if they were his brother, saying the brother had seen the car, sending a video and confirming that everything was in order; he says they used information about his family and a cloned voice.", "causal_attribution": "The victim's account as reported by G1 MS." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "'Acreditando que conversava com o parente, Márcio fez um Pix de aproximadamente R$ 28 mil para pagar pelo veículo. Logo depois, os criminosos bloquearam o contato'; 'acionou o banco pelo aplicativo e solicitou a contestação da transferência por meio do Mecanismo Especial de Devolução (MED) do Banco Central. Após quase três horas de atendimento, registro presencial e apresentação do boletim de ocorrência, ele conseguiu reaver cerca de 20% do valor perdido'", "relation": "supports", "source_id": "s1" } ], "assertion": "Believing he was talking to his brother, he made a Pix transfer of about R$28,000 for the car, after which the criminals blocked contact; he contested the transfer through the Central Bank's return mechanism and recovered about 20 percent after nearly three hours, an in-person registration and a police report.", "causal_attribution": "The victim's account; the loss is attributed to the fraudsters." }, { "id": "c3", "status": "reported", "evidence": [ { "locator": "'a mãe recebeu mensagens, um áudio e um vídeo de uma pessoa que se passava pela estudante'; 'Na gravação com a voz clonada, o criminoso afirmava que já estava no estabelecimento, que havia vistoriado o carro e o mecânico responsável também teria aprovado o veículo. A suposta Isabela autorizava, então, o pagamento via Pix'; 'A mãe, contudo, decidiu confirmar a informação diretamente com a filha. Foi quando descobriu que Isabela não estava no local e o áudio havia sido gerado por inteligência artificial'", "relation": "supports", "source_id": "s1" } ], "assertion": "In a second case, a medical student's mother in Dourados received messages, an audio and a video from someone posing as her daughter, in a cloned voice, saying she had inspected an HB20 at the family's trusted workshop and authorising the Pix; the mother checked directly with her daughter, found she was not there and that the audio had been AI-generated, and did not pay.", "causal_attribution": "The student's account as reported by G1 MS; no loss occurred." }, { "id": "c4", "status": "reported", "evidence": [ { "locator": "'afirmou que a unidade ainda não catalogou casos idênticos com o uso específico de clonagem de voz, o que sinaliza a novidade do modus operandi'; 'A reportagem questionou a Polícia Civil de Mato Grosso do Sul sobre esse tipo de crime, mas não obteve retorno até a última atualização desta reportagem'", "relation": "supports", "source_id": "s1" } ], "assertion": "A prosecutor of the Mato Grosso do Sul Public Ministry said the unit had not yet catalogued identical cases with voice cloning and recommended registering police reports even for attempts; G1 said the Civil Police had not responded to its questions.", "causal_attribution": "Prosecutor's statement to G1 MS." } ], "effects": [ { "label": "about R$28,000 transferred by Pix after voice notes in a brother's AI-cloned voice 'confirmed' a car purchase; about a fifth recovered", "claim_id": "c2", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://g1.globo.com/ms/mato-grosso-do-sul/noticia/2026/09/19/novo-golpe-do-pix-usa-voz-clonada-de-familiares-para-enganar-vitimas-em-negociacoes-de-carros.ghtml", "kind": "news_report", "access": "read", "language": "pt", "translation_note": "Read live in Portuguese on 2026-09-21 (HTTP 200; bylined Ana Karla Flores and Geane Beserra, g1 MS and TV Morena, 19 September 2026). Based on the two families' accounts and statements from a lawyer and a prosecutor; quotations translated by the reviewer.", "independence_group": "g1-ms-2026-09-19" } ], "version": 1, "ai_roles": [ "others_use" ], "contexts": [ "finance", "everyday_life", "relationships" ], "unknowns": [ "The date of the fraud and the police report are not stated.", "The voice-cloning tool is not identified and no police or technical confirmation of the AI element is reported.", "The exact amount transferred and recovered ('aproximadamente R$ 28 mil'; 'cerca de 20%') are approximate in the report.", "How the fraudsters obtained the brother's voice, and whether the seller's advertisement or accounts were traced, is not reported.", "No arrest or later coverage was found." ], "geography": { "basis": "Victim's workshop in Campo Grande, Mato Grosso do Sul; the car was supposedly in Ponta Porã; the second targeted family is in Campo Grande and Dourados (G1 MS). Police report registered; no court proceeding.", "court_countries": [], "event_countries": [ "BR" ], "affected_person_countries": [ "BR" ] }, "publication": { "basis": "Published under the 2026-09-15 charter as an impersonation-fraud case with a concrete financial loss reported by the victim in a bylined regional report that also documents a police report and the bank's partial return. One source read in full; claims recorded as reported and attributed. The victims are named in the report and are not named here.", "reviewed_on": "2026-09-21" }, "ai_involvement": { "basis": "The victim and G1 MS describe the audios as a cloned voice produced with artificial intelligence, and G1 publishes images of the audio messages; in the second case the mother found the audio 'havia sido gerado por inteligência artificial'. No police or technical confirmation of the AI element is reported and the tool is not identified.", "status": "reported" }, "person_relations": [ "depicted_or_impersonated" ] }, "name": "Campo Grande, Mato Grosso do Sul: a workshop owner paid about R$28,000 by Pix for a car after messages and voice notes in his brother's AI-cloned voice 'confirmed' the vehicle; a second family avoided the same fraud by checking directly with their daughter", "summary": "A businessman who owns a workshop in Campo Grande, Mato Grosso do Sul, found a car advertised at a market price by a seller who said he was in Ponta Porã, the businessman's home town; he passed his brother's contact so the brother could inspect the car. The fraudsters then contacted him as if they were his brother, saying he had seen the car, sending a video and confirming everything was in order; believing he was speaking to his brother, he made a Pix transfer of about R$28,000, after which the contact was blocked. He told G1 MS and TV Morena that the criminals used information about his family and a cloned voice. Guided by his wife, he contested the transfer through the Central Bank's special return mechanism and, after nearly three hours, a police report and an in-person registration, recovered about 20 percent. In a second case reported alongside, a medical student's mother in Dourados received messages, a voice note and a video from someone posing as her daughter, in a cloned voice, approving payment for an HB20 she was buying in Campo Grande; the mother checked directly with her daughter and discovered the audio had been AI-generated before any money was sent. A state prosecutor said his unit had not yet catalogued identical voice-cloning cases and urged victims to file police reports; the Civil Police did not respond to G1's questions. The date of the fraud is not reported.", "incidentKind": "single_event", "incidentDatePrecision": "unknown", "exposurePattern": "single_interaction", "reportedDate": "2026-09-19", "aiSystem": "AI voice cloning (tool not identified)", "severity": "medium", "verificationStatus": "credible", "harmCategories": [], "harmOutcomes": [ "financial_loss" ], "harmOutcomeSummary": "The workshop owner lost about R$28,000 in a Pix transfer made after voice notes and messages in his brother's AI-cloned voice 'confirmed' the car purchase, recovering about a fifth through the bank's return mechanism (his account to G1 MS and TV Morena).", "frameworkFacets": [], "causationStatus": "alleged", "participantUsersAffectedMin": 0, "otherPeopleHarmedMin": 1, "affectedCountStatus": "exact", "affectedCountEvidence": "One victim who made the transfer (G1 MS). The brother whose voice was imitated reports no loss; the student and her mother avoided the fraud before paying and are not counted. Exact 1.", "victimAgeRange": "adult", "jurisdiction": "BR", "platformType": "other", "outcomeType": "media_coverage", "outcomeStatus": "ongoing", "primarySourceUrl": "https://g1.globo.com/ms/mato-grosso-do-sul/noticia/2026/09/19/novo-golpe-do-pix-usa-voz-clonada-de-familiares-para-enganar-vitimas-em-negociacoes-de-carros.ghtml", "primarySourceLabel": "G1 MS and TV Morena, 19 September 2026: Voz clonada por IA ajuda golpistas a aplicar golpe de R$ 28 mil em compra de carro em Mato Grosso do Sul", "firstPublishedAt": "2026-09-21T04:11:23.184568+00:00", "scopeVersion": "facts-v3", "tags": [ "voice-cloning", "impersonation", "car-purchase-fraud", "pix", "brazil", "mato-grosso-do-sul", "campo-grande", "financial-loss" ] }, { "id": "2026-picos-piaui-ai-voice-clone-uncle-car-purchase-fraud", "caseFacts": { "claims": [ { "id": "c1", "status": "reported", "evidence": [ { "locator": "'Os golpistas utilizaram foto e áudios com voz clonada por inteligência artificial para se passar pelo tio'; 'iniciou negociação na segunda-feira (10), após encontrar um anúncio na internet com venda em Fortaleza (CE)'; 'Eles usaram a foto do familiar do influenciador e enviaram áudios que imitavam a voz dele'; 'usando algum tipo de inteligência artificial e a voz idêntica'", "relation": "supports", "source_id": "s1" } ], "assertion": "On 10-11 August 2026 fraudsters contacted the influencer from a different number using his uncle's photo and sent audios imitating the uncle's voice, generated with AI, to pose as the uncle who was supposed to inspect a car advertised for sale in Fortaleza.", "causal_attribution": "Victim's account as reported by G1." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "'perdeu mais de R$ 56 mil ao cair em um golpe durante a compra de um carro'; 'o golpista afirmou que o carro estava em boas condições e o orientou a realizar a transferência bancária'; 'entrou em contato com o número verdadeiro do tio descobriu que havia sido vítima de um golpe. O prejuízo ultrapassou R$ 56 mil'", "relation": "supports", "source_id": "s1" } ], "assertion": "Believing the audios came from his uncle, he made the bank transfer; the loss exceeded R$56,000, and he discovered the fraud when he called the uncle's real number.", "causal_attribution": "Victim's account; the loss is attributed to the fraudsters." }, { "id": "c3", "status": "reported", "evidence": [ { "locator": "'Um boletim de ocorrência foi registrado na terça-feira (11) e o caso é investigado pela Delegacia Especializada em Crimes contra o Patrimônio (Depatri)'; 'também tenta, junto aos bancos, o reembolso do valor pago'", "relation": "supports", "source_id": "s1" } ], "assertion": "A police report was registered on Tuesday 11 August 2026; the case is under investigation by Depatri; the victim is seeking reimbursement from the banks.", "causal_attribution": "G1 report; the police unit had not responded to G1." } ], "effects": [ { "label": "a bank transfer of more than R$56,000 lost after audios in a relative's AI-cloned voice 'confirmed' the purchase", "claim_id": "c2", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://g1.globo.com/pi/piaui/noticia/2026/08/13/influenciador-golpe-com-voz-clonada.ghtml", "kind": "news_report", "access": "read", "language": "pt", "translation_note": "Read live in Portuguese on 2026-09-20 (HTTP 200). Based on the victim's social-media account and an interview with G1; quotations translated by the reviewer.", "independence_group": "g1-piaui-2026-08-13" } ], "version": 1, "ai_roles": [ "others_use" ], "contexts": [ "finance", "everyday_life" ], "unknowns": [ "The voice-cloning tool is not identified and no police or technical confirmation of the AI element is reported.", "The exact amount beyond 'more than R$56,000' and whether any money was recovered are not stated.", "Whether the uncle's number or accounts were compromised, or how the fraudsters obtained his photo and voice, is not reported.", "No later coverage of the investigation was found.", "An embedded video title on the G1 page gives the loss as R$ 50 mil; the article text says more than R$ 56 mil, which this record follows." ], "geography": { "basis": "Victim in Picos, Piauí; the car was advertised in Fortaleza, Ceará, where the impersonated uncle lives; police report with the Piauí Depatri (G1 Piauí). No court proceeding.", "court_countries": [], "event_countries": [ "BR" ], "affected_person_countries": [ "BR" ] }, "publication": { "basis": "Published under the 2026-09-15 charter as an impersonation-fraud case with a concrete financial loss reported by the victim in a public account and a registered police report. One source (G1 Piauí) read in full; claims recorded as reported and attributed. The victim is a public influencer who reported the case under his own name; he is not named in this record.", "reviewed_on": "2026-09-20" }, "ai_involvement": { "basis": "The victim states that the fraudsters sent audios imitating his uncle's voice 'usando algum tipo de inteligência artificial e a voz idêntica' together with the uncle's photo; G1 reports this as his account. No police or technical confirmation of the AI element is reported and the tool is unknown.", "status": "reported" }, "person_relations": [ "depicted_or_impersonated" ] }, "name": "Picos, Piauí, Brazil: a digital influencer lost more than R$56,000 when fraudsters sent him audio messages in his uncle's AI-cloned voice 'confirming' a car he was buying in Fortaleza", "summary": "On Monday 10 August 2026 a digital influencer from Picos, in the centre-south of Piauí, began negotiating a car advertised online for sale in Fortaleza (Ceará), where an uncle of his lives, and asked the sellers to take the car to the uncle so he could inspect it. On Tuesday 11 August a contact using a different number but the uncle's photo sent him audio messages in a voice identical to his uncle's, generated with artificial intelligence, saying the car was in good condition and telling him to make the bank transfer. Believing he was speaking to his uncle, he transferred the money; when he then called the uncle's real number he learned he had been defrauded. The loss exceeded R$56,000, money he says he had saved for years. He registered a police report on 11 August; the Piauí property-crimes unit (Depatri) is investigating and he is seeking a refund from the banks. The account is the victim's own, reported by G1 Piauí on 13 August 2026 from his social-media posts and an interview; the police unit did not respond to G1 before publication.", "incidentDate": "2026-08-11", "incidentKind": "single_event", "incidentDatePrecision": "day", "exposurePattern": "single_interaction", "reportedDate": "2026-08-13", "aiSystem": "AI voice cloning (tool not identified)", "severity": "medium", "verificationStatus": "credible", "harmCategories": [], "harmOutcomes": [ "financial_loss" ], "harmOutcomeSummary": "One person lost more than R$56,000 in a bank transfer made after receiving audios in his uncle's cloned voice; the victim attributes the persuasion to AI voice cloning and the loss to the fraudsters.", "frameworkFacets": [], "causationStatus": "alleged", "participantUsersAffectedMin": 0, "otherPeopleHarmedMin": 1, "affectedCountStatus": "exact", "affectedCountEvidence": "One victim who made the transfer (G1 Piauí). No loss is reported for the uncle whose photo and voice were imitated, so he is not counted. Exact 1.", "victimAgeRange": "adult", "jurisdiction": "BR", "platformType": "other", "outcomeType": "investigation_opened", "outcomeStatus": "ongoing", "primarySourceUrl": "https://g1.globo.com/pi/piaui/noticia/2026/08/13/influenciador-golpe-com-voz-clonada.ghtml", "primarySourceLabel": "G1 Piauí, 13 August 2026: Influenciador do PI perde R$ 56 mil em golpe com voz clonada por IA durante compra de carro", "firstPublishedAt": "2026-09-20T03:28:14.49159+00:00", "scopeVersion": "facts-v3", "tags": [ "voice-cloning", "impersonation", "car-purchase-fraud", "brazil", "piaui", "financial-loss", "first-person-account" ] }, { "id": "2026-hudsonville-michigan-ai-voice-clone-closing-wire-fraud", "caseFacts": { "claims": [ { "id": "c1", "status": "reported", "evidence": [ { "locator": "\"the four-bedroom, $460,000 condo in the nearby suburb of Hudsonville checked every box\"; \"But on May 19 this year, days before closing, they got a startling email. To keep the closing on schedule, it said, the couple needed to wire $66,026.92 to a specified bank account within 24 hours to cover a down payment and closing costs\"; \"received a call to confirm the instructions, and the voice on the phone sounded just like their loan officer\"; \"The couple wired the money.\"; \"The closing was canceled hours before the couple was scheduled to sign the final paperwork\"; \"the couple instead rushed to borrow money from family and other sources\"; \"had two extra letters: UnitedsMortgages, instead of UnitedMortgage\".", "relation": "supports", "source_id": "s1" }, { "locator": "\"必須在24小時內把頭期款與交屋費用共計6萬6026.92元匯到指定銀行帳戶\"; \"收到一封緊急電郵，結果因此損失6萬多元\".", "relation": "supports", "source_id": "s2" } ], "assertion": "On 19 May 2026, days before closing on a US$460,000 condo in Hudsonville, Michigan, the couple received an email demanding a US$66,026.92 wire within 24 hours from an address with two extra letters and listing a phone number two digits off their loan officer's; the husband then received a call confirming the instructions in a voice that sounded just like the loan officer; the couple borrowed from family and wired the money, which was gone by the time the real loan officer's statement arrived the day before closing, and the closing was cancelled.", "causal_attribution": "The couple's account to CNN; the World Journal item relays CNN." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "\"ensnared in a sophisticated real estate scam that uses suspected AI voice cloning and fake emails to target homebuyers in the frantic days before closing\"; \"The 64-year-old said he now believes the phone call that followed the emails was from a spoofed number and used AI-assisted voice cloning\"; \"home-buying process was compromised\"; \"likely took snippets of the loan officer\"; \"Neither the company nor the loan officer have been accused of any complicity in the scam\".", "relation": "supports", "source_id": "s1" }, { "locator": "\"詐騙份子利用AI語音複製與偽造電郵\".", "relation": "supports", "source_id": "s2" } ], "assertion": "The husband believes the call came from a spoofed number using AI-assisted voice cloning; CertifID's co-founder, working with the couple and federal officials, said someone's email in the transaction was likely compromised and that the scammers likely cloned the loan officer's voice from his social-media posts; CNN describes the fraud as using 'suspected AI voice cloning'.", "causal_attribution": "Attribution by the victim and a fraud-prevention firm involved in the case; no forensic confirmation is published." }, { "id": "c3", "status": "reported", "evidence": [ { "locator": "\"They eventually got money from their mutual fund and completed the home purchase in early June\"; \"Internet Crime Complaint Center, the agency\"; \"wired the money to has since closed, the couple said\"; \"We are just very apprehensive\"; \"Do we need to work a little bit longer?\".", "relation": "supports", "source_id": "s1" }, { "locator": "\"終於在6月初完成購屋手續。他們已向FBI「網際網路犯罪申訴中心」(Internet Crime Complaint Center)報案\".", "relation": "supports", "source_id": "s2" } ], "assertion": "The couple later completed the purchase in early June 2026 from their mutual fund, filed a report with the FBI's Internet Crime Complaint Center, and say the receiving account has closed; they describe apprehension and discussions about delaying retirement.", "causal_attribution": "The couple's account to CNN." } ], "effects": [ { "label": "a couple wired US$66,026.92 to scammers after a spoofed email and a call in a voice resembling their loan officer; closing cancelled, money not recovered", "claim_id": "c1", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://www.cnn.com/2026/09/15/us/homebuyers-voice-cloning-scam", "kind": "news_report", "access": "read", "language": "en", "translation_note": "Read in English on 2026-09-19 (CNN, Faith Karimi, published 15 Sep 2026, updated the same day). Interviews with the couple, CertifID's Tyler Adams and the National Association of Realtors; FBI figures; lender's counsel comment.", "independence_group": "cnn" }, { "id": "s2", "url": "https://www.worldjournal.com/wj/story/121469/9231485", "kind": "news_report", "access": "read", "language": "zh", "translation_note": "Read in Traditional Chinese on 2026-09-16 and re-read on 2026-09-19 (World Journal, 15 Sep 2026): a relay of CNN's report, so it does not corroborate it; translation by the reviewer. Cited for the exact amount and the June completion of the purchase as reported in Chinese.", "independence_group": "cnn" } ], "version": 1, "ai_roles": [ "others_use" ], "contexts": [ "finance", "everyday_life" ], "unknowns": [ "Whether the call in fact used AI voice cloning; no forensic finding is reported.", "Whose email account was compromised and how the scammers obtained the transaction details.", "Whether any funds have been recovered or suspects identified.", "The exact loss after any recovery; CNN reports the wired amount and that the money was gone." ], "geography": { "basis": "Hudsonville, a suburb of Grand Rapids, Michigan, per CNN's report and photographs; the couple live there. No court proceeding; an FBI IC3 report was filed.", "court_countries": [], "event_countries": [ "US" ], "affected_person_countries": [ "US" ] }, "publication": { "basis": "Published under the 2026-09-15 charter as an impersonation-fraud case with a concrete, quantified consequence: a couple lost US$66,026.92 after a call in a voice resembling their loan officer that they and a fraud-prevention firm attribute to AI voice cloning. One original report (CNN) and one relay read; AI involvement recorded as suspected; the couple are not named in this record.", "reviewed_on": "2026-09-19" }, "ai_involvement": { "basis": "CNN describes 'suspected AI voice cloning'; the husband believes the confirming call used AI-assisted voice cloning from a spoofed number, and CertifID's co-founder, who is working on the case, says the scammers likely cloned the loan officer's voice from social-media clips. No technical confirmation is published. If the attribution is right, the AI impersonated a third party (the loan officer) in a live call with the victim; the email side of the fraud is ordinary spoofing.", "status": "suspected" }, "person_relations": [ "depicted_or_impersonated", "communicated_with" ] }, "name": "Hudsonville (Grand Rapids area), Michigan: a couple wired US$66,026.92 to scammers after a spoofed email and a phone call in what sounded like their loan officer's voice, which they and a fraud-prevention firm attribute to AI voice cloning", "summary": "A married couple in their sixties buying a US$460,000 condo in Hudsonville, near Grand Rapids, Michigan, received an email on 19 May 2026, days before closing, telling them to wire US$66,026.92 for the down payment and closing costs within 24 hours. The email listed a phone number differing from their loan officer's by two digits, and the husband then received a call confirming the instructions in a voice that sounded just like the loan officer. The couple borrowed from family and other sources and wired the money. The day before closing their real loan officer sent the actual statement; the closing was cancelled hours before signing and the money was gone. The husband now believes the call came from a spoofed number using AI-assisted voice cloning; Tyler Adams of CertifID, which is working with the couple and federal officials, said someone's email in the transaction was probably compromised and that the scammers likely cloned the loan officer's voice from social-media clips. The sender's address had two extra letters ('UnitedsMortgages' instead of 'UnitedMortgage'). Neither the lender nor the loan officer is accused of complicity. The couple later completed the purchase in early June from their mutual fund, reported the loss to the FBI's Internet Crime Complaint Center, and describe lasting apprehension and have discussed delaying retirement. CNN reported the case on 15 September 2026; the account the money went to has since closed.", "incidentDate": "2026-05-19", "incidentKind": "single_event", "incidentDatePrecision": "day", "exposurePattern": "single_interaction", "reportedDate": "2026-09-15", "aiSystem": "Suspected AI voice cloning of a mortgage loan officer, combined with a spoofed phone number and a look-alike email domain (tool not identified; attribution by the victims and CertifID)", "severity": "medium", "verificationStatus": "unverified", "harmCategories": [], "harmOutcomes": [ "financial_loss", "psychological_distress" ], "harmOutcomeSummary": "A couple wired US$66,026.92, partly borrowed from family, to a fraudulent account after a spoofed email and a call in what sounded like their loan officer's voice; the money was not recovered as of CNN's report, their closing was cancelled and later completed from savings, and they describe lasting apprehension and have discussed working longer before retiring.", "frameworkFacets": [], "causationStatus": "alleged", "participantUsersAffectedMin": 0, "otherPeopleHarmedMin": 2, "affectedCountStatus": "exact", "affectedCountEvidence": "CNN describes one married couple who wired the funds and bore the loss. Exact count of two.", "victimAgeRange": "adult", "jurisdiction": "US", "platformType": "other", "outcomeType": "investigation_opened", "outcomeStatus": "ongoing", "primarySourceUrl": "https://www.cnn.com/2026/09/15/us/homebuyers-voice-cloning-scam", "primarySourceLabel": "CNN, 15 Sep 2026: 'We both missed the signs:' How two homebuyers lost $66,000 in a suspected voice-cloning scam", "firstPublishedAt": "2026-09-20T03:19:50.137088+00:00", "scopeVersion": "facts-v3", "tags": [ "voice-cloning", "impersonation", "wire-fraud", "real-estate-scam", "mortgage-closing", "united-states", "michigan", "financial-loss", "ic3" ] }, { "id": "2026-kazakhstan-deepfake-celebrity-trading-fraud-series", "caseFacts": { "claims": [ { "id": "c1", "status": "reported", "evidence": [ { "locator": "\"Только за последние полтора месяца по стране было зарегистрировано 119 таких фактов\"; \"создают дипфейк-видео со знаменитостями и фейковые ИИ-платформы, обещающие сверхвысокий пассивный доход\".", "relation": "supports", "source_id": "s1" }, { "locator": "\"В Казахстане за последние полтора месяца зарегистрировали 119 случаев мошенничества под видом трейдинга с использованием дипфейков, сообщили в Генеральной прокуратуре\".", "relation": "supports", "source_id": "s2" }, { "locator": "\"По информации Генпрокуратуры, только за последние полтора месяца по стране зарегистрировано 119 таких фактов\".", "relation": "supports", "source_id": "s3" }, { "locator": "\"Только за последние полтора месяца в стране зарегистрировали 119 фактов мошенничества\".", "relation": "supports", "source_id": "s5" } ], "assertion": "The Prosecutor General's Office said that in the previous one and a half months 119 cases of fraud had been registered in Kazakhstan in a scheme that lures victims through social-media deepfake videos of celebrities and fake 'AI' investment platforms (named examples: 'Kaspi AI' with Mikhail Lomtadze, 'Quantum AI' with Elon Musk, 'TON' with Pavel Durov, 'people's investments' fronted by television news presenters).", "causal_attribution": "Single official statement relayed by five outlets; the 119 figure is a count of registered cases, and the deepfake description is the office's characterisation of the scheme." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "\"В сентябре текущего года жительница Талдыкоргана обратилась с заявлением по факту мошенничества в особо крупном размере\"; \"перевела на счета 3-их лиц более 7 млн\"; \"По указанному факту проводится досудебное расследование\".", "relation": "supports", "source_id": "s1" }, { "locator": "\"Одной из жертв мошенников стала жительница Талдыкоргана\"; \"Перечисленные ею деньги и якобы дивиденды отображались в фейковом кошельке, однако возможность их обналичить мошенники не предоставили. По указанному факту проводится досудебное расследование\".", "relation": "supports", "source_id": "s3" }, { "locator": "\"Более 7 млн тенге перевела злоумышленникам жительница Талдыкоргана, поверив в рекламу о сверхприбыли от трейдинга\"; \"Вывести средства женщина не смогла\".", "relation": "supports", "source_id": "s4" }, { "locator": "\"она перевела на счета третьих лиц более 7 млн тенге\".", "relation": "supports", "source_id": "s2" } ], "assertion": "In September 2026 a woman from Taldykorgan reported large-scale fraud: after an Instagram advertisement offering super-profits from share trading she left her details, was contacted by the fraudsters and on their instructions transferred more than 7 million tenge to third-party accounts; the money and supposed dividends showed in a fake wallet she could not cash out; a pre-trial investigation is under way.", "causal_attribution": "The office's account of one registered case, given as an example of the scheme; whether the advertisement she saw was a deepfake video is not stated." } ], "effects": [ { "label": "a woman lost more than 7 million tenge; 119 registered cases of deepfake-fronted trading fraud in about six weeks", "claim_id": "c2", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://kazpravda.kz/n/dipfeyki-maska-durova-i-lomtadze-kazahstancev-obmanyvayut-pod-vidom-treydinga/", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-19 (Kazakhstanskaya Pravda, Dana Amenova, 16 Sep 2026), citing the Prosecutor General's press service; quotations in this record are the reviewer's translations from the Russian body.", "independence_group": "kz-prosecutor-general" }, { "id": "s2", "url": "https://informburo.kz/novosti/dipfeiki-ilona-maska-i-pavla-durova-119-slucaev-mosennicestva-s-treidingom-zaregistrirovali-v-kazaxstane", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-19 (Informburo.kz, 16 Sep 2026). Same Prosecutor General statement, with the office's quoted description of the Taldykorgan case.", "independence_group": "kz-prosecutor-general" }, { "id": "s3", "url": "https://tengrinews.kz/kazakhstan_news/kazahstanka-lishilas-7-millionov-tenge-reklamyi-instagram-608643/", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-19 (Tengrinews, 16 Sep 2026). Same statement; carries the office's quoted sentence on the fake wallet and the pre-trial investigation.", "independence_group": "kz-prosecutor-general" }, { "id": "s4", "url": "https://kazlenta.kz/120453-moshennichestvo-pod-vidom-treydinga-genprokuratura-obratilas-k-kazahstancam.html", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-19 (Kazlenta.kz, 16 Sep 2026, the earliest report found). Same statement.", "independence_group": "kz-prosecutor-general" }, { "id": "s5", "url": "https://kz.kursiv.media/2026-09-16/ezif-lomtadze-mask-i-durov-daryat-milliony-kak-kazahstancev-zamanivayut-v-lzheinvesticii/", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-19 (Kursiv Media, 16 Sep 2026). Same statement.", "independence_group": "kz-prosecutor-general" } ], "version": 1, "ai_roles": [ "others_use" ], "contexts": [ "finance", "everyday_life" ], "unknowns": [ "Whether the Instagram advertisement seen by the Taldykorgan woman was itself a deepfake video or a fake 'AI platform' page.", "The number of victims and total losses across the 119 registered cases; the exact period ('the last one and a half months' before mid-September 2026).", "Whether any suspects have been identified or funds recovered.", "The Prosecutor General's original release text was not reached (gov.kz is JavaScript-only to this host); the record relies on five press relays of the press service." ], "geography": { "basis": "Nationwide registrations in Kazakhstan per the Prosecutor General's Office; the identified victim lives in Taldykorgan (Zhetysu region). No court proceeding reported.", "court_countries": [], "event_countries": [ "KZ" ], "affected_person_countries": [ "KZ" ] }, "publication": { "basis": "Published under the 2026-09-15 charter as an impersonation-fraud series with an official source: the Prosecutor General's Office reports 119 registered cases in about six weeks lured by deepfake celebrity videos and fake 'AI' platforms, and one identified anonymous victim who lost more than 7 million tenge. Five Russian-language bodies read, all relaying one official statement (claims reported); person count kept to the one identified victim plus unquantified others.", "reviewed_on": "2026-09-19" }, "ai_involvement": { "basis": "The Prosecutor General's Office describes the scheme's lure as deepfake videos of celebrities and fake 'AI' platforms placed on social networks; no technical verification is published, and the statement does not say whether the Taldykorgan woman's Instagram advertisement was itself a deepfake. The AI artifacts depicted and impersonated public figures; the victims' dealings were with human fraudsters.", "status": "reported" }, "person_relations": [ "depicted_or_impersonated" ] }, "name": "Kazakhstan: the Prosecutor General's Office reported 119 trading-fraud cases registered in about six weeks, lured by deepfake videos of Elon Musk, Pavel Durov and other public figures and fake 'AI' platforms; a Taldykorgan woman transferred more than 7 million tenge", "summary": "On 16 September 2026 the Prosecutor General's Office of Kazakhstan warned of an investment-fraud scheme in which criminals advertise non-existent projects on TikTok, Instagram, YouTube and other platforms using deepfake videos of well-known people and fake 'AI' investment platforms promising very high passive income: 'Kaspi AI' with Mikhail Lomtadze, 'Quantum AI' with Elon Musk, 'TON' with Pavel Durov, and 'people's investments' in KazMunayGas or Gazprom fronted by news presenters from Khabar 24, KTK and Channel One. The office said 119 such cases had been registered across the country in the previous one and a half months. Its example: in September 2026 a woman from Taldykorgan saw an Instagram advertisement offering high returns from share trading, left her details through the link, was contacted by the fraudsters and, following their instructions, transferred more than 7 million tenge to third-party accounts; the money and supposed dividends appeared in a fake wallet that she could not withdraw from. A pre-trial investigation is under way. The office urged people not to trust guaranteed-return offers or transfer money to strangers.", "incidentDate": "2026-08-01", "incidentEndDate": "2026-09-16", "incidentKind": "bounded_series", "incidentDatePrecision": "range", "exposurePattern": "repeated_interactions", "reportedDate": "2026-09-16", "aiSystem": "Deepfake videos of public figures (Elon Musk, Pavel Durov, Mikhail Lomtadze, television news presenters) and fake 'AI' investment platforms ('Quantum AI', 'Kaspi AI'); generation tools not identified", "severity": "medium", "verificationStatus": "unverified", "harmCategories": [], "harmOutcomes": [ "financial_loss" ], "harmOutcomeSummary": "A woman in Taldykorgan transferred more than 7 million tenge to fraudsters after an Instagram trading advertisement and could not withdraw the supposed returns; the Prosecutor General's Office registered 119 such fraud cases nationwide in about six weeks, in a scheme whose lure is deepfake celebrity videos and fake 'AI' platforms.", "frameworkFacets": [], "causationStatus": "supported", "participantUsersAffectedMin": 0, "otherPeopleHarmedMin": 1, "affectedCountStatus": "partial", "affectedCountEvidence": "One identified victim (the Taldykorgan woman, more than 7 million tenge). The 119 figure counts registered fraud cases ('фактов'), not people, so the remaining victims are unquantified. One counted plus unquantified others: partial.", "victimAgeRange": "unknown", "jurisdiction": "KZ", "platformType": "other", "outcomeType": "investigation_opened", "outcomeStatus": "ongoing", "primarySourceUrl": "https://kazpravda.kz/n/dipfeyki-maska-durova-i-lomtadze-kazahstancev-obmanyvayut-pod-vidom-treydinga/", "primarySourceLabel": "Kazakhstanskaya Pravda, 16 Sep 2026: Deepfakes of Musk, Durov and Lomtadze: Kazakhstanis defrauded under the guise of trading (Prosecutor General's Office statement)", "firstPublishedAt": "2026-09-20T03:19:45.310788+00:00", "scopeVersion": "facts-v3", "tags": [ "deepfake", "celebrity-impersonation", "investment-fraud", "trading-scam", "fake-ai-platform", "kazakhstan", "prosecutor-general", "financial-loss", "instagram" ] }, { "id": "2026-shanghai-ai-generated-persona-online-romance-fraud-170k-yuan", "caseFacts": { "claims": [ { "id": "c1", "status": "reported", "evidence": [ { "locator": "«对方自称1992年出生，是知名三甲医院医生，手握医院物业工程项目资源» (she claimed to be born in 1992, a doctor at a well-known tertiary hospital, holding hospital property-engineering project resources); «陆续向对方转账共计17万元» (transferred a total of 170,000 yuan in instalments); «就连想要打一通视频电话，对方也会以母亲在一旁看管作为理由拒绝» (even a video call was refused on the ground that her mother was watching); «反复回想交往细节，…越想越不对劲，才到派出所报案» (thinking back over the details he felt something was wrong and went to the police station).", "relation": "supports", "source_id": "s2" }, { "locator": "«在短短5个月时间里，…陆续向对方转账共计17万元» (in just five months he transferred 170,000 yuan in total); «去年开始与其频繁聊天» (frequent chatting began last year, i.e. 2025).", "relation": "supports", "source_id": "s1" } ], "assertion": "Over five months the man transferred a total of 170,000 yuan to a woman he had met on a social platform in 2021 who claimed to be a 1992-born doctor at a well-known top-tier hospital with property-engineering projects to award; she refused meetings and video calls citing her mother; he reported to the police when the promised projects never materialised.", "causal_attribution": "police account via the programme 案件聚焦, relayed by Jiupai News and Guangming Net; single official chain." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "«实际出生于1961年，现年65岁，她并无医生资质，仅曾在医院从事后勤保洁工作» (actually born in 1961, now 65, no medical qualification, had only done hospital logistics cleaning); «注意到部分视频角落有一行小字提示：本作品含AI生成内容» (noticed a small corner label on some videos: this work contains AI-generated content); «累计近七千条日常视频、上万粉丝，全都是AI磨皮、场景合成制作而成» (nearly 7,000 videos and 10,000-plus followers, all made with AI skin-smoothing and scene compositing); «一人分饰两角，利用多个账号，分别扮演自己和早已离世的母亲» (played two roles through multiple accounts, herself and her long-dead mother).", "relation": "supports", "source_id": "s2" }, { "locator": "«…社交账号发布的累计近7000条日常视频、上万粉丝，全都是AI磨皮、场景合成制作而成» (the account's nearly 7,000 videos were all AI-processed).", "relation": "supports", "source_id": "s1" } ], "assertion": "Police found the woman was born in 1961, aged 65, had no medical qualification and had worked as a hospital cleaner; her close to 7,000 videos were made with AI skin-smoothing and scene compositing, some carrying a small 'contains AI-generated content' label the victim had never noticed; she used multiple accounts to play herself and her deceased mother.", "causal_attribution": "Police findings as presented in the programme; no independent chain." }, { "id": "c3", "status": "reported", "evidence": [ { "locator": "«全部被她用于医美护肤、购置衣物等个人挥霍。2009年，她还曾因诈骗罪被判处有期徒刑四年六个月» (all spent on cosmetic treatments and clothing; in 2009 she was sentenced to four years six months for fraud); «因涉嫌诈骗罪，已被公安机关依法采取刑事强制措施» (criminal coercive measures taken for suspected fraud).", "relation": "supports", "source_id": "s2" }, { "locator": "«…曾于2009年因诈骗罪被判监4年半。目前，…因涉嫌诈骗罪已被公安机关采取刑事强制措施» (2009 fraud sentence of four and a half years; now under criminal coercive measures).", "relation": "supports", "source_id": "s3" } ], "assertion": "The 170,000 yuan was spent on cosmetic skin treatments and clothing; the woman had been sentenced to four years and six months for fraud in 2009; she is under criminal coercive measures for suspected fraud.", "causal_attribution": "Police statement relayed by press." }, { "id": "c4", "status": "reported", "evidence": [ { "locator": "«同时与十余人保持暧昧关系» (simultaneously kept ambiguous relationships with more than ten people). (police-attributed sentence in the Epoch Times)", "relation": "supports", "source_id": "s4" }, { "locator": "headline: '65岁阿姨AI换脸装“90后”美女，谈10多个暧昧对象' (the s1 body text does not repeat it)", "relation": "context", "source_id": "s1" } ], "assertion": "Police said the woman simultaneously kept ambiguous relationships with more than ten people; no loss by anyone else is reported.", "causal_attribution": "Police statement relayed by the Epoch Times; context only, no further victims quantified." } ], "effects": [ { "label": "a man transferred 170,000 yuan over five months to a fabricated AI-processed persona and the money is reported spent", "claim_id": "c1", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://m.gmw.cn/2026-09/16/content_1304564495.htm", "kind": "news_report", "access": "read", "language": "zh", "translation_note": "Read in Chinese on 2026-09-19 (Guangming Net, 16 September 2026, sourced to 贵阳晚报). Marks the victim's name as a pseudonym (化名). Same police-programme chain as the other sources. Model-read original; English glosses unreviewed by a bilingual human. Chain line '综合：法治日报、案件聚焦、深圳新闻网'.", "independence_group": "shanghai-police-case-focus-programme" }, { "id": "s2", "url": "https://news.qq.com/rain/a/20260915A0CNH000", "kind": "news_report", "access": "read", "language": "zh", "translation_note": "Read in Chinese on 2026-09-19 (Jiupai News on Tencent News, 15 September 2026; body recovered from the page's script payload). Carries the attribution line 来源：案件聚焦、看看新闻. Same chain as s1. Its lede reads '五年网恋' where its body and s1 say five months; the Jiaohuidian copy of the same text reads '关注对方账号五年、五个月网恋', so the lede is a truncation. Jiupai does not mark the names as pseudonyms; s1, s3 and s4 do.", "independence_group": "shanghai-police-case-focus-programme" }, { "id": "s3", "url": "https://www.stheadline.com/zh-hans/realtime-china/3616014/AI%E5%8F%98%E8%84%B8%E9%AA%97%E5%B1%8065%E5%B2%81%E6%B8%85%E6%B4%81%E9%98%BF%E5%A7%A8%E4%BC%AA%E8%A3%8590%E5%90%8E%E7%BE%8E%E5%A5%B3%E5%8C%BB%E7%94%9F-%E4%B8%8A%E6%B5%B7%E7%94%B7%E7%BD%91%E6%81%8B5%E4%B8%AA%E6%9C%88%E8%A2%AB%E9%AA%9717%E4%B8%87", "kind": "news_report", "access": "read", "language": "zh", "translation_note": "Read in Chinese on 2026-09-19 (Sing Tao Headline, Hong Kong; '综合内媒报道', a digest of mainland reports). Marks both names as pseudonyms. Same chain.", "independence_group": "shanghai-police-case-focus-programme" }, { "id": "s4", "url": "https://www.epochtimes.com/gb/26/9/17/n14851558.htm", "kind": "news_report", "access": "read", "language": "zh", "translation_note": "Read in Chinese on 2026-09-19 (Epoch Times, 17 September 2026; '据大陆媒体报导'). Adds the police statement that the suspect kept ambiguous relationships with more than ten people. Same chain.", "independence_group": "shanghai-police-case-focus-programme" } ], "version": 1, "ai_roles": [ "others_use" ], "contexts": [ "relationships", "finance" ], "unknowns": [ "The months of the five-month relationship and of the police report are not stated; frequent chatting began in 2025 per Guangming Net, so the first known event year is recorded as 2025 at year precision.", "The AI tools used to make the videos are not identified.", "Whether prosecutors have charged the suspect, and whether any money was recovered, is not reported.", "Whether any of the more than ten other contacts lost money is not reported.", "The Kankan News 案件聚焦 broadcast page was not readable (script shell); the programme's account is known through press relays." ], "geography": { "basis": "The victim is described as a Shanghai man (上海男子), the two were in the same city (同在一个城市) and the demanded flat was in Shanghai (在上海购置房产); no court proceeding is reported.", "court_countries": [], "event_countries": [ "CN" ], "affected_person_countries": [ "CN" ] }, "publication": { "basis": "Published under the 2026-09-15 charter as an impersonation case with a documented 170,000 yuan loss to one person, where police examined the AI-processed videos and their AI-content label. One official chain relayed by several outlets, so claims are recorded as reported. Both parties are pseudonymised in the reporting and the pseudonyms have been elided from the quoted passages here.", "reviewed_on": "2026-09-19" }, "ai_involvement": { "basis": "police, via the Kankan News programme 案件聚焦, said officers found an AI-generated-content label on some of the suspect's videos and established that her roughly 7,000 videos were produced with AI skin-smoothing and scene compositing. The AI content depicted a fabricated young persona shown to the victim, which is why depicted_or_impersonated is recorded; the chat itself was conducted by the suspect, so communicated_with is not recorded. Single official chain relayed by several outlets.", "status": "supported" }, "person_relations": [ "depicted_or_impersonated" ] }, "name": "Shanghai: a man transferred 170,000 yuan over a five-month online romance with a '1992-born hospital doctor' whose roughly 7,000 videos were AI-processed fabrications by a 65-year-old woman; police took criminal coercive measures", "summary": "police, as presented by the Kankan News programme 案件聚焦 (Case Focus), reported in September 2026 that a Shanghai property-engineering contractor had transferred 170,000 yuan in total during a five-month online relationship with a woman he had met on a social platform in 2021. She presented herself as born in 1992, a doctor at a well-known top-tier hospital with hospital property-engineering projects to award, and ran an account with more than 10,000 followers and close to 7,000 short videos of daily life. She refused to meet or take a video call, saying her mother opposed the relationship and demanded a 300,000 yuan bride price and a Shanghai flat; the man reported to a police station when the promised projects never materialised and his savings ran down. Police found she was born in 1961, aged 65, had no medical qualification and had worked as a hospital cleaner; the receiving bank account was registered to another man; the videos were all made with AI skin-smoothing and scene compositing, some carrying a small 'this work contains AI-generated content' label he had never noticed; and she used multiple accounts to play both herself and her long-dead mother. The money had gone on cosmetic treatments and clothing; she had a 2009 fraud conviction with a sentence of four and a half years and is now under criminal coercive measures for suspected fraud. Police also said she kept ambiguous relationships with more than ten people; no other losses are reported.", "incidentDate": "2025-01-01", "incidentKind": "bounded_series", "incidentDatePrecision": "year", "exposurePattern": "cumulative_relationship", "reportedDate": "2026-09-15", "aiSystem": "AI video processing ('AI磨皮、场景合成': AI skin-smoothing and scene compositing) used to produce close to 7,000 short videos of a fabricated young 'doctor' persona; tools not identified", "severity": "medium", "verificationStatus": "credible", "harmCategories": [], "harmOutcomes": [ "financial_loss" ], "harmOutcomeSummary": "A Shanghai man transferred 170,000 yuan over five months to a fabricated 'doctor' persona whose videos police found were AI-processed; the money is reported spent and no recovery is reported.", "frameworkFacets": [], "causationStatus": "supported", "participantUsersAffectedMin": 0, "otherPeopleHarmedMin": 1, "affectedCountStatus": "exact", "affectedCountEvidence": "One man with a documented loss of 170,000 yuan. Police said the suspect kept ambiguous relationships with more than ten other people, but no loss by anyone else is reported, so they are not counted.", "victimAgeRange": "adult", "jurisdiction": "CN", "platformType": "other", "outcomeType": "investigation_opened", "outcomeStatus": "ongoing", "primarySourceUrl": "https://m.gmw.cn/2026-09/16/content_1304564495.htm", "primarySourceLabel": "Guangming Net (光明网), 16 September 2026: 65岁阿姨AI换脸装“90后”美女，谈10多个暧昧对象 (Shanghai police programme 案件聚焦 via 贵阳晚报)", "firstPublishedAt": "2026-09-20T03:12:46.86943+00:00", "scopeVersion": "facts-v3", "tags": [ "ai-generated-video", "synthetic-persona", "romance-fraud", "shanghai", "china", "financial-loss", "police-reported", "ai-content-label" ] }, { "id": "2026-attica-nea-ionia-ai-voice-clone-relative-fraud-ring", "caseFacts": { "claims": [ { "id": "c1", "status": "reported", "evidence": [ { "locator": "'Ιδιαίτερο χαρακτηριστικό της δράσης της εγκληματικής οργάνωσης αποτελούσε η χρήση εργαλείων τεχνητής νοημοσύνης (A.I.) για την κλωνοποίηση της φωνής συγγενικού προσώπου του υποψήφιου θύματος'; 'Κατά τη διάρκεια της σύντομης συνομιλίας αποκτούσαν δείγμα της φωνής του και, με τη χρήση εργαλείου τεχνητής νοημοσύνης, προέβαιναν στην κλωνοποίηση'", "relation": "supports", "source_id": "s1" }, { "locator": "'επικοινωνούσαν τηλεφωνικά με τα υποψήφια θύματα και τα έπειθαν να προβούν σε συγκεκριμένες ενέργειες'; 'κυρίως για θέματα που αφορούν την εγκατάσταση οπτικής ίνας'; 'αναπαράγοντας μέσω της τεχνολογίας κλωνοποίησης τη φωνή του συγγενικού ή οικείου του προσώπου'", "relation": "supports", "source_id": "s2" } ], "assertion": "The organisation used an AI tool to clone the voice of a relative of the intended victim, obtained from a pretext call, and played the cloned voice to the victim to confirm the fraudsters' instructions during fake fibre-installation or utility scenarios.", "causal_attribution": "Hellenic Police statement; single official chain." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "'συνελήφθησαν -2- από τα μέλη της οργάνωσης, τη στιγμή που μόλις είχαν αφαιρέσει από οικία θύματος, τιμαλφή αξίας -30.000- ευρώ'; 'Πρόκειται για έναν 23χρονο και έναν 25χρονο'", "relation": "supports", "source_id": "s1" }, { "locator": "'συνελήφθησαν δύο από τα μέλη της οργάνωσης, τη στιγμή που μόλις είχαν αφαιρέσει από οικία θύματος, τιμαλφή αξίας 30.000 ευρώ'", "relation": "supports", "source_id": "s2" } ], "assertion": "Two members aged 23 and 25 were arrested in Nea Ionia, Attica, immediately after removing valuables worth €30,000 from a victim's home.", "causal_attribution": "Police account of the arrest; the loss is attributed to the ring." }, { "id": "c3", "status": "reported", "evidence": [ { "locator": "'Μέχρι στιγμής έχει πιστοποιηθεί η εμπλοκή των μελών της οργάνωσης σε επιπλέον -5- περιπτώσεις με παρόμοια μεθοδολογία'; 'με όφελος άνω των -120.000- ευρώ, περιλαμβάνονται ακόμη -4- άτομα'; 'το παράνομο περιουσιακό όφελος από τη δράση της εγκληματικής οργάνωσης ξεπερνά το -1.000.000- ευρώ'; 'τουλάχιστον από τις αρχές Ιουλίου 2026'", "relation": "supports", "source_id": "s1" }, { "locator": "'Μέχρι στιγμής έχουν διακριβωθεί ακόμη πέντε περιπτώσεις με παρόμοια μεθοδολογία'; 'Το παράνομο περιουσιακό όφελος που αποδίδεται στη δράση της ομάδας εκτιμάται ότι ξεπερνά το 1 εκατομμύριο ευρώ'", "relation": "supports", "source_id": "s3" } ], "assertion": "Police have confirmed the group's involvement in at least five further cases with the same method, document proceeds above €120,000 in the case file, which names four further people, and estimate total illicit gains above €1 million; the group operated since at least early July 2026.", "causal_attribution": "Police figures; the €1 million is an estimate and is not used as a loss count." }, { "id": "c4", "status": "reported", "evidence": [ { "locator": "'Οι συλληφθέντες οδηγήθηκαν στον αρμόδιο Εισαγγελέα και παραπέμφθηκαν στον Ανακριτή'; 'κατασχέθηκαν ένα όχημα Δημόσιας Χρήσης και -2- συσκευές κινητής τηλεφωνίας'; 'κλοπή οχήματος που τελέστηκε στις 14/9/2026'", "relation": "supports", "source_id": "s1" } ], "assertion": "The two arrested were brought before the prosecutor and referred to an investigating judge; a taxi and two mobile phones were seized and a vehicle stolen on 14 September 2026 was attributed to the group.", "causal_attribution": "Police statement." } ], "effects": [ { "label": "a victim's valuables worth €30,000 were taken after calls in which a cloned relative's voice confirmed the fraudsters' instructions; police confirm at least five further victims", "claim_id": "c2", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://tvstar.gr/2026/09/18/klonopoious", "kind": "news_report", "access": "read", "language": "el", "translation_note": "Read in Greek on 2026-09-19; the second half of the article reproduces the Hellenic Police announcement verbatim. Quotations translated by the reviewer.", "independence_group": "hellenic-police-release" }, { "id": "s2", "url": "https://www.in.gr/2026/09/18/greece/egklimatiki-organosi-eksapatouse-klonopoiontas-fones-syggenikon-prosopon-ton-thymaton-leia-ano-tou-1-ekat-eyro/", "kind": "news_report", "access": "read", "language": "el", "translation_note": "Read in Greek on 2026-09-19; carries the police announcement text ('Σύμφωνα με την ΕΛ.ΑΣ.').", "independence_group": "hellenic-police-release" }, { "id": "s3", "url": "https://indicator.gr/i-nea-ai-apati-mama-eimai-ego-klonopoioyn", "kind": "news_report", "access": "read", "language": "el", "translation_note": "Read in Greek on 2026-09-19; a rewritten account of the same police announcement ('σύμφωνα με τις πληροφορίες', 'σύμφωνα με την ΕΛ.ΑΣ.'), grouped with it.", "independence_group": "hellenic-police-release" } ], "version": 1, "ai_roles": [ "others_use" ], "contexts": [ "finance", "everyday_life" ], "unknowns": [ "The AI voice-cloning tool is not identified and no recording of a cloned call has been published.", "The number of people harmed in the five further cases, their losses, and whether any money was recovered are not stated.", "The date of the arrests is not given (the release is dated 18 September 2026).", "The Hellenic Police release page itself could not be fetched (astynomia.gr 403); its text is taken from full reproductions.", "Names and ages of the victims and of the cloned relatives are not published." ], "geography": { "basis": "Arrests in Nea Ionia, Attica, at a victim's home; the police describe an Attica-based operation; the arrested were brought before the competent prosecutor and referred to an investigating judge (Hellenic Police release as reproduced by tvstar.gr and in.gr).", "court_countries": [ "GR" ], "event_countries": [ "GR" ], "affected_person_countries": [ "GR" ] }, "publication": { "basis": "Published under the 2026-09-15 charter as an impersonation-fraud series with a police-documented loss to an identified (unnamed) victim and at least five further confirmed victims, where the police describe AI voice cloning as the method of persuasion. Three Greek reports read, all relaying one Hellenic Police release; claims recorded as reported. Victims and relatives unnamed; suspects identified only by age.", "reviewed_on": "2026-09-19" }, "ai_involvement": { "basis": "The Hellenic Police announcement states that the organisation used artificial-intelligence tools to clone the voice of a relative of the intended victim from a sample obtained in a pretext call, and played the cloned voice to the victim to confirm the fraudsters' instructions. The cloned voice impersonated the relative and was used to speak to the victim, which is why both relations are recorded. The tool is not identified and no recording has been published; all inspected accounts relay the police release.", "status": "reported" }, "person_relations": [ "communicated_with", "depicted_or_impersonated" ] }, "name": "Attica, Greece: a fraud ring cloned relatives' voices with AI to 'confirm' fake fibre-installation instructions; two collectors arrested in Nea Ionia with €30,000 of a victim's valuables, at least six cases since July 2026", "summary": "On 18 September 2026 the Hellenic Police announced that its Organised Crime Directorate had dismantled a criminal organisation, active since at least early July 2026, whose members defrauded and robbed residents of Attica by posing on the phone as staff of the electricity distributor ΔΕΔΔΗΕ, mobile operators or fibre-optic installers. When a target hesitated, the callers asked for a relative's phone number, called that relative under a mobile-operator pretext to obtain a voice sample, cloned the voice with an AI tool and then played the cloned voice to the target to 'confirm' the instructions. Two men aged 23 and 25, described as the ring's 'collectors', were arrested in Nea Ionia just after removing valuables worth €30,000 from a victim's home; the case file, covering criminal organisation, fraud and aggravated theft with proceeds above €120,000, names four more people. Police have so far confirmed at least five further cases with the same method and estimate the group's total proceeds above €1 million. The two arrested were brought before the prosecutor and referred to an investigating judge.", "incidentDate": "2026-07-01", "incidentKind": "bounded_series", "incidentDatePrecision": "month", "exposurePattern": "single_interaction", "reportedDate": "2026-09-18", "aiSystem": "AI voice-cloning tool (not identified by police)", "severity": "medium", "verificationStatus": "credible", "harmCategories": [], "harmOutcomes": [ "financial_loss" ], "harmOutcomeSummary": "A victim lost valuables worth €30,000 to collectors who arrived after calls in which a cloned relative's voice confirmed the fraudsters' instructions; police confirm at least five further victims of the same method and document proceeds above €120,000. The police attribute the persuasion to AI voice cloning; the losses are attributed to the ring.", "frameworkFacets": [], "causationStatus": "supported", "participantUsersAffectedMin": 0, "otherPeopleHarmedMin": 1, "affectedCountStatus": "partial", "affectedCountEvidence": "The police release describes one victim from whose home valuables worth €30,000 had just been removed when the arrests took place, and 'at least five further cases with a similar methodology' without saying how many people each involved. One counted person plus additional unquantified victims (partial). The €120,000 in the case file and the estimated €1 million in proceeds are not person counts.", "victimAgeRange": "unknown", "jurisdiction": "GR", "platformType": "other", "outcomeType": "criminal_charges", "outcomeStatus": "ongoing", "primarySourceUrl": "https://tvstar.gr/2026/09/18/klonopoious", "primarySourceLabel": "tvstar.gr (STAR Κεντρικής Ελλάδας), 18 September 2026: Κλωνοποιούσαν με Τεχνητή Νοημοσύνη τις φωνές συγγενών για να πείθουν τα θύματά τους (reproduces the Hellenic Police release in full)", "firstPublishedAt": "2026-09-19T03:12:18.18414+00:00", "scopeVersion": "facts-v3", "tags": [ "voice-cloning", "impersonation", "phone-fraud", "greece", "attica", "police-operation", "financial-loss", "organised-crime" ] }, { "id": "2026-singapore-deepfake-zoom-pm-impersonation-funding-scam", "caseFacts": { "claims": [ { "id": "c1", "status": "reported", "evidence": [ { "locator": "'A person lost at least $4.9 million after falling for a scam involving the impersonation of senior government officials'; 'received a WhatsApp message with a profile photo of Mr Wong Hong Kuan'; 'transferred the money through a series of transactions to a corporate bank account supplied by the scammers'.", "relation": "supports", "source_id": "s2" }, { "locator": "'He lost at least $4.9 million after believing that Prime Minister Lawrence Wong had sought his help'; 'the email was sent from a Proton Mail account'; 'invited to a Zoom video conference ... fabricated using deepfake artificial intelligence technology'.", "relation": "supports", "source_id": "s3" }, { "locator": "'In one case, a victim lost at least S$4.9 million (US$3.8 million) in what was claimed to be funding assistance related to the Strait of Hormuz'.", "relation": "supports", "source_id": "s1" } ], "assertion": "A businessman lost at least S$4.9 million after being approached by scammers posing as the Secretary to the Cabinet, signing an NDA, receiving a fake letter of guarantee with the Prime Minister's signature, attending a deepfake Zoom conference of government officials, and then transferring money in a series of transactions to a corporate account.", "causal_attribution": "Singapore Police Force advisory relayed by three outlets; single official chain." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "'the speech did not synchronise with the speakers' lips'; 'the speech was broadcast via one account throughout the call'; 'end with a deepfake video of PM Wong delivering closing remarks, which included an acknowledgement of the victim's attendance'.", "relation": "supports", "source_id": "s1" } ], "assertion": "Police obtained the footage of the fabricated Zoom conference depicting the Prime Minister, the President, Minister Indranee Rajah, MAS representatives and foreign officials, and identified deepfake indicators: speech out of sync with lips, audio broadcast from one account, and a distorted background and Zoom logo; the fake Prime Minister's closing remarks acknowledged the victim's attendance.", "causal_attribution": "Police statement on their own examination of the footage, reported by CNA." } ], "effects": [ { "label": "a businessman lost at least S$4.9 million after a deepfake video conference of government officials and a fake letter of guarantee", "claim_id": "c1", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://www.channelnewsasia.com/singapore/impersonation-scam-fake-zoom-meeting-footage-lawrence-wong-tharman-indranee-police-6125691", "kind": "news_report", "access": "read", "language": "en", "translation_note": "Read in English on 2026-09-18 (CNA, 16 May 2026). Reports the police release of the fabricated Zoom footage, the participants depicted and the deepfake indicators.", "independence_group": "spf-advisory" }, { "id": "s2", "url": "https://www.straitstimes.com/singapore/victim-loses-at-least-4-9m-in-scam-involving-deepfakes-of-pm-wong-government-officials", "kind": "news_report", "access": "read", "language": "en", "translation_note": "Read in English on 2026-09-18 (Straits Times, 14 May 2026). Reports the SPF advisory: WhatsApp and proton.me approach, NDA, letter of guarantee, Zoom call, transfers, and the 9 May SIM-card charges.", "independence_group": "spf-advisory" }, { "id": "s3", "url": "https://www.asiaone.com/singapore/police-spf-advisory-government-official-impersonation-scam-pm-lawrence-wong-funding-assistance-hormuz-49-million", "kind": "news_report", "access": "read", "language": "en", "translation_note": "Read in English on 2026-09-18 (AsiaOne, 13/14 May 2026). Same SPF advisory with screenshots of the WhatsApp and email approach.", "independence_group": "spf-advisory" } ], "version": 1, "ai_roles": [ "others_use" ], "contexts": [ "finance", "public_services" ], "unknowns": [ "The victim's identity, business and the exact date of the transfers are not published (advisory 14 May 2026).", "No arrest for this loss or recovery of funds is reported.", "The deepfake tools used are not identified.", "Whether the victim has pursued civil recovery is unknown." ], "geography": { "basis": "Singapore Police Force advisory; the victim is described as a Singapore business professional who had dealt with government officials (Straits Times, CNA). No court proceeding for this loss is reported; the 9 May SIM-card charges concern earlier cases.", "court_countries": [], "event_countries": [ "SG" ], "affected_person_countries": [ "SG" ] }, "publication": { "basis": "Published under the 2026-09-15 charter as an impersonation-fraud case with a large documented loss to one person, where the police examined and released the AI-generated footage. Three Singapore outlets read, all relaying SPF advisories; claims recorded as reported. Victim unnamed; impersonated officials are public figures.", "reviewed_on": "2026-09-18" }, "ai_involvement": { "basis": "The Singapore Police Force obtained the Zoom footage and described specific deepfake indicators (speech out of sync with lips, audio broadcast from a single account, distorted background and logo). The AI content depicted and impersonated named officials, and the fabricated closing remarks were addressed to the victim, acknowledging his attendance, which is why communicated_with is also recorded.", "status": "supported" }, "person_relations": [ "communicated_with", "depicted_or_impersonated" ] }, "name": "Singapore: a businessman lost at least S$4.9 million after a deepfake Zoom 'briefing' with fabricated Prime Minister Lawrence Wong and other officials asked him for 'urgent funding assistance'", "summary": "In May 2026 the Singapore Police Force (SPF) reported that a man had lost at least S$4.9 million (about US$3.8 million) to a government-official impersonation scam. He received a WhatsApp message carrying the profile photo of Secretary to the Cabinet Wong Hong Kuan and an email from a proton.me address in that name, requesting urgent funding assistance for 'the situation in the Strait of Hormuz', with a fake 'letter of guarantee' bearing the Prime Minister's signature promising reimbursement within 15 business days; he signed a non-disclosure agreement and supplied a copy of his identity card. He was then invited to a Zoom video conference in which Prime Minister Lawrence Wong, President Tharman Shanmugaratnam, Minister Indranee Rajah, Monetary Authority of Singapore representatives and foreign officials appeared; all were fabricated with deepfake AI, and the closing 'remarks' by the fake Prime Minister acknowledged the victim's attendance. Contacted afterwards on WhatsApp by a scammer posing as a lawyer, he transferred the money in a series of transactions to a corporate bank account, and realised the fraud only when he contacted the real cabinet secretary. On 16 May the police released footage of the fake conference, noting lips out of sync with speech, audio broadcast from a single account and a distorted background.", "incidentDate": "2026-05-01", "incidentKind": "single_event", "incidentDatePrecision": "month", "exposurePattern": "single_interaction", "reportedDate": "2026-05-14", "aiSystem": "Deepfake AI video and audio fabricating Prime Minister Lawrence Wong, President Tharman Shanmugaratnam, Minister Indranee Rajah and other officials in a Zoom conference (tools not identified)", "severity": "high", "verificationStatus": "credible", "harmCategories": [], "harmOutcomes": [ "financial_loss" ], "harmOutcomeSummary": "A businessman transferred at least S$4.9 million to scammers after a deepfake video conference fabricating the Prime Minister and other officials; the police documented the AI-generated footage.", "frameworkFacets": [], "causationStatus": "supported", "participantUsersAffectedMin": 0, "otherPeopleHarmedMin": 1, "affectedCountStatus": "exact", "affectedCountEvidence": "Police describe a single victim who lost at least S$4.9 million. Exact count of one; the impersonated officials are not counted.", "victimAgeRange": "adult", "jurisdiction": "SG", "platformType": "other", "outcomeType": "investigation_opened", "outcomeStatus": "ongoing", "primarySourceUrl": "https://www.straitstimes.com/singapore/victim-loses-at-least-4-9m-in-scam-involving-deepfakes-of-pm-wong-government-officials", "primarySourceLabel": "The Straits Times, 14 May 2026: Victim loses at least $4.9m in scam involving deepfakes of PM Wong, government officials (Singapore Police Force advisory)", "firstPublishedAt": "2026-09-18T03:25:14.306192+00:00", "scopeVersion": "facts-v3", "tags": [ "deepfake", "government-impersonation", "zoom", "video-conference", "fraud", "singapore", "financial-loss", "police-documented" ] }, { "id": "2026-northern-ireland-ai-celebrity-video-investment-scam", "caseFacts": { "claims": [ { "id": "c1", "status": "reported", "evidence": [ { "locator": "'A person has lost £250,000 after falling victim to an AI-generated scam'; 'saw what appeared to be an AI-generated video featuring a well-known personality from the financial sector'; 'persuaded the victim in the Ards and north Down area to create multiple online accounts and gained remote access to their computer'.", "relation": "supports", "source_id": "s1" }, { "locator": "'a victim lost £250,000 in Ards and North Down'; 'encouraged to borrow money to continue investing'; 'further payments were required before money supposedly held in the investment could be released'.", "relation": "supports", "source_id": "s2" }, { "locator": "'the victim was encouraged to borrow money to continue investing. Funds were transferred to accounts controlled by the criminals'.", "relation": "supports", "source_id": "s3" } ], "assertion": "A person in the Ards and North Down area lost £250,000 to an investment fraud that began with an apparently AI-generated video of a well-known financial personality, progressed through WhatsApp contact, multiple new online accounts, remote access to the victim's computer and borrowing to invest, and ended with demands for further payments to release the funds.", "causal_attribution": "Single PSNI account relayed by three outlets; the AI-generated nature of the video is the police's description ('what appeared to be')." } ], "effects": [ { "label": "one person lost £250,000 (partly borrowed) to an investment fraud lured by an AI-generated celebrity video", "claim_id": "c1", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://www.bbc.com/news/articles/cx2zkp8vx9jo", "kind": "news_report", "access": "read", "language": "en", "translation_note": "Read in English on 2026-09-17 and 2026-09-18 (BBC News NI, Ben Lonsdale, 7 Sep 2026). Reports the PSNI statement and adds that BBC News NI has seen online scams using Martin Lewis, Peter Jones and Steven Bartlett; the PSNI did not confirm the personality.", "independence_group": "psni-statement" }, { "id": "s2", "url": "https://www.irishnews.com/news/northern-ireland/psni-urging-public-to-be-vigilant-after-sophisticated-investment-fraud-victim-looses-250000-IZL253VWX5BOLJN7ZKZ56RUYDY/", "kind": "news_report", "access": "read", "language": "en", "translation_note": "Read in English on 2026-09-18 via the MSN content API copy (Irish News, 7 Sep 2026). Carries the full PSNI statement including the Inspector Youle and Superintendent Gibson quotations.", "independence_group": "psni-statement" }, { "id": "s3", "url": "https://www.farminglife.com/news/crime/warning-after-victim-loses-ps250000-in-ai-investment-scam-in-northern-ireland-8972844", "kind": "news_report", "access": "read", "language": "en", "translation_note": "Read in English on 2026-09-18 via the MSN content API copy (Farming Life, 7 Sep 2026). Same PSNI statement.", "independence_group": "psni-statement" } ], "version": 1, "ai_roles": [ "others_use" ], "contexts": [ "finance", "everyday_life" ], "unknowns": [ "The dates over which the fraud ran are not given.", "The impersonated personality and the AI tool are not identified.", "No arrest or recovery of funds is reported.", "The victim's age and circumstances are not described." ], "geography": { "basis": "The PSNI locates the victim in the Ards and North Down area of Northern Ireland (UK, recorded as GB). No court proceeding.", "court_countries": [], "event_countries": [ "GB" ], "affected_person_countries": [ "GB" ] }, "publication": { "basis": "Published under the 2026-09-15 charter as an impersonation-fraud case with a concrete, police-reported consequence: one identified-but-anonymous person lost £250,000 after an AI-generated celebrity video lure. Three outlets read, all relaying one PSNI statement; claim status reported.", "reviewed_on": "2026-09-18" }, "ai_involvement": { "basis": "The PSNI says the fraud began with 'what appeared to be an AI-generated video' of a financial personality; no technical confirmation is published. The relation recorded is that the AI artifact depicted and impersonated a public figure to reach the victim; the victim's own dealings were with human fraudsters on WhatsApp.", "status": "reported" }, "person_relations": [ "depicted_or_impersonated" ] }, "name": "Ards and North Down, Northern Ireland: a person lost £250,000 to an investment fraud that began with an AI-generated video of a well-known financial personality", "summary": "On 7 September 2026 the Police Service of Northern Ireland (PSNI) said a person in the Ards and North Down area had lost £250,000 in what it called a 'sophisticated and substantial' investment fraud. The victim first saw what appeared to be an AI-generated online video featuring a well-known personality from the financial sector promoting an investment with significant returns. After investing a small amount the victim was contacted on WhatsApp and encouraged to pay more, persuaded to open multiple online accounts, to allow the fraudsters remote access to a computer 'to assist with the investment', to borrow money to keep investing, and finally to make further payments to 'release' funds supposedly held in the investment. The PSNI did not name the personality; BBC News NI noted that fabricated endorsements of financial experts such as Martin Lewis, Peter Jones and Steven Bartlett circulate online.", "incidentKind": "ongoing_experience", "incidentDatePrecision": "unknown", "exposurePattern": "repeated_interactions", "reportedDate": "2026-09-07", "aiSystem": "AI-generated video impersonating a well-known financial personality (tool not identified; personality not named by police)", "severity": "high", "verificationStatus": "credible", "harmCategories": [], "harmOutcomes": [ "financial_loss" ], "harmOutcomeSummary": "One person lost £250,000, including borrowed money, to an investment fraud that used an AI-generated video of a financial personality as its lure and progressed through WhatsApp grooming and remote computer access.", "frameworkFacets": [], "causationStatus": "supported", "participantUsersAffectedMin": 0, "otherPeopleHarmedMin": 1, "affectedCountStatus": "exact", "affectedCountEvidence": "The PSNI describes a single victim who lost £250,000. Exact count of one.", "victimAgeRange": "unknown", "jurisdiction": "GB", "platformType": "other", "outcomeType": "investigation_opened", "outcomeStatus": "ongoing", "primarySourceUrl": "https://www.bbc.com/news/articles/cx2zkp8vx9jo", "primarySourceLabel": "BBC News NI, 7 Sep 2026: Victim loses £250k after scammers use AI video of 'well-known' celebrity (PSNI statement)", "firstPublishedAt": "2026-09-18T03:25:09.292712+00:00", "scopeVersion": "facts-v3", "tags": [ "deepfake", "ai-generated-video", "celebrity-impersonation", "investment-fraud", "united-kingdom", "northern-ireland", "psni", "financial-loss" ] }, { "id": "2026-russia-chatgpt-phishing-crypto-theft", "caseFacts": { "claims": [ { "id": "c1", "status": "corroborated", "evidence": [ { "locator": "'ChatGPT... выдала ссылку на страницу, которая оказалась сайтом мошенников'; '1 904 513 FXRP — примерно $2,1 млн'; 'unlimited approval'.", "relation": "supports", "source_id": "s1" }, { "locator": "'12 июня 2026 года... обменять токены sFLR на WFLR. Он посоветовался с ChatGPT'; 'ссылка на sceptre.network — точную копию легитимного сервиса sceptre.fi'; '1 904 513 FXRP — примерно $2,1 млн'.", "relation": "supports", "source_id": "s2" }, { "locator": "'Криптоинвестор потерял около 180 миллионов рублей после перехода по фишинговой ссылке, которую посоветовал ChatGPT'; 'похитили около 2,1 миллиона долларов'.", "relation": "supports", "source_id": "s3" } ], "assertion": "On 12 June 2026 a Russian-speaking investor asked ChatGPT in Russian where to swap sFLR for WFLR; ChatGPT returned a link to sceptre.network, a phishing clone of sceptre.fi; he connected his wallet, signed an unlimited-approval transaction, and about 1.9 million FXRP (~$2.1 million) were drained.", "causal_attribution": "The on-chain analysis (VAL, carried by s1/s2/s4) and the MVD confirmation (s3) are independent chains for the loss and the ChatGPT-link mechanism." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "'фишинговая ссылка появлялась только в ответах на русском языке. При аналогичных запросах на других языках ChatGPT её не выдавал. Мошенники целенаправленно \"отравляли\" данные для русскоязычных пользователей.'", "relation": "supports", "source_id": "s2" }, { "locator": "'Сейчас фишинговая ссылка больше не появляется в ChatGPT'.", "relation": "supports", "source_id": "s1" } ], "assertion": "The phishing link appeared only in ChatGPT's Russian-language answers, indicating deliberate data-poisoning targeting Russian-speaking users; the link no longer appears.", "causal_attribution": "Reported by the blockchain analyst (VAL) and carried by the Russian tech press; not independently verified by the MVD." }, { "id": "c3", "status": "documented", "evidence": [ { "locator": "'сообщили РАПСИ в пресс-службе Управления по организации борьбы с противоправным использованием информационно-коммуникационных технологий МВД РФ'.", "relation": "supports", "source_id": "s3" } ], "assertion": "Russia's Interior Ministry (MVD) confirmed the loss of about 180 million rubles ($2.1 million).", "causal_attribution": "Attributed to the MVD press service via RAPSI." } ], "effects": [ { "label": "crypto investor lost about $2.1 million after acting on a phishing link ChatGPT returned to a Russian-language query", "claim_id": "c1", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://bits.media/kriptopoinvestor-lishilsya-2-1-mln-iz-za-ssylki-v-otvete-chatgpt/", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-17 (datePublished 2026-09-04). Relays blockchain analyst VAL's on-chain investigation: sFLR/WFLR query, sceptre.network phishing clone, 1.9M FXRP (~$2.1M) drained via unlimited approval, Tornado Cash routing. Model reading; no human bilingual review.", "independence_group": "val-report" }, { "id": "s2", "url": "https://vc.ru/ai/3122620-kak-ii-obmanul-kriptovinvestora-na-milliony-dollarov", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-17 (datePublished 2026-09-05). Names the 12 June 2026 date, alias Alex, the unlimited-approval signing, and that the phishing link appeared only in Russian-language answers. Derives from VAL's report. Model reading.", "independence_group": "val-report" }, { "id": "s3", "url": "https://rapsinews.ru/digital_law_news/20260911/312188548.html", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-17 (RAPSI, 11 Sep 2026). Attributes the confirmation to the press service of the MVD's unit for combating unlawful use of ICT: ~180 million rubles / ~$2.1M lost after a ChatGPT-provided phishing link. Independent official confirmation. Model reading.", "independence_group": "mvd" }, { "id": "s4", "url": "https://hi-tech.mail.ru/news/154924-chatgpt-podsunul-fishingovuyu-ssylku-kriptoinvestor/", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-17 (datePublished 2026-09-07). Russian tech-press account derived from VAL's report. Model reading.", "independence_group": "val-report" } ], "version": 1, "ai_roles": [ "own_use" ], "contexts": [ "finance" ], "unknowns": [ "The investor's full identity and exact location within Russia are not established; only the alias Alex/@vesnuhin is public.", "No arrests or defendants are identified.", "Whether OpenAI has acknowledged or acted on the reported Russian-language data-poisoning is not established in the inspected sources." ], "geography": { "basis": "The investor is Russian-speaking and the case was confirmed by Russia's Interior Ministry (RAPSI). Event and affected-person country recorded as Russia on that basis. No court proceeding established.", "court_countries": [], "event_countries": [ "RU" ], "affected_person_countries": [ "RU" ] }, "publication": { "basis": "Published under the 2026-09-15 charter, which includes fraud and security consequences in scope. A crypto investor acted on a phishing link ChatGPT returned to his Russian-language query and lost about $2.1 million; the loss is confirmed independently by Russia's Interior Ministry and traced on-chain by a blockchain analyst. Causation of the AI's role (surfacing the phishing link) is supported; the theft was executed by scam operators.", "reviewed_on": "2026-09-17" }, "ai_involvement": { "basis": "Multiple technology outlets and a blockchain analyst report that the phishing link appeared in ChatGPT's answer to the investor's Russian-language question, and Russia's Interior Ministry confirmed to RAPSI that the loss followed a phishing link ChatGPT provided. The theft itself was executed by the scam operators; ChatGPT's role was surfacing the phishing link, reportedly only in Russian-language responses.", "status": "supported" }, "person_relations": [ "communicated_with" ] }, "name": "Russia: a crypto investor lost about $2.1 million after ChatGPT returned a phishing link in answer to a token-swap question", "summary": "On 12 June 2026 a Russian-speaking crypto investor, known by the alias Alex (@vesnuhin), asked ChatGPT in Russian where to swap sFLR for WFLR tokens. ChatGPT's reply included a link to sceptre.network, a phishing clone of the legitimate sceptre.fi. He connected his wallet and signed an unlimited-approval transaction; within seconds about 1.9 million FXRP, worth roughly $2.1 million (about 180 million rubles), were drained. A blockchain analyst traced the theft, and reported that the phishing link appeared only in Russian-language answers. Russia's Interior Ministry (MVD) later confirmed the loss.", "incidentDate": "2026-06-12", "incidentKind": "single_event", "incidentDatePrecision": "day", "exposurePattern": "single_interaction", "reportedDate": "2026-09-04", "aiSystem": "ChatGPT (OpenAI)", "aiCompany": "OpenAI", "severity": "high", "verificationStatus": "credible", "harmCategories": [], "harmOutcomes": [ "financial_loss" ], "harmOutcomeSummary": "A crypto investor lost about $2.1 million (some 180 million rubles) after connecting his wallet to a phishing site whose link ChatGPT had returned in answer to a Russian-language token-swap question; Russia's Interior Ministry confirmed the loss.", "frameworkFacets": [], "causationStatus": "supported", "participantUsersAffectedMin": 1, "otherPeopleHarmedMin": 0, "affectedCountStatus": "exact", "affectedCountEvidence": "One affected person: the investor who acted on the ChatGPT-provided link and lost about $2.1 million. VAL's report that a related scheme netted more than $2.2 million from other users is not used as a person count.", "victimAgeRange": "adult", "jurisdiction": "RU", "platformType": "assistant", "outcomeType": "investigation_opened", "outcomeStatus": "ongoing", "primarySourceUrl": "https://bits.media/kriptopoinvestor-lishilsya-2-1-mln-iz-za-ssylki-v-otvete-chatgpt/", "primarySourceLabel": "bits.media, 4 September 2026: crypto investor lost ~$2.1M after a phishing link in a ChatGPT answer (blockchain analyst VAL on-chain analysis)", "firstPublishedAt": "2026-09-17T03:27:42.903846+00:00", "scopeVersion": "facts-v3", "tags": [ "chatgpt", "openai", "phishing", "crypto", "financial-loss", "data-poisoning", "russia", "communicated-with" ] } ] }