{ "meta": { "exportedAt": "2026-09-22T16:03:27.983Z", "formatVersion": 2, "selection": { "q": "financial-loss", "system": "", "harm": "", "context": "", "country": "", "role": "", "relation": "", "evidence": "", "year": "2026", "response": "", "severity": "", "verification": "", "view": "incidents", "sort": "added" }, "totalIncidents": 6, "coverage": { "cases": 6, "countries": 6, "languages": 5, "unknownLocation": 0, "locationPending": 0, "unknownLanguage": 0, "unknownDate": 0, "lawsuits": 0, "regulatory": 5, "minors": 0, "coreRelations": 6, "contextualRelations": 0, "mixedRelations": 0, "unknownRelations": 0, "relationPending": 0, "relationUnknown": 0 }, "countingNote": "Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.", "affectedCountNote": "Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.", "source": "NOPE Incident Tracker", "url": "https://nope.net/incidents", "license": "CC BY 4.0" }, "incidents": [ { "id": "2026-picos-piaui-ai-voice-clone-uncle-car-purchase-fraud", "caseFacts": { "claims": [ { "id": "c1", "status": "reported", "evidence": [ { "locator": "'Os golpistas utilizaram foto e áudios com voz clonada por inteligência artificial para se passar pelo tio'; 'iniciou negociação na segunda-feira (10), após encontrar um anúncio na internet com venda em Fortaleza (CE)'; 'Eles usaram a foto do familiar do influenciador e enviaram áudios que imitavam a voz dele'; 'usando algum tipo de inteligência artificial e a voz idêntica'", "relation": "supports", "source_id": "s1" } ], "assertion": "On 10-11 August 2026 fraudsters contacted the influencer from a different number using his uncle's photo and sent audios imitating the uncle's voice, generated with AI, to pose as the uncle who was supposed to inspect a car advertised for sale in Fortaleza.", "causal_attribution": "Victim's account as reported by G1." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "'perdeu mais de R$ 56 mil ao cair em um golpe durante a compra de um carro'; 'o golpista afirmou que o carro estava em boas condições e o orientou a realizar a transferência bancária'; 'entrou em contato com o número verdadeiro do tio descobriu que havia sido vítima de um golpe. O prejuízo ultrapassou R$ 56 mil'", "relation": "supports", "source_id": "s1" } ], "assertion": "Believing the audios came from his uncle, he made the bank transfer; the loss exceeded R$56,000, and he discovered the fraud when he called the uncle's real number.", "causal_attribution": "Victim's account; the loss is attributed to the fraudsters." }, { "id": "c3", "status": "reported", "evidence": [ { "locator": "'Um boletim de ocorrência foi registrado na terça-feira (11) e o caso é investigado pela Delegacia Especializada em Crimes contra o Patrimônio (Depatri)'; 'também tenta, junto aos bancos, o reembolso do valor pago'", "relation": "supports", "source_id": "s1" } ], "assertion": "A police report was registered on Tuesday 11 August 2026; the case is under investigation by Depatri; the victim is seeking reimbursement from the banks.", "causal_attribution": "G1 report; the police unit had not responded to G1." } ], "effects": [ { "label": "a bank transfer of more than R$56,000 lost after audios in a relative's AI-cloned voice 'confirmed' the purchase", "claim_id": "c2", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://g1.globo.com/pi/piaui/noticia/2026/08/13/influenciador-golpe-com-voz-clonada.ghtml", "kind": "news_report", "access": "read", "language": "pt", "translation_note": "Read live in Portuguese on 2026-09-20 (HTTP 200). Based on the victim's social-media account and an interview with G1; quotations translated by the reviewer.", "independence_group": "g1-piaui-2026-08-13" } ], "version": 1, "ai_roles": [ "others_use" ], "contexts": [ "finance", "everyday_life" ], "unknowns": [ "The voice-cloning tool is not identified and no police or technical confirmation of the AI element is reported.", "The exact amount beyond 'more than R$56,000' and whether any money was recovered are not stated.", "Whether the uncle's number or accounts were compromised, or how the fraudsters obtained his photo and voice, is not reported.", "No later coverage of the investigation was found.", "An embedded video title on the G1 page gives the loss as R$ 50 mil; the article text says more than R$ 56 mil, which this record follows." ], "geography": { "basis": "Victim in Picos, Piauí; the car was advertised in Fortaleza, Ceará, where the impersonated uncle lives; police report with the Piauí Depatri (G1 Piauí). No court proceeding.", "court_countries": [], "event_countries": [ "BR" ], "affected_person_countries": [ "BR" ] }, "publication": { "basis": "Published under the 2026-09-15 charter as an impersonation-fraud case with a concrete financial loss reported by the victim in a public account and a registered police report. One source (G1 Piauí) read in full; claims recorded as reported and attributed. The victim is a public influencer who reported the case under his own name; he is not named in this record.", "reviewed_on": "2026-09-20" }, "ai_involvement": { "basis": "The victim states that the fraudsters sent audios imitating his uncle's voice 'usando algum tipo de inteligência artificial e a voz idêntica' together with the uncle's photo; G1 reports this as his account. No police or technical confirmation of the AI element is reported and the tool is unknown.", "status": "reported" }, "person_relations": [ "depicted_or_impersonated" ] }, "name": "Picos, Piauí, Brazil: a digital influencer lost more than R$56,000 when fraudsters sent him audio messages in his uncle's AI-cloned voice 'confirming' a car he was buying in Fortaleza", "summary": "On Monday 10 August 2026 a digital influencer from Picos, in the centre-south of Piauí, began negotiating a car advertised online for sale in Fortaleza (Ceará), where an uncle of his lives, and asked the sellers to take the car to the uncle so he could inspect it. On Tuesday 11 August a contact using a different number but the uncle's photo sent him audio messages in a voice identical to his uncle's, generated with artificial intelligence, saying the car was in good condition and telling him to make the bank transfer. Believing he was speaking to his uncle, he transferred the money; when he then called the uncle's real number he learned he had been defrauded. The loss exceeded R$56,000, money he says he had saved for years. He registered a police report on 11 August; the Piauí property-crimes unit (Depatri) is investigating and he is seeking a refund from the banks. The account is the victim's own, reported by G1 Piauí on 13 August 2026 from his social-media posts and an interview; the police unit did not respond to G1 before publication.", "incidentDate": "2026-08-11", "incidentKind": "single_event", "incidentDatePrecision": "day", "exposurePattern": "single_interaction", "reportedDate": "2026-08-13", "aiSystem": "AI voice cloning (tool not identified)", "severity": "medium", "verificationStatus": "credible", "harmCategories": [], "harmOutcomes": [ "financial_loss" ], "harmOutcomeSummary": "One person lost more than R$56,000 in a bank transfer made after receiving audios in his uncle's cloned voice; the victim attributes the persuasion to AI voice cloning and the loss to the fraudsters.", "frameworkFacets": [], "causationStatus": "alleged", "participantUsersAffectedMin": 0, "otherPeopleHarmedMin": 1, "affectedCountStatus": "exact", "affectedCountEvidence": "One victim who made the transfer (G1 Piauí). No loss is reported for the uncle whose photo and voice were imitated, so he is not counted. Exact 1.", "victimAgeRange": "adult", "jurisdiction": "BR", "platformType": "other", "outcomeType": "investigation_opened", "outcomeStatus": "ongoing", "primarySourceUrl": "https://g1.globo.com/pi/piaui/noticia/2026/08/13/influenciador-golpe-com-voz-clonada.ghtml", "primarySourceLabel": "G1 Piauí, 13 August 2026: Influenciador do PI perde R$ 56 mil em golpe com voz clonada por IA durante compra de carro", "firstPublishedAt": "2026-09-20T03:28:14.49159+00:00", "scopeVersion": "facts-v3", "tags": [ "voice-cloning", "impersonation", "car-purchase-fraud", "brazil", "piaui", "financial-loss", "first-person-account" ] }, { "id": "2026-hudsonville-michigan-ai-voice-clone-closing-wire-fraud", "caseFacts": { "claims": [ { "id": "c1", "status": "reported", "evidence": [ { "locator": "\"the four-bedroom, $460,000 condo in the nearby suburb of Hudsonville checked every box\"; \"But on May 19 this year, days before closing, they got a startling email. To keep the closing on schedule, it said, the couple needed to wire $66,026.92 to a specified bank account within 24 hours to cover a down payment and closing costs\"; \"received a call to confirm the instructions, and the voice on the phone sounded just like their loan officer\"; \"The couple wired the money.\"; \"The closing was canceled hours before the couple was scheduled to sign the final paperwork\"; \"the couple instead rushed to borrow money from family and other sources\"; \"had two extra letters: UnitedsMortgages, instead of UnitedMortgage\".", "relation": "supports", "source_id": "s1" }, { "locator": "\"必須在24小時內把頭期款與交屋費用共計6萬6026.92元匯到指定銀行帳戶\"; \"收到一封緊急電郵，結果因此損失6萬多元\".", "relation": "supports", "source_id": "s2" } ], "assertion": "On 19 May 2026, days before closing on a US$460,000 condo in Hudsonville, Michigan, the couple received an email demanding a US$66,026.92 wire within 24 hours from an address with two extra letters and listing a phone number two digits off their loan officer's; the husband then received a call confirming the instructions in a voice that sounded just like the loan officer; the couple borrowed from family and wired the money, which was gone by the time the real loan officer's statement arrived the day before closing, and the closing was cancelled.", "causal_attribution": "The couple's account to CNN; the World Journal item relays CNN." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "\"ensnared in a sophisticated real estate scam that uses suspected AI voice cloning and fake emails to target homebuyers in the frantic days before closing\"; \"The 64-year-old said he now believes the phone call that followed the emails was from a spoofed number and used AI-assisted voice cloning\"; \"home-buying process was compromised\"; \"likely took snippets of the loan officer\"; \"Neither the company nor the loan officer have been accused of any complicity in the scam\".", "relation": "supports", "source_id": "s1" }, { "locator": "\"詐騙份子利用AI語音複製與偽造電郵\".", "relation": "supports", "source_id": "s2" } ], "assertion": "The husband believes the call came from a spoofed number using AI-assisted voice cloning; CertifID's co-founder, working with the couple and federal officials, said someone's email in the transaction was likely compromised and that the scammers likely cloned the loan officer's voice from his social-media posts; CNN describes the fraud as using 'suspected AI voice cloning'.", "causal_attribution": "Attribution by the victim and a fraud-prevention firm involved in the case; no forensic confirmation is published." }, { "id": "c3", "status": "reported", "evidence": [ { "locator": "\"They eventually got money from their mutual fund and completed the home purchase in early June\"; \"Internet Crime Complaint Center, the agency\"; \"wired the money to has since closed, the couple said\"; \"We are just very apprehensive\"; \"Do we need to work a little bit longer?\".", "relation": "supports", "source_id": "s1" }, { "locator": "\"終於在6月初完成購屋手續。他們已向FBI「網際網路犯罪申訴中心」(Internet Crime Complaint Center)報案\".", "relation": "supports", "source_id": "s2" } ], "assertion": "The couple later completed the purchase in early June 2026 from their mutual fund, filed a report with the FBI's Internet Crime Complaint Center, and say the receiving account has closed; they describe apprehension and discussions about delaying retirement.", "causal_attribution": "The couple's account to CNN." } ], "effects": [ { "label": "a couple wired US$66,026.92 to scammers after a spoofed email and a call in a voice resembling their loan officer; closing cancelled, money not recovered", "claim_id": "c1", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://www.cnn.com/2026/09/15/us/homebuyers-voice-cloning-scam", "kind": "news_report", "access": "read", "language": "en", "translation_note": "Read in English on 2026-09-19 (CNN, Faith Karimi, published 15 Sep 2026, updated the same day). Interviews with the couple, CertifID's Tyler Adams and the National Association of Realtors; FBI figures; lender's counsel comment.", "independence_group": "cnn" }, { "id": "s2", "url": "https://www.worldjournal.com/wj/story/121469/9231485", "kind": "news_report", "access": "read", "language": "zh", "translation_note": "Read in Traditional Chinese on 2026-09-16 and re-read on 2026-09-19 (World Journal, 15 Sep 2026): a relay of CNN's report, so it does not corroborate it; translation by the reviewer. Cited for the exact amount and the June completion of the purchase as reported in Chinese.", "independence_group": "cnn" } ], "version": 1, "ai_roles": [ "others_use" ], "contexts": [ "finance", "everyday_life" ], "unknowns": [ "Whether the call in fact used AI voice cloning; no forensic finding is reported.", "Whose email account was compromised and how the scammers obtained the transaction details.", "Whether any funds have been recovered or suspects identified.", "The exact loss after any recovery; CNN reports the wired amount and that the money was gone." ], "geography": { "basis": "Hudsonville, a suburb of Grand Rapids, Michigan, per CNN's report and photographs; the couple live there. No court proceeding; an FBI IC3 report was filed.", "court_countries": [], "event_countries": [ "US" ], "affected_person_countries": [ "US" ] }, "publication": { "basis": "Published under the 2026-09-15 charter as an impersonation-fraud case with a concrete, quantified consequence: a couple lost US$66,026.92 after a call in a voice resembling their loan officer that they and a fraud-prevention firm attribute to AI voice cloning. One original report (CNN) and one relay read; AI involvement recorded as suspected; the couple are not named in this record.", "reviewed_on": "2026-09-19" }, "ai_involvement": { "basis": "CNN describes 'suspected AI voice cloning'; the husband believes the confirming call used AI-assisted voice cloning from a spoofed number, and CertifID's co-founder, who is working on the case, says the scammers likely cloned the loan officer's voice from social-media clips. No technical confirmation is published. If the attribution is right, the AI impersonated a third party (the loan officer) in a live call with the victim; the email side of the fraud is ordinary spoofing.", "status": "suspected" }, "person_relations": [ "depicted_or_impersonated", "communicated_with" ] }, "name": "Hudsonville (Grand Rapids area), Michigan: a couple wired US$66,026.92 to scammers after a spoofed email and a phone call in what sounded like their loan officer's voice, which they and a fraud-prevention firm attribute to AI voice cloning", "summary": "A married couple in their sixties buying a US$460,000 condo in Hudsonville, near Grand Rapids, Michigan, received an email on 19 May 2026, days before closing, telling them to wire US$66,026.92 for the down payment and closing costs within 24 hours. The email listed a phone number differing from their loan officer's by two digits, and the husband then received a call confirming the instructions in a voice that sounded just like the loan officer. The couple borrowed from family and other sources and wired the money. The day before closing their real loan officer sent the actual statement; the closing was cancelled hours before signing and the money was gone. The husband now believes the call came from a spoofed number using AI-assisted voice cloning; Tyler Adams of CertifID, which is working with the couple and federal officials, said someone's email in the transaction was probably compromised and that the scammers likely cloned the loan officer's voice from social-media clips. The sender's address had two extra letters ('UnitedsMortgages' instead of 'UnitedMortgage'). Neither the lender nor the loan officer is accused of complicity. The couple later completed the purchase in early June from their mutual fund, reported the loss to the FBI's Internet Crime Complaint Center, and describe lasting apprehension and have discussed delaying retirement. CNN reported the case on 15 September 2026; the account the money went to has since closed.", "incidentDate": "2026-05-19", "incidentKind": "single_event", "incidentDatePrecision": "day", "exposurePattern": "single_interaction", "reportedDate": "2026-09-15", "aiSystem": "Suspected AI voice cloning of a mortgage loan officer, combined with a spoofed phone number and a look-alike email domain (tool not identified; attribution by the victims and CertifID)", "severity": "medium", "verificationStatus": "unverified", "harmCategories": [], "harmOutcomes": [ "financial_loss", "psychological_distress" ], "harmOutcomeSummary": "A couple wired US$66,026.92, partly borrowed from family, to a fraudulent account after a spoofed email and a call in what sounded like their loan officer's voice; the money was not recovered as of CNN's report, their closing was cancelled and later completed from savings, and they describe lasting apprehension and have discussed working longer before retiring.", "frameworkFacets": [], "causationStatus": "alleged", "participantUsersAffectedMin": 0, "otherPeopleHarmedMin": 2, "affectedCountStatus": "exact", "affectedCountEvidence": "CNN describes one married couple who wired the funds and bore the loss. Exact count of two.", "victimAgeRange": "adult", "jurisdiction": "US", "platformType": "other", "outcomeType": "investigation_opened", "outcomeStatus": "ongoing", "primarySourceUrl": "https://www.cnn.com/2026/09/15/us/homebuyers-voice-cloning-scam", "primarySourceLabel": "CNN, 15 Sep 2026: 'We both missed the signs:' How two homebuyers lost $66,000 in a suspected voice-cloning scam", "firstPublishedAt": "2026-09-20T03:19:50.137088+00:00", "scopeVersion": "facts-v3", "tags": [ "voice-cloning", "impersonation", "wire-fraud", "real-estate-scam", "mortgage-closing", "united-states", "michigan", "financial-loss", "ic3" ] }, { "id": "2026-kazakhstan-deepfake-celebrity-trading-fraud-series", "caseFacts": { "claims": [ { "id": "c1", "status": "reported", "evidence": [ { "locator": "\"Только за последние полтора месяца по стране было зарегистрировано 119 таких фактов\"; \"создают дипфейк-видео со знаменитостями и фейковые ИИ-платформы, обещающие сверхвысокий пассивный доход\".", "relation": "supports", "source_id": "s1" }, { "locator": "\"В Казахстане за последние полтора месяца зарегистрировали 119 случаев мошенничества под видом трейдинга с использованием дипфейков, сообщили в Генеральной прокуратуре\".", "relation": "supports", "source_id": "s2" }, { "locator": "\"По информации Генпрокуратуры, только за последние полтора месяца по стране зарегистрировано 119 таких фактов\".", "relation": "supports", "source_id": "s3" }, { "locator": "\"Только за последние полтора месяца в стране зарегистрировали 119 фактов мошенничества\".", "relation": "supports", "source_id": "s5" } ], "assertion": "The Prosecutor General's Office said that in the previous one and a half months 119 cases of fraud had been registered in Kazakhstan in a scheme that lures victims through social-media deepfake videos of celebrities and fake 'AI' investment platforms (named examples: 'Kaspi AI' with Mikhail Lomtadze, 'Quantum AI' with Elon Musk, 'TON' with Pavel Durov, 'people's investments' fronted by television news presenters).", "causal_attribution": "Single official statement relayed by five outlets; the 119 figure is a count of registered cases, and the deepfake description is the office's characterisation of the scheme." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "\"В сентябре текущего года жительница Талдыкоргана обратилась с заявлением по факту мошенничества в особо крупном размере\"; \"перевела на счета 3-их лиц более 7 млн\"; \"По указанному факту проводится досудебное расследование\".", "relation": "supports", "source_id": "s1" }, { "locator": "\"Одной из жертв мошенников стала жительница Талдыкоргана\"; \"Перечисленные ею деньги и якобы дивиденды отображались в фейковом кошельке, однако возможность их обналичить мошенники не предоставили. По указанному факту проводится досудебное расследование\".", "relation": "supports", "source_id": "s3" }, { "locator": "\"Более 7 млн тенге перевела злоумышленникам жительница Талдыкоргана, поверив в рекламу о сверхприбыли от трейдинга\"; \"Вывести средства женщина не смогла\".", "relation": "supports", "source_id": "s4" }, { "locator": "\"она перевела на счета третьих лиц более 7 млн тенге\".", "relation": "supports", "source_id": "s2" } ], "assertion": "In September 2026 a woman from Taldykorgan reported large-scale fraud: after an Instagram advertisement offering super-profits from share trading she left her details, was contacted by the fraudsters and on their instructions transferred more than 7 million tenge to third-party accounts; the money and supposed dividends showed in a fake wallet she could not cash out; a pre-trial investigation is under way.", "causal_attribution": "The office's account of one registered case, given as an example of the scheme; whether the advertisement she saw was a deepfake video is not stated." } ], "effects": [ { "label": "a woman lost more than 7 million tenge; 119 registered cases of deepfake-fronted trading fraud in about six weeks", "claim_id": "c2", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://kazpravda.kz/n/dipfeyki-maska-durova-i-lomtadze-kazahstancev-obmanyvayut-pod-vidom-treydinga/", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-19 (Kazakhstanskaya Pravda, Dana Amenova, 16 Sep 2026), citing the Prosecutor General's press service; quotations in this record are the reviewer's translations from the Russian body.", "independence_group": "kz-prosecutor-general" }, { "id": "s2", "url": "https://informburo.kz/novosti/dipfeiki-ilona-maska-i-pavla-durova-119-slucaev-mosennicestva-s-treidingom-zaregistrirovali-v-kazaxstane", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-19 (Informburo.kz, 16 Sep 2026). Same Prosecutor General statement, with the office's quoted description of the Taldykorgan case.", "independence_group": "kz-prosecutor-general" }, { "id": "s3", "url": "https://tengrinews.kz/kazakhstan_news/kazahstanka-lishilas-7-millionov-tenge-reklamyi-instagram-608643/", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-19 (Tengrinews, 16 Sep 2026). Same statement; carries the office's quoted sentence on the fake wallet and the pre-trial investigation.", "independence_group": "kz-prosecutor-general" }, { "id": "s4", "url": "https://kazlenta.kz/120453-moshennichestvo-pod-vidom-treydinga-genprokuratura-obratilas-k-kazahstancam.html", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-19 (Kazlenta.kz, 16 Sep 2026, the earliest report found). Same statement.", "independence_group": "kz-prosecutor-general" }, { "id": "s5", "url": "https://kz.kursiv.media/2026-09-16/ezif-lomtadze-mask-i-durov-daryat-milliony-kak-kazahstancev-zamanivayut-v-lzheinvesticii/", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-19 (Kursiv Media, 16 Sep 2026). Same statement.", "independence_group": "kz-prosecutor-general" } ], "version": 1, "ai_roles": [ "others_use" ], "contexts": [ "finance", "everyday_life" ], "unknowns": [ "Whether the Instagram advertisement seen by the Taldykorgan woman was itself a deepfake video or a fake 'AI platform' page.", "The number of victims and total losses across the 119 registered cases; the exact period ('the last one and a half months' before mid-September 2026).", "Whether any suspects have been identified or funds recovered.", "The Prosecutor General's original release text was not reached (gov.kz is JavaScript-only to this host); the record relies on five press relays of the press service." ], "geography": { "basis": "Nationwide registrations in Kazakhstan per the Prosecutor General's Office; the identified victim lives in Taldykorgan (Zhetysu region). No court proceeding reported.", "court_countries": [], "event_countries": [ "KZ" ], "affected_person_countries": [ "KZ" ] }, "publication": { "basis": "Published under the 2026-09-15 charter as an impersonation-fraud series with an official source: the Prosecutor General's Office reports 119 registered cases in about six weeks lured by deepfake celebrity videos and fake 'AI' platforms, and one identified anonymous victim who lost more than 7 million tenge. Five Russian-language bodies read, all relaying one official statement (claims reported); person count kept to the one identified victim plus unquantified others.", "reviewed_on": "2026-09-19" }, "ai_involvement": { "basis": "The Prosecutor General's Office describes the scheme's lure as deepfake videos of celebrities and fake 'AI' platforms placed on social networks; no technical verification is published, and the statement does not say whether the Taldykorgan woman's Instagram advertisement was itself a deepfake. The AI artifacts depicted and impersonated public figures; the victims' dealings were with human fraudsters.", "status": "reported" }, "person_relations": [ "depicted_or_impersonated" ] }, "name": "Kazakhstan: the Prosecutor General's Office reported 119 trading-fraud cases registered in about six weeks, lured by deepfake videos of Elon Musk, Pavel Durov and other public figures and fake 'AI' platforms; a Taldykorgan woman transferred more than 7 million tenge", "summary": "On 16 September 2026 the Prosecutor General's Office of Kazakhstan warned of an investment-fraud scheme in which criminals advertise non-existent projects on TikTok, Instagram, YouTube and other platforms using deepfake videos of well-known people and fake 'AI' investment platforms promising very high passive income: 'Kaspi AI' with Mikhail Lomtadze, 'Quantum AI' with Elon Musk, 'TON' with Pavel Durov, and 'people's investments' in KazMunayGas or Gazprom fronted by news presenters from Khabar 24, KTK and Channel One. The office said 119 such cases had been registered across the country in the previous one and a half months. Its example: in September 2026 a woman from Taldykorgan saw an Instagram advertisement offering high returns from share trading, left her details through the link, was contacted by the fraudsters and, following their instructions, transferred more than 7 million tenge to third-party accounts; the money and supposed dividends appeared in a fake wallet that she could not withdraw from. A pre-trial investigation is under way. The office urged people not to trust guaranteed-return offers or transfer money to strangers.", "incidentDate": "2026-08-01", "incidentEndDate": "2026-09-16", "incidentKind": "bounded_series", "incidentDatePrecision": "range", "exposurePattern": "repeated_interactions", "reportedDate": "2026-09-16", "aiSystem": "Deepfake videos of public figures (Elon Musk, Pavel Durov, Mikhail Lomtadze, television news presenters) and fake 'AI' investment platforms ('Quantum AI', 'Kaspi AI'); generation tools not identified", "severity": "medium", "verificationStatus": "unverified", "harmCategories": [], "harmOutcomes": [ "financial_loss" ], "harmOutcomeSummary": "A woman in Taldykorgan transferred more than 7 million tenge to fraudsters after an Instagram trading advertisement and could not withdraw the supposed returns; the Prosecutor General's Office registered 119 such fraud cases nationwide in about six weeks, in a scheme whose lure is deepfake celebrity videos and fake 'AI' platforms.", "frameworkFacets": [], "causationStatus": "supported", "participantUsersAffectedMin": 0, "otherPeopleHarmedMin": 1, "affectedCountStatus": "partial", "affectedCountEvidence": "One identified victim (the Taldykorgan woman, more than 7 million tenge). The 119 figure counts registered fraud cases ('фактов'), not people, so the remaining victims are unquantified. One counted plus unquantified others: partial.", "victimAgeRange": "unknown", "jurisdiction": "KZ", "platformType": "other", "outcomeType": "investigation_opened", "outcomeStatus": "ongoing", "primarySourceUrl": "https://kazpravda.kz/n/dipfeyki-maska-durova-i-lomtadze-kazahstancev-obmanyvayut-pod-vidom-treydinga/", "primarySourceLabel": "Kazakhstanskaya Pravda, 16 Sep 2026: Deepfakes of Musk, Durov and Lomtadze: Kazakhstanis defrauded under the guise of trading (Prosecutor General's Office statement)", "firstPublishedAt": "2026-09-20T03:19:45.310788+00:00", "scopeVersion": "facts-v3", "tags": [ "deepfake", "celebrity-impersonation", "investment-fraud", "trading-scam", "fake-ai-platform", "kazakhstan", "prosecutor-general", "financial-loss", "instagram" ] }, { "id": "2026-attica-nea-ionia-ai-voice-clone-relative-fraud-ring", "caseFacts": { "claims": [ { "id": "c1", "status": "reported", "evidence": [ { "locator": "'Ιδιαίτερο χαρακτηριστικό της δράσης της εγκληματικής οργάνωσης αποτελούσε η χρήση εργαλείων τεχνητής νοημοσύνης (A.I.) για την κλωνοποίηση της φωνής συγγενικού προσώπου του υποψήφιου θύματος'; 'Κατά τη διάρκεια της σύντομης συνομιλίας αποκτούσαν δείγμα της φωνής του και, με τη χρήση εργαλείου τεχνητής νοημοσύνης, προέβαιναν στην κλωνοποίηση'", "relation": "supports", "source_id": "s1" }, { "locator": "'επικοινωνούσαν τηλεφωνικά με τα υποψήφια θύματα και τα έπειθαν να προβούν σε συγκεκριμένες ενέργειες'; 'κυρίως για θέματα που αφορούν την εγκατάσταση οπτικής ίνας'; 'αναπαράγοντας μέσω της τεχνολογίας κλωνοποίησης τη φωνή του συγγενικού ή οικείου του προσώπου'", "relation": "supports", "source_id": "s2" } ], "assertion": "The organisation used an AI tool to clone the voice of a relative of the intended victim, obtained from a pretext call, and played the cloned voice to the victim to confirm the fraudsters' instructions during fake fibre-installation or utility scenarios.", "causal_attribution": "Hellenic Police statement; single official chain." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "'συνελήφθησαν -2- από τα μέλη της οργάνωσης, τη στιγμή που μόλις είχαν αφαιρέσει από οικία θύματος, τιμαλφή αξίας -30.000- ευρώ'; 'Πρόκειται για έναν 23χρονο και έναν 25χρονο'", "relation": "supports", "source_id": "s1" }, { "locator": "'συνελήφθησαν δύο από τα μέλη της οργάνωσης, τη στιγμή που μόλις είχαν αφαιρέσει από οικία θύματος, τιμαλφή αξίας 30.000 ευρώ'", "relation": "supports", "source_id": "s2" } ], "assertion": "Two members aged 23 and 25 were arrested in Nea Ionia, Attica, immediately after removing valuables worth €30,000 from a victim's home.", "causal_attribution": "Police account of the arrest; the loss is attributed to the ring." }, { "id": "c3", "status": "reported", "evidence": [ { "locator": "'Μέχρι στιγμής έχει πιστοποιηθεί η εμπλοκή των μελών της οργάνωσης σε επιπλέον -5- περιπτώσεις με παρόμοια μεθοδολογία'; 'με όφελος άνω των -120.000- ευρώ, περιλαμβάνονται ακόμη -4- άτομα'; 'το παράνομο περιουσιακό όφελος από τη δράση της εγκληματικής οργάνωσης ξεπερνά το -1.000.000- ευρώ'; 'τουλάχιστον από τις αρχές Ιουλίου 2026'", "relation": "supports", "source_id": "s1" }, { "locator": "'Μέχρι στιγμής έχουν διακριβωθεί ακόμη πέντε περιπτώσεις με παρόμοια μεθοδολογία'; 'Το παράνομο περιουσιακό όφελος που αποδίδεται στη δράση της ομάδας εκτιμάται ότι ξεπερνά το 1 εκατομμύριο ευρώ'", "relation": "supports", "source_id": "s3" } ], "assertion": "Police have confirmed the group's involvement in at least five further cases with the same method, document proceeds above €120,000 in the case file, which names four further people, and estimate total illicit gains above €1 million; the group operated since at least early July 2026.", "causal_attribution": "Police figures; the €1 million is an estimate and is not used as a loss count." }, { "id": "c4", "status": "reported", "evidence": [ { "locator": "'Οι συλληφθέντες οδηγήθηκαν στον αρμόδιο Εισαγγελέα και παραπέμφθηκαν στον Ανακριτή'; 'κατασχέθηκαν ένα όχημα Δημόσιας Χρήσης και -2- συσκευές κινητής τηλεφωνίας'; 'κλοπή οχήματος που τελέστηκε στις 14/9/2026'", "relation": "supports", "source_id": "s1" } ], "assertion": "The two arrested were brought before the prosecutor and referred to an investigating judge; a taxi and two mobile phones were seized and a vehicle stolen on 14 September 2026 was attributed to the group.", "causal_attribution": "Police statement." } ], "effects": [ { "label": "a victim's valuables worth €30,000 were taken after calls in which a cloned relative's voice confirmed the fraudsters' instructions; police confirm at least five further victims", "claim_id": "c2", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://tvstar.gr/2026/09/18/klonopoious", "kind": "news_report", "access": "read", "language": "el", "translation_note": "Read in Greek on 2026-09-19; the second half of the article reproduces the Hellenic Police announcement verbatim. Quotations translated by the reviewer.", "independence_group": "hellenic-police-release" }, { "id": "s2", "url": "https://www.in.gr/2026/09/18/greece/egklimatiki-organosi-eksapatouse-klonopoiontas-fones-syggenikon-prosopon-ton-thymaton-leia-ano-tou-1-ekat-eyro/", "kind": "news_report", "access": "read", "language": "el", "translation_note": "Read in Greek on 2026-09-19; carries the police announcement text ('Σύμφωνα με την ΕΛ.ΑΣ.').", "independence_group": "hellenic-police-release" }, { "id": "s3", "url": "https://indicator.gr/i-nea-ai-apati-mama-eimai-ego-klonopoioyn", "kind": "news_report", "access": "read", "language": "el", "translation_note": "Read in Greek on 2026-09-19; a rewritten account of the same police announcement ('σύμφωνα με τις πληροφορίες', 'σύμφωνα με την ΕΛ.ΑΣ.'), grouped with it.", "independence_group": "hellenic-police-release" } ], "version": 1, "ai_roles": [ "others_use" ], "contexts": [ "finance", "everyday_life" ], "unknowns": [ "The AI voice-cloning tool is not identified and no recording of a cloned call has been published.", "The number of people harmed in the five further cases, their losses, and whether any money was recovered are not stated.", "The date of the arrests is not given (the release is dated 18 September 2026).", "The Hellenic Police release page itself could not be fetched (astynomia.gr 403); its text is taken from full reproductions.", "Names and ages of the victims and of the cloned relatives are not published." ], "geography": { "basis": "Arrests in Nea Ionia, Attica, at a victim's home; the police describe an Attica-based operation; the arrested were brought before the competent prosecutor and referred to an investigating judge (Hellenic Police release as reproduced by tvstar.gr and in.gr).", "court_countries": [ "GR" ], "event_countries": [ "GR" ], "affected_person_countries": [ "GR" ] }, "publication": { "basis": "Published under the 2026-09-15 charter as an impersonation-fraud series with a police-documented loss to an identified (unnamed) victim and at least five further confirmed victims, where the police describe AI voice cloning as the method of persuasion. Three Greek reports read, all relaying one Hellenic Police release; claims recorded as reported. Victims and relatives unnamed; suspects identified only by age.", "reviewed_on": "2026-09-19" }, "ai_involvement": { "basis": "The Hellenic Police announcement states that the organisation used artificial-intelligence tools to clone the voice of a relative of the intended victim from a sample obtained in a pretext call, and played the cloned voice to the victim to confirm the fraudsters' instructions. The cloned voice impersonated the relative and was used to speak to the victim, which is why both relations are recorded. The tool is not identified and no recording has been published; all inspected accounts relay the police release.", "status": "reported" }, "person_relations": [ "communicated_with", "depicted_or_impersonated" ] }, "name": "Attica, Greece: a fraud ring cloned relatives' voices with AI to 'confirm' fake fibre-installation instructions; two collectors arrested in Nea Ionia with €30,000 of a victim's valuables, at least six cases since July 2026", "summary": "On 18 September 2026 the Hellenic Police announced that its Organised Crime Directorate had dismantled a criminal organisation, active since at least early July 2026, whose members defrauded and robbed residents of Attica by posing on the phone as staff of the electricity distributor ΔΕΔΔΗΕ, mobile operators or fibre-optic installers. When a target hesitated, the callers asked for a relative's phone number, called that relative under a mobile-operator pretext to obtain a voice sample, cloned the voice with an AI tool and then played the cloned voice to the target to 'confirm' the instructions. Two men aged 23 and 25, described as the ring's 'collectors', were arrested in Nea Ionia just after removing valuables worth €30,000 from a victim's home; the case file, covering criminal organisation, fraud and aggravated theft with proceeds above €120,000, names four more people. Police have so far confirmed at least five further cases with the same method and estimate the group's total proceeds above €1 million. The two arrested were brought before the prosecutor and referred to an investigating judge.", "incidentDate": "2026-07-01", "incidentKind": "bounded_series", "incidentDatePrecision": "month", "exposurePattern": "single_interaction", "reportedDate": "2026-09-18", "aiSystem": "AI voice-cloning tool (not identified by police)", "severity": "medium", "verificationStatus": "credible", "harmCategories": [], "harmOutcomes": [ "financial_loss" ], "harmOutcomeSummary": "A victim lost valuables worth €30,000 to collectors who arrived after calls in which a cloned relative's voice confirmed the fraudsters' instructions; police confirm at least five further victims of the same method and document proceeds above €120,000. The police attribute the persuasion to AI voice cloning; the losses are attributed to the ring.", "frameworkFacets": [], "causationStatus": "supported", "participantUsersAffectedMin": 0, "otherPeopleHarmedMin": 1, "affectedCountStatus": "partial", "affectedCountEvidence": "The police release describes one victim from whose home valuables worth €30,000 had just been removed when the arrests took place, and 'at least five further cases with a similar methodology' without saying how many people each involved. One counted person plus additional unquantified victims (partial). The €120,000 in the case file and the estimated €1 million in proceeds are not person counts.", "victimAgeRange": "unknown", "jurisdiction": "GR", "platformType": "other", "outcomeType": "criminal_charges", "outcomeStatus": "ongoing", "primarySourceUrl": "https://tvstar.gr/2026/09/18/klonopoious", "primarySourceLabel": "tvstar.gr (STAR Κεντρικής Ελλάδας), 18 September 2026: Κλωνοποιούσαν με Τεχνητή Νοημοσύνη τις φωνές συγγενών για να πείθουν τα θύματά τους (reproduces the Hellenic Police release in full)", "firstPublishedAt": "2026-09-19T03:12:18.18414+00:00", "scopeVersion": "facts-v3", "tags": [ "voice-cloning", "impersonation", "phone-fraud", "greece", "attica", "police-operation", "financial-loss", "organised-crime" ] }, { "id": "2026-singapore-deepfake-zoom-pm-impersonation-funding-scam", "caseFacts": { "claims": [ { "id": "c1", "status": "reported", "evidence": [ { "locator": "'A person lost at least $4.9 million after falling for a scam involving the impersonation of senior government officials'; 'received a WhatsApp message with a profile photo of Mr Wong Hong Kuan'; 'transferred the money through a series of transactions to a corporate bank account supplied by the scammers'.", "relation": "supports", "source_id": "s2" }, { "locator": "'He lost at least $4.9 million after believing that Prime Minister Lawrence Wong had sought his help'; 'the email was sent from a Proton Mail account'; 'invited to a Zoom video conference ... fabricated using deepfake artificial intelligence technology'.", "relation": "supports", "source_id": "s3" }, { "locator": "'In one case, a victim lost at least S$4.9 million (US$3.8 million) in what was claimed to be funding assistance related to the Strait of Hormuz'.", "relation": "supports", "source_id": "s1" } ], "assertion": "A businessman lost at least S$4.9 million after being approached by scammers posing as the Secretary to the Cabinet, signing an NDA, receiving a fake letter of guarantee with the Prime Minister's signature, attending a deepfake Zoom conference of government officials, and then transferring money in a series of transactions to a corporate account.", "causal_attribution": "Singapore Police Force advisory relayed by three outlets; single official chain." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "'the speech did not synchronise with the speakers' lips'; 'the speech was broadcast via one account throughout the call'; 'end with a deepfake video of PM Wong delivering closing remarks, which included an acknowledgement of the victim's attendance'.", "relation": "supports", "source_id": "s1" } ], "assertion": "Police obtained the footage of the fabricated Zoom conference depicting the Prime Minister, the President, Minister Indranee Rajah, MAS representatives and foreign officials, and identified deepfake indicators: speech out of sync with lips, audio broadcast from one account, and a distorted background and Zoom logo; the fake Prime Minister's closing remarks acknowledged the victim's attendance.", "causal_attribution": "Police statement on their own examination of the footage, reported by CNA." } ], "effects": [ { "label": "a businessman lost at least S$4.9 million after a deepfake video conference of government officials and a fake letter of guarantee", "claim_id": "c1", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://www.channelnewsasia.com/singapore/impersonation-scam-fake-zoom-meeting-footage-lawrence-wong-tharman-indranee-police-6125691", "kind": "news_report", "access": "read", "language": "en", "translation_note": "Read in English on 2026-09-18 (CNA, 16 May 2026). Reports the police release of the fabricated Zoom footage, the participants depicted and the deepfake indicators.", "independence_group": "spf-advisory" }, { "id": "s2", "url": "https://www.straitstimes.com/singapore/victim-loses-at-least-4-9m-in-scam-involving-deepfakes-of-pm-wong-government-officials", "kind": "news_report", "access": "read", "language": "en", "translation_note": "Read in English on 2026-09-18 (Straits Times, 14 May 2026). Reports the SPF advisory: WhatsApp and proton.me approach, NDA, letter of guarantee, Zoom call, transfers, and the 9 May SIM-card charges.", "independence_group": "spf-advisory" }, { "id": "s3", "url": "https://www.asiaone.com/singapore/police-spf-advisory-government-official-impersonation-scam-pm-lawrence-wong-funding-assistance-hormuz-49-million", "kind": "news_report", "access": "read", "language": "en", "translation_note": "Read in English on 2026-09-18 (AsiaOne, 13/14 May 2026). Same SPF advisory with screenshots of the WhatsApp and email approach.", "independence_group": "spf-advisory" } ], "version": 1, "ai_roles": [ "others_use" ], "contexts": [ "finance", "public_services" ], "unknowns": [ "The victim's identity, business and the exact date of the transfers are not published (advisory 14 May 2026).", "No arrest for this loss or recovery of funds is reported.", "The deepfake tools used are not identified.", "Whether the victim has pursued civil recovery is unknown." ], "geography": { "basis": "Singapore Police Force advisory; the victim is described as a Singapore business professional who had dealt with government officials (Straits Times, CNA). No court proceeding for this loss is reported; the 9 May SIM-card charges concern earlier cases.", "court_countries": [], "event_countries": [ "SG" ], "affected_person_countries": [ "SG" ] }, "publication": { "basis": "Published under the 2026-09-15 charter as an impersonation-fraud case with a large documented loss to one person, where the police examined and released the AI-generated footage. Three Singapore outlets read, all relaying SPF advisories; claims recorded as reported. Victim unnamed; impersonated officials are public figures.", "reviewed_on": "2026-09-18" }, "ai_involvement": { "basis": "The Singapore Police Force obtained the Zoom footage and described specific deepfake indicators (speech out of sync with lips, audio broadcast from a single account, distorted background and logo). The AI content depicted and impersonated named officials, and the fabricated closing remarks were addressed to the victim, acknowledging his attendance, which is why communicated_with is also recorded.", "status": "supported" }, "person_relations": [ "communicated_with", "depicted_or_impersonated" ] }, "name": "Singapore: a businessman lost at least S$4.9 million after a deepfake Zoom 'briefing' with fabricated Prime Minister Lawrence Wong and other officials asked him for 'urgent funding assistance'", "summary": "In May 2026 the Singapore Police Force (SPF) reported that a man had lost at least S$4.9 million (about US$3.8 million) to a government-official impersonation scam. He received a WhatsApp message carrying the profile photo of Secretary to the Cabinet Wong Hong Kuan and an email from a proton.me address in that name, requesting urgent funding assistance for 'the situation in the Strait of Hormuz', with a fake 'letter of guarantee' bearing the Prime Minister's signature promising reimbursement within 15 business days; he signed a non-disclosure agreement and supplied a copy of his identity card. He was then invited to a Zoom video conference in which Prime Minister Lawrence Wong, President Tharman Shanmugaratnam, Minister Indranee Rajah, Monetary Authority of Singapore representatives and foreign officials appeared; all were fabricated with deepfake AI, and the closing 'remarks' by the fake Prime Minister acknowledged the victim's attendance. Contacted afterwards on WhatsApp by a scammer posing as a lawyer, he transferred the money in a series of transactions to a corporate bank account, and realised the fraud only when he contacted the real cabinet secretary. On 16 May the police released footage of the fake conference, noting lips out of sync with speech, audio broadcast from a single account and a distorted background.", "incidentDate": "2026-05-01", "incidentKind": "single_event", "incidentDatePrecision": "month", "exposurePattern": "single_interaction", "reportedDate": "2026-05-14", "aiSystem": "Deepfake AI video and audio fabricating Prime Minister Lawrence Wong, President Tharman Shanmugaratnam, Minister Indranee Rajah and other officials in a Zoom conference (tools not identified)", "severity": "high", "verificationStatus": "credible", "harmCategories": [], "harmOutcomes": [ "financial_loss" ], "harmOutcomeSummary": "A businessman transferred at least S$4.9 million to scammers after a deepfake video conference fabricating the Prime Minister and other officials; the police documented the AI-generated footage.", "frameworkFacets": [], "causationStatus": "supported", "participantUsersAffectedMin": 0, "otherPeopleHarmedMin": 1, "affectedCountStatus": "exact", "affectedCountEvidence": "Police describe a single victim who lost at least S$4.9 million. Exact count of one; the impersonated officials are not counted.", "victimAgeRange": "adult", "jurisdiction": "SG", "platformType": "other", "outcomeType": "investigation_opened", "outcomeStatus": "ongoing", "primarySourceUrl": "https://www.straitstimes.com/singapore/victim-loses-at-least-4-9m-in-scam-involving-deepfakes-of-pm-wong-government-officials", "primarySourceLabel": "The Straits Times, 14 May 2026: Victim loses at least $4.9m in scam involving deepfakes of PM Wong, government officials (Singapore Police Force advisory)", "firstPublishedAt": "2026-09-18T03:25:14.306192+00:00", "scopeVersion": "facts-v3", "tags": [ "deepfake", "government-impersonation", "zoom", "video-conference", "fraud", "singapore", "financial-loss", "police-documented" ] }, { "id": "2026-russia-chatgpt-phishing-crypto-theft", "caseFacts": { "claims": [ { "id": "c1", "status": "corroborated", "evidence": [ { "locator": "'ChatGPT... выдала ссылку на страницу, которая оказалась сайтом мошенников'; '1 904 513 FXRP — примерно $2,1 млн'; 'unlimited approval'.", "relation": "supports", "source_id": "s1" }, { "locator": "'12 июня 2026 года... обменять токены sFLR на WFLR. Он посоветовался с ChatGPT'; 'ссылка на sceptre.network — точную копию легитимного сервиса sceptre.fi'; '1 904 513 FXRP — примерно $2,1 млн'.", "relation": "supports", "source_id": "s2" }, { "locator": "'Криптоинвестор потерял около 180 миллионов рублей после перехода по фишинговой ссылке, которую посоветовал ChatGPT'; 'похитили около 2,1 миллиона долларов'.", "relation": "supports", "source_id": "s3" } ], "assertion": "On 12 June 2026 a Russian-speaking investor asked ChatGPT in Russian where to swap sFLR for WFLR; ChatGPT returned a link to sceptre.network, a phishing clone of sceptre.fi; he connected his wallet, signed an unlimited-approval transaction, and about 1.9 million FXRP (~$2.1 million) were drained.", "causal_attribution": "The on-chain analysis (VAL, carried by s1/s2/s4) and the MVD confirmation (s3) are independent chains for the loss and the ChatGPT-link mechanism." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "'фишинговая ссылка появлялась только в ответах на русском языке. При аналогичных запросах на других языках ChatGPT её не выдавал. Мошенники целенаправленно \"отравляли\" данные для русскоязычных пользователей.'", "relation": "supports", "source_id": "s2" }, { "locator": "'Сейчас фишинговая ссылка больше не появляется в ChatGPT'.", "relation": "supports", "source_id": "s1" } ], "assertion": "The phishing link appeared only in ChatGPT's Russian-language answers, indicating deliberate data-poisoning targeting Russian-speaking users; the link no longer appears.", "causal_attribution": "Reported by the blockchain analyst (VAL) and carried by the Russian tech press; not independently verified by the MVD." }, { "id": "c3", "status": "documented", "evidence": [ { "locator": "'сообщили РАПСИ в пресс-службе Управления по организации борьбы с противоправным использованием информационно-коммуникационных технологий МВД РФ'.", "relation": "supports", "source_id": "s3" } ], "assertion": "Russia's Interior Ministry (MVD) confirmed the loss of about 180 million rubles ($2.1 million).", "causal_attribution": "Attributed to the MVD press service via RAPSI." } ], "effects": [ { "label": "crypto investor lost about $2.1 million after acting on a phishing link ChatGPT returned to a Russian-language query", "claim_id": "c1", "direction": "negative" } ], "sources": [ { "id": "s1", "url": "https://bits.media/kriptopoinvestor-lishilsya-2-1-mln-iz-za-ssylki-v-otvete-chatgpt/", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-17 (datePublished 2026-09-04). Relays blockchain analyst VAL's on-chain investigation: sFLR/WFLR query, sceptre.network phishing clone, 1.9M FXRP (~$2.1M) drained via unlimited approval, Tornado Cash routing. Model reading; no human bilingual review.", "independence_group": "val-report" }, { "id": "s2", "url": "https://vc.ru/ai/3122620-kak-ii-obmanul-kriptovinvestora-na-milliony-dollarov", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-17 (datePublished 2026-09-05). Names the 12 June 2026 date, alias Alex, the unlimited-approval signing, and that the phishing link appeared only in Russian-language answers. Derives from VAL's report. Model reading.", "independence_group": "val-report" }, { "id": "s3", "url": "https://rapsinews.ru/digital_law_news/20260911/312188548.html", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-17 (RAPSI, 11 Sep 2026). Attributes the confirmation to the press service of the MVD's unit for combating unlawful use of ICT: ~180 million rubles / ~$2.1M lost after a ChatGPT-provided phishing link. Independent official confirmation. Model reading.", "independence_group": "mvd" }, { "id": "s4", "url": "https://hi-tech.mail.ru/news/154924-chatgpt-podsunul-fishingovuyu-ssylku-kriptoinvestor/", "kind": "news_report", "access": "read", "language": "ru", "translation_note": "Read in Russian on 2026-09-17 (datePublished 2026-09-07). Russian tech-press account derived from VAL's report. Model reading.", "independence_group": "val-report" } ], "version": 1, "ai_roles": [ "own_use" ], "contexts": [ "finance" ], "unknowns": [ "The investor's full identity and exact location within Russia are not established; only the alias Alex/@vesnuhin is public.", "No arrests or defendants are identified.", "Whether OpenAI has acknowledged or acted on the reported Russian-language data-poisoning is not established in the inspected sources." ], "geography": { "basis": "The investor is Russian-speaking and the case was confirmed by Russia's Interior Ministry (RAPSI). Event and affected-person country recorded as Russia on that basis. No court proceeding established.", "court_countries": [], "event_countries": [ "RU" ], "affected_person_countries": [ "RU" ] }, "publication": { "basis": "Published under the 2026-09-15 charter, which includes fraud and security consequences in scope. A crypto investor acted on a phishing link ChatGPT returned to his Russian-language query and lost about $2.1 million; the loss is confirmed independently by Russia's Interior Ministry and traced on-chain by a blockchain analyst. Causation of the AI's role (surfacing the phishing link) is supported; the theft was executed by scam operators.", "reviewed_on": "2026-09-17" }, "ai_involvement": { "basis": "Multiple technology outlets and a blockchain analyst report that the phishing link appeared in ChatGPT's answer to the investor's Russian-language question, and Russia's Interior Ministry confirmed to RAPSI that the loss followed a phishing link ChatGPT provided. The theft itself was executed by the scam operators; ChatGPT's role was surfacing the phishing link, reportedly only in Russian-language responses.", "status": "supported" }, "person_relations": [ "communicated_with" ] }, "name": "Russia: a crypto investor lost about $2.1 million after ChatGPT returned a phishing link in answer to a token-swap question", "summary": "On 12 June 2026 a Russian-speaking crypto investor, known by the alias Alex (@vesnuhin), asked ChatGPT in Russian where to swap sFLR for WFLR tokens. ChatGPT's reply included a link to sceptre.network, a phishing clone of the legitimate sceptre.fi. He connected his wallet and signed an unlimited-approval transaction; within seconds about 1.9 million FXRP, worth roughly $2.1 million (about 180 million rubles), were drained. A blockchain analyst traced the theft, and reported that the phishing link appeared only in Russian-language answers. Russia's Interior Ministry (MVD) later confirmed the loss.", "incidentDate": "2026-06-12", "incidentKind": "single_event", "incidentDatePrecision": "day", "exposurePattern": "single_interaction", "reportedDate": "2026-09-04", "aiSystem": "ChatGPT (OpenAI)", "aiCompany": "OpenAI", "severity": "high", "verificationStatus": "credible", "harmCategories": [], "harmOutcomes": [ "financial_loss" ], "harmOutcomeSummary": "A crypto investor lost about $2.1 million (some 180 million rubles) after connecting his wallet to a phishing site whose link ChatGPT had returned in answer to a Russian-language token-swap question; Russia's Interior Ministry confirmed the loss.", "frameworkFacets": [], "causationStatus": "supported", "participantUsersAffectedMin": 1, "otherPeopleHarmedMin": 0, "affectedCountStatus": "exact", "affectedCountEvidence": "One affected person: the investor who acted on the ChatGPT-provided link and lost about $2.1 million. VAL's report that a related scheme netted more than $2.2 million from other users is not used as a person count.", "victimAgeRange": "adult", "jurisdiction": "RU", "platformType": "assistant", "outcomeType": "investigation_opened", "outcomeStatus": "ongoing", "primarySourceUrl": "https://bits.media/kriptopoinvestor-lishilsya-2-1-mln-iz-za-ssylki-v-otvete-chatgpt/", "primarySourceLabel": "bits.media, 4 September 2026: crypto investor lost ~$2.1M after a phishing link in a ChatGPT answer (blockchain analyst VAL on-chain analysis)", "firstPublishedAt": "2026-09-17T03:27:42.903846+00:00", "scopeVersion": "facts-v3", "tags": [ "chatgpt", "openai", "phishing", "crypto", "financial-loss", "data-poisoning", "russia", "communicated-with" ] } ] }