Deepfakes in fake investment ads: how the scam works

A famous athlete or actress appears to “recommend” an investment platform with guaranteed returns. The voice and face may look convincing even though that person never made the statement. A deepfake is only one component of an older investment scam: its job is to make the viewer submit a phone number and start talking to the criminal.

How the scam works

The scheme is repeatable and well-honed:

1. A bait ad on social media with a deepfake of a celebrity and a promise of “guaranteed profit” or “a method the banks don’t want you to see”.
2. A contact form — the victim leaves a phone number.
3. A call from an “advisor”, who walks them step by step through registering on a fake platform and making a first, small deposit.
4. A fake dashboard shows growing profits, encouraging ever-larger top-ups.
5. When the victim tries to withdraw, “taxes” and “fees” appear — and the money never comes back anyway.

Poland’s financial regulator describes this pattern as a fake investment promoted, among other methods, through the unauthorised use of a public figure’s image. Synthetic media alone does not prove fraud, however. The decisive questions concern the entity’s identity and authorisation, the flow of money and the terms of the offer.

How to recognise a deepfake

The technology is getting better, but it still leaves traces:

• Unnatural intonation and “seams” in the voice — an artificial narrator, an odd sentence rhythm.
• Lip movement out of sync with the audio, “floating” face edges, strange blinking.
• A context that doesn’t fit the person — celebrities don’t advertise trading platforms with guaranteed returns.

But don’t rely on spotting artefacts alone — that’s a race the defence is losing. What matters more is the overriding rule.

A rule that materially reduces risk

A promise of high returns without risk, time pressure and no clear legal identity form a strong set of warning signs. Before paying, establish the company’s full legal name, jurisdiction, licence number and regulator, then verify those details independently — never through a link supplied by the “advisor”. The KNF public warning list can identify some dangerous offers, but absence from that list is not an approval or a safety guarantee.

Don’t call “advisors” back, don’t install “remote help” apps (a common element — screen and, in effect, banking takeover), and check KNF warnings. Report suspicious ads to CSIRT KNF and to the platform where you saw them.

Deepfakes have raised the credibility of an old scam, but they haven’t changed its foundation — it’s still social engineering feeding on greed and on trust in a familiar face.

What happens after the first deposit

A small initial payment lowers the barrier. The caller then presents a fabricated dashboard showing profits, asks for larger transfers or directs the victim to install remote-control software. That software can expose the screen, authentication codes and actions performed in online banking. When the victim requests a withdrawal, the criminals invent a tax, AML charge, account-unlocking fee or another required deposit. A genuine institution does not make the return of your own money conditional on a transfer to a private account named by an agent.

After the loss, a second approach may follow. A supposed law firm, hacker or recovery agent promises to retrieve the funds for an advance fee. This can be another stage of the same fraud. Do not grant such a person access to your device, cryptocurrency wallet or bank account.

How to respond after contact or payment

End the conversation and do not install further applications. If you disclosed credentials, change passwords from a clean device, starting with email and banking, terminate unfamiliar sessions and enable MFA. Contact the bank immediately after a transfer; time may affect whether it can attempt to stop the funds. Preserve the ad URL, domain, phone numbers, chat history, payment receipts and wallet identifiers. Report the case to law enforcement, the bank, the advertising platform and the relevant national CSIRT.

Want to train your team to recognise deepfakes and social engineering, or test your organisation’s resilience to AI-powered manipulation? See our security and AI services or get in touch.

Sources: KNF — definition of deepfake, KNF — investment-fraud pattern, KNF — public warning list.