Alleged AI-Generated Scam Uses Bank of Cyprus Branding to Solicit Investments

An alleged fraudulent online platform presented as the "Bank of Cyprus Trading AI Platform" was promoted using reportedly fabricated media, including a video that appeared to depict the Bank's CEO endorsing the service. The video reportedly used misleading branding, including the BBC logo, and promised unrealistic investment returns. The Bank of Cyprus publicly denied any affiliation and warned customers about the use of AI-generated content in the scam.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves the use of AI-generated deepfake videos of a bank CEO to impersonate him and promote a fraudulent investment scam for financial gain.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by human malicious actors who intentionally created and deployed deepfake videos and fake promotional materials to defraud the public.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The incident involves AI-generated content such as deepfakes, which are subject to transparency obligations under the EU AI Act to ensure users are informed of their synthetic nature.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Video Generation; Voice Generation
• Behaviour type: Tool
• Alleged developer: Unknown voice cloning technology developers, Unknown deepfake technology developers
• Alleged deployer: Unknown scammers, Unidentified scam network
• Alleged harmed parties: Prospective investors in Cyprus, Panicos Nicolaou, General public of Cyprus, BBC, Bank of Cyprus customers, Bank of Cyprus

Harm severity

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: The report explicitly describes malicious content in the form of a deepfake video of the Bank of Cyprus CEO and fabricated social media posts used to promote a scam.

Directly caused: A deepfake video of CEO Panicos Nicolaou and fake Twitter posts were created and circulated online to deceive the public.

Indirectly caused: N/A

Inferred additional harm: It is likely that the malicious deepfake video reached thousands of social media users in Cyprus before being flagged or removed.

Epistemic

Reported: The report explicitly describes epistemic harm through the creation and online circulation of fake news, a fabricated BBC video, and deepfake media.

Directly caused: The fraudsters generated a fake video using the BBC logo and a deepfake of the bank's CEO to spread false information about a non-existent trading platform.

Indirectly caused: N/A

Inferred additional harm: The widespread dissemination of highly convincing deepfakes could erode public trust in official media broadcasts and banking communications.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 10000

Potential causes

Technology

• Deepfake Video Generation: Scammers used advanced AI to create a realistic video of the bank's CEO.
• Logo and Brand Spoofing: Misleadingly used BBC logo and bank branding to appear legitimate.
• Automated Fraudulent Platform: Promoted a fake automated trading system to promise steady passive income.

Data Inputs

• Unauthorized CEO Media Use: Used existing video/audio of CEO Panicos Nicolaou to train deepfake model.
• Fabricated Social Media Images: Created fake Twitter posts and branch photos to suggest widespread buzz.

Human Factors

• Public Susceptibility to Scams: Users attracted by low deposit requirements and high guaranteed returns.
• Trust in Manipulated Media: Victims easily deceived by realistic deepfake videos and trusted logos.

Process and Methods

• Ineffective Ad Screening: Online networks failed to detect and block fraudulent deepfake advertisements.
• Unsolicited Outreach Methods: Scammers used phishing emails, SMS, and direct chats to bypass bank channels.

Regulatory Environment

• Weak Online Ad Regulation: Lack of strict regulatory oversight on AI-generated promotional content.

Information quality

• Classification confidence: High
• Reason for confidence: The report clearly details the nature of the scam, the specific AI technology used (deepfakes), and the target of the impersonation (the Bank of Cyprus CEO). There is no ambiguity about the fraudulent intent or the methods used, although the exact number of victims and financial losses are not specified.
• Ambiguities identified: The report does not specify if any individuals actually fell victim to the scam or lost money, nor does it identify the specific deepfake generation software used.
• Alternative interpretations: None. The incident is clearly a financial scam leveraging deepfake technology.

A financial scam targeting Cypriot citizens utilized a deepfake video of the Bank of Cyprus CEO and fake BBC branding to promote a fraudulent trading platform. While representing an evolved capability in consumer fraud, the incident has minor national security implications, targeting retail banking customers rather than systemic financial infrastructure.

• Overall national security impact: Minor
• Response level: Moderate
• Scope: Single nation
• Primary target: Cyprus
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Near-term. Active scam campaign requiring monitoring and public warnings, but does not constitute an immediate national security crisis.
• Autonomy: Human-controlled. The AI was used as a passive tool to generate synthetic media based on direct human inputs and instructions.
• Novelty: Established threat. Deepfake-based financial scams and executive impersonation are established threat vectors seen globally.

Impact by dimension

• Physical security: Negligible. The incident is a financial scam targeting the public and does not involve physical threats or critical infrastructure damage.
• Information security: Minor. Use of deepfake media and fake BBC branding to deceive the public, but localized to a financial scam rather than state-sponsored geopolitical information warfare.
• Sovereignty: Negligible. The scam targeted a commercial bank and the general public, with no impact on government operations, elections, or state sovereignty.
• Economic security: Minor. Represents a localized financial scam targeting retail bank customers, with no systemic threat to the nation's financial system or core economic infrastructure.
• Societal stability: Negligible. The incident is a targeted financial fraud and does not threaten broader societal stability, civil liberties, or human rights.