Alleged AI-Generated Video Ads Impersonate Bank of Montreal Strategist Brian Belski to Promote Investment Scam

A purportedly AI-generated video of Bank of Montreal Chief Investment Strategist Brian Belski was used in an alleged fraudulent investment ad campaign on Meta platforms, including Instagram and Facebook. The ads reportedly impersonated Belski to promote a WhatsApp investment group. BMO confirmed the impersonation and warned users; the Facebook page was reportedly renamed and repurposed by scammers.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves threat actors using AI-generated deepfake videos of financial experts to run highly convincing investment scams and defraud individual investors.

Additional risk subdomains

• 3.1 False or misleading information: The deepfake videos generate false and misleading investment advice to deceive users.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The risk is caused by human threat actors intentionally deploying AI deepfake generation tools post-deployment to commit financial fraud.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes 'AI-generated deepfake videos' and 'AI-powered deepfake videos' used to impersonate financial experts. According to the definitions, Limited Risk includes 'AI-generated content such as deepfakes' which require transparency obligations.

AI system and alleged parties

• AI system: unspecified
• AI purpose: Deepfake Video Generation; Voice Generation
• Behaviour type: Tool
• Alleged developer: Unknown voice cloning technology developers, Unknown deepfake technology developers
• Alleged deployer: Unknown scammers impersonating Brian Belski, Unknown scammers
• Alleged harmed parties: General public of Canada, Brian Belski, Bank of Montreal

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Substantial, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The report explicitly describes significant financial losses, including over $1 million lost by investors in a scam impersonating economist David Watt, and rising Canadian social media investment scam losses reaching $128.4 million in 2023. Across the 4 identified occurrences, the average reported loss per occurrence is estimated at $250,000 based on the $1 million reported for Watt's case.

Directly caused: Investors lost over $1,000,000 in a scam using David Watt's identity, averaging $250,000 per occurrence if distributed across the 4 main cases mentioned.

Inferred additional harm: Given the scale of the ads reaching millions of users and the $128.4 million in overall Canadian social media scam losses, total inferred losses from these specific deepfake campaigns are likely several million dollars.

Malicious content

Reported: Yes, the report describes the creation and distribution of malicious deepfake videos and phishing ads on Meta platforms.

Directly caused: Threat actors created and distributed AI-generated deepfake videos of Brian Belski and Martin Sandbu, with one ad reaching nearly 1,000,000 users in the EU.

Inferred additional harm: It is likely that many more deepfake videos and phishing ads were generated and distributed across Meta platforms, exposing millions of additional users to malicious content.

Privacy

Reported: Yes, the report describes phishing attempts to collect users' personal and banking credentials.

Directly caused: Phishing ads mimicking EQ Bank directed users to counterfeit login screens to steal banking credentials.

Inferred additional harm: It is likely that hundreds of users had their personal information or banking credentials compromised through these phishing sites.

Epistemic

Reported: Yes, the report describes the generation of highly realistic deepfake videos of financial experts giving fake investment advice, eroding trust in legitimate financial communications.

Directly caused: AI-generated deepfake videos of Brian Belski and Martin Sandbu fabricated investment advice, misleading nearly 1,000,000 viewers in the EU.

Inferred additional harm: The proliferation of such high-fidelity deepfakes likely erodes public trust in digital media and legitimate financial institutions, making it harder for users to distinguish real advice from fake.

People affected

• Occurrences reported: 4
• People reportedly harmed: 10
• People reportedly exposed: 1000000

Potential causes

Management

• Inadequate Pre-Ad Screening: Management failed to verify identity of ad accounts before publishing.
• Underfunded Ad Verification: Platforms did not allocate enough resources to verify advertiser identity.

Technology

• AI Deepfake Video Generation: Scammers used AI to generate highly realistic videos of financial experts.
• Ad Platform Loophole: Meta allowed running Instagram ads without an active Instagram profile.
• Lack of Proactive AI Filters: No automated tools were active to detect deepfakes before they were published.

Data Inputs

• Scraped Public Personas: Scammers scraped public web data of legitimate finance professionals.
• Repurposed Facebook Pages: Stolen or renamed pages were reused to bypass new-account red flags.
• Lookalike Phishing Domains: Scammers used counterfeit domains mimicking real bank brands.

Human Factors

• Trust in Public Figures: Victims trusted realistic deepfakes of renowned investment experts.
• Search for High Yields: Low interest rates motivated investors to seek riskier, fake opportunities.

Process and Methods

• Delayed Takedown Response: Platforms took days to remove ads even after receiving direct reports.
• Reactive Moderation Process: Moderation relied on user reports rather than proactive detection.

Regulatory Environment

• Safe Harbour Protections: Platforms face limited liability for host content under safe harbour laws.
• Foreign Jurisdiction Scams: Scammers operate from regions hostile to local law enforcement.
• Lagging Prevention Systems: Canada lacks unified national fraud-fighting agencies like peers.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide clear, detailed accounts of the deepfake scams, the specific individuals and institutions targeted, the platforms used, and the financial impact. The role of AI (deepfake generation) is explicitly stated, and the classification of the incident as financial fraud (4.3) is highly straightforward.
• Ambiguities identified: The exact AI models used to generate the deepfakes are not specified.
• Alternative interpretations: None. The incident is clearly a case of AI-enabled financial fraud.

Threat actors used AI-generated deepfakes of financial experts to conduct widespread investment fraud targeting Canadian and European citizens. While the incident caused significant individual financial losses and highlights content moderation challenges, its national security impact remains minor as it does not target critical infrastructure, state sovereignty, or systemic financial stability.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: Canada
• Other affected: European Union
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. Represents an ongoing capability and strategic concern regarding AI-enabled financial fraud rather than an immediate national security crisis.
• Autonomy: Human-controlled. AI tools were used to generate synthetic media, but human actors directed the fraud campaigns, set up phishing sites, and managed the interactions.
• Novelty: Evolved capability. AI-enabled impersonation and deepfakes represent a significant advancement of existing phishing and financial fraud techniques.

Impact by dimension

• Physical security: Negligible. The incident is purely digital and financial, posing no threat to physical systems, critical infrastructure, or human safety.
• Information security: Minor. While deepfakes were used, they targeted financial commentators for consumer fraud rather than state institutions, political leadership, or intelligence operations.
• Sovereignty: Negligible. The incident did not impact state authority, electoral systems, or core government decision-making processes.
• Economic security: Minor. Although victims suffered significant individual financial losses, the scam targeted retail investors and did not threaten systemic financial stability or strategic national industries.
• Societal stability: Minor. The phishing and credential harvesting compromised personal privacy for affected users, but did not result in population-scale manipulation or systemic civil rights violations.