New Zealand Financial Markets Authority (FMA), Te Mana Tātai Hokohoko, Reportedly Flags Purported Deepfake Pump-and-Dump Network Using Social Media Ads

The New Zealand Financial Markets Authority (FMA), Te Mana Tātai Hokohoko, reportedly warned of a global AI-enabled "pump-and-dump" scam that used purported deepfake videos of prominent New Zealand business leaders in Facebook and Instagram ads to lure investors into fake WhatsApp investment groups. Victims were allegedly urged to buy low-value foreign shares to inflate prices, then defrauded through a follow-on "recovery" scam.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves scammers using deepfake technology to impersonate business leaders in order to commit financial fraud and target individual investors for personal gain.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The scam is orchestrated by human actors who intentionally deploy deepfake technology post-deployment to deceive investors for financial gain.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the use of 'AI-generated content such as deepfakes' to impersonate business leaders, which falls under the transparency obligations of Risk Level 3.

AI system and alleged parties

• AI system: unspecified
• AI purpose: Deepfake Video Generation; Social Media Content Generation
• Behaviour type: Tool
• Alleged developer: Unknown voice cloning technology developers, Unknown deepfake technology developers
• Alleged deployer: Unknown scammers impersonating New Zealand business leaders, Unknown scammers
• Alleged harmed parties: Investors, Impersonated New Zealand business leaders, General public of New Zealand, General public

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Minor, indirect Minor
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Minor
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The report explicitly describes financial losses, stating that 'multiple victims have lost significant amounts' of money through the pump-and-dump scheme.

Directly caused: Victims suffered direct financial losses by purchasing low-value shares that subsequently collapsed in price, though specific dollar amounts are not quantified in the report.

Indirectly caused: Victims may have suffered additional indirect financial losses through secondary recovery scams where scammers extracted further payments under the guise of compensation.

Inferred additional harm: Given the FMA's statement that the complaints are 'only the tip of the iceberg' and part of a 'global network,' total financial losses are likely in the hundreds of thousands or millions of dollars.

Malicious content

Reported: Yes, the report describes the creation and spread of deepfake impersonation videos and advertisements on social media platforms.

Directly caused: Scammers created and distributed deepfake ads on Facebook and Instagram impersonating well-known Kiwi business leaders to lure investors.

Inferred additional harm: It is likely that thousands of social media users were exposed to these malicious deepfake advertisements across New Zealand and globally.

Privacy

Reported: Yes, the report describes scammers collecting personal information from victims.

Indirectly caused: In the secondary recovery scam, scammers collected personal information, copies of IDs, and bank details from victims under the false pretense of offering compensation.

Inferred additional harm: The harvested personal information and identity documents are likely used for further identity theft or sold on the dark web, affecting dozens of victims.

Epistemic

Reported: Yes, the report describes the spread of false information and deepfakes to manipulate stock markets.

Directly caused: Scammers used deepfake videos to fabricate endorsements from business leaders and spread false information about company prospects in chat groups to artificially inflate stock prices.

Inferred additional harm: The widespread use of deepfakes of trusted business leaders erodes public trust in online financial information and the authenticity of digital media.

People affected

• Occurrences reported: 1
• People reportedly harmed: 10
• People reportedly exposed: 100

Potential causes

Management

• Revenue Prioritization: Ad networks prioritized revenue over rigorous vetting of financial ads.
• Slow Platform Response: Delayed action by platforms in removing reported imposter accounts.

Technology

• Deepfake Video Generation: AI-generated deepfakes successfully impersonated trusted business leaders.
• Automated Bot Accounts: AI-controlled bots populated group chats to simulate active engagement.

Data Inputs

• Impersonation Target Media: Publicly available media of leaders used to train deepfake algorithms.
• Unverified Ad Creatives: Platforms accepted fraudulent media inputs for paid promotional campaigns.

Human Factors

• Cognitive Bias and FOMO: Investors trusted familiar faces and feared missing out on quick gains.
• Lack of Deepfake Awareness: Victims could not distinguish synthetic media from real videos of leaders.

Process and Methods

• Flawed Ad Moderation: Automated ad reviews failed to detect deepfake impersonations.
• Unregulated Messaging Groups: Platforms lacked proactive scanning for fraudulent group chat activities.

Regulatory Environment

• Cross-Border Gaps: Global nature of scams makes international regulatory enforcement difficult.
• Weak Synthetic Media Laws: Lack of clear regulations holding platforms accountable for deepfake ads.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from the Financial Markets Authority provide a clear, detailed, and authoritative account of the scam's mechanics, the platforms used, and the role of deepfake technology. While exact financial losses and the precise number of victims are not quantified, the nature of the AI's involvement (deepfakes and bots) and the resulting harms are unambiguously described.
• Ambiguities identified: The specific AI tools or models used to generate the deepfakes are not identified, and the exact number of victims and total financial losses are not specified.
• Alternative interpretations: None. The incident is clearly a coordinated financial scam leveraging synthetic media.

A global financial scam network utilized deepfake videos of prominent New Zealand business leaders to execute a pump-and-dump scheme targeting individual investors. While the incident causes financial harm and highlights the growing threat of synthetic media in fraud, it remains a criminal matter with minor direct implications for national security.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: New Zealand
• Other affected: Unknown
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. Represents an ongoing criminal capability rather than an imminent national security crisis requiring immediate government intervention.
• Autonomy: Human-controlled. The AI (deepfake generator) was used as a tool by human scammers to generate synthetic media based on direct inputs, without autonomous decision-making.
• Novelty: Evolved capability. Represents an evolved capability of traditional financial fraud, leveraging increasingly accessible and realistic deepfake generation tools.

Impact by dimension

• Physical security: Negligible. No physical security or critical infrastructure systems were targeted or affected in this financial scam.
• Information security: Minor. Deepfake technology was used to impersonate business leaders for financial fraud, but did not target national intelligence, classified models, or state security.
• Sovereignty: Negligible. The incident did not target or compromise government decision-making, electoral systems, or core sovereign functions.
• Economic security: Minor. While the pump-and-dump scam caused financial losses to individual investors, it did not threaten the broader financial system, critical supply chains, or national economic stability.
• Societal stability: Negligible. The scam targeted individual investors for financial gain, with no indications of mass surveillance, systematic discrimination, or threat to societal stability.