Purported Deepfake-Based Facebook Impersonation Reportedly Targets Daughter of Scot in Coma

Scammers allegedly created a fake Facebook profile impersonating a Scottish woman, Teigan McMahon, raising funds for her father, who was reportedly in a coma in Turkey. The account reportedly reused her photos and posts and was described as using purportedly AI-generated or deepfake-style content to solicit donations. The impersonation forced the family to pause their legitimate fundraiser while the fake profile remained online.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves fraudsters using impersonation and deep-fake technology to target specific victims and scam them for personal financial gain.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by human fraudsters who intentionally created a fake social media profile using deployed AI technologies to scam donors.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The incident involves 'deep-fakes' (AI-generated content), which under the EU AI Act are subject to transparency obligations to inform users they are interacting with AI-generated media.

AI system and alleged parties

• AI system: None named
• AI purpose: Social Media Content Generation; Deepfake Image Generation
• Behaviour type: unknown
• Alleged developer: Unknown image generator developer, Unknown deepfake technology developers
• Alleged deployer: Unknown scammers
• Alleged harmed parties: Teigan McMahon, Peter McMahon, Epistemic integrity

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Psychological

Reported: The report explicitly describes psychological distress experienced by the victim due to the scam.

Directly caused: Teigan McMahon was left 'sickened' and 'devastated' by scammers exploiting her father's life-threatening medical situation.

Inferred additional harm: Other members of the family likely suffered severe emotional distress and anxiety due to the fraudulent exploitation of their family tragedy.

People affected

• Occurrences reported: 1
• People reportedly harmed: 2
• People reportedly exposed: 2

Potential causes

Management

• Prioritizing Growth Over Security: Platforms prioritize user growth over robust safety and moderation.
• Inadequate Risk Assessment: Failure to assess risk of AI-enabled impersonation on platforms.

Technology

• Facilitation of Deepfakes: AI tools enable scammers to easily create convincing fake media.
• Weak Identity Verification: Social media platforms lack robust automated identity verification.
• Inadequate Fake Account Detection: Algorithms fail to automatically flag and remove impersonator accounts.

Data Inputs

• Unprotected Personal Photos: Publicly accessible photos are harvested to fuel impersonation scams.
• Lack of Media Provenance: No metadata to verify the authenticity of uploaded images.

Human Factors

• Overreliance on Profiles: Users trust social media profiles without verifying actual identity.
• Scammer Exploitation of Empathy: Scammers exploit human emotions and empathy during family tragedies.
• Difficulty Spotting Deepfakes: Public struggles to differentiate between real and AI-manipulated media.

Process and Methods

• Slow Takedown Processes: Reporting mechanisms are slow to remove flagged impersonator profiles.
• Inadequate Content Moderation: Platform moderation processes fail to proactively stop scam setups.

Regulatory Environment

• Lack of Deepfake Regulation: Absence of strict legal frameworks governing AI-generated impersonation.
• Weak Platform Liability Laws: Platforms face minimal legal penalties for hosting fraudulent accounts.

Information quality

• Classification confidence: Medium
• Reason for confidence: The report clearly details the real-world impact of the scam on the family and their GoFundMe campaign. However, details about the AI technology used (referred to generally as 'deep-fake') are extremely sparse, making it difficult to identify the specific AI system or verify if AI was actually used or if it was a simple manual impersonation.
• Ambiguities identified: It is unclear whether actual AI-generated deepfake technology (like voice or video cloning) was used, or if the term 'deep-fake' was used colloquially by the victim/reporter to describe a standard social media impersonation and photo theft.
• Alternative interpretations: The incident could be interpreted as a non-AI social engineering scam if the 'deep-fake' label was misapplied to simple profile cloning.
• Missing information: Technical details of the AI system used, confirmation of whether synthetic media (deepfakes) was actually generated, and the specific platform used to create the content.

Fraudsters created a fake Facebook profile impersonating a UK citizen to scam donors raising money for a family medical emergency. The incident is a localized financial fraud attempt with negligible national security implications, representing an established cybercrime threat rather than a national security crisis.

• Overall national security impact: Negligible
• Scope: Multiple nations
• Primary target: United Kingdom
• Other affected: United States, Turkey
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The incident represents an ongoing, low-level cybercrime capability rather than an imminent national security crisis.
• Autonomy: Human-controlled. The scam was manually executed by human fraudsters who utilized basic social engineering and digital tools.
• Novelty: Established threat. Social media impersonation, photo theft, and online fundraising fraud are well-established criminal tactics.

Impact by dimension

• Physical security: Negligible. The incident is a localized social media scam targeting an individual and has no impact on physical systems, critical infrastructure, or human safety.
• Information security: Negligible. No state-sponsored disinformation, intelligence compromise, or mass information warfare operations are indicated in this personal fraud incident.
• Sovereignty: Negligible. The scam target is a private individual and does not disrupt or threaten state authority, elections, or core government operations.
• Economic security: Negligible. The financial impact is limited to a small-scale personal fundraising campaign with no systemic economic or technological security implications.
• Societal stability: Negligible. While distressing for the victim, the incident does not threaten social cohesion, civil liberties, or population-scale stability.