India-Based Sextortion Gang Allegedly Used AI-Generated Sexual Videos to Extort Canada-Based Indian Victim

Police in Ghaziabad, India, alleged that four members of a sextortion gang recorded a Canada-based Indian victim during a Facebook Messenger video call, created sexually explicit AI videos depicting the victim, and demanded $50,000 while threatening to circulate the material. Police said the victim reported the demand and that AI sextortion videos were found on the suspects' phones.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves malicious actors using AI-generated explicit videos to target, blackmail, and extort specific individuals for financial gain, which aligns with Boundary Rule B1.

Additional risk subdomains

• 1.2 Exposure to toxic content: The incident involved the creation and targeted exposure of sexually explicit, non-consensual synthetic content to blackmail the victims.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The risk and subsequent harm were caused by human malicious actors intentionally using AI tools to generate explicit videos for blackmail after the AI technology was deployed.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The incident involves the creation of deepfakes (AI-generated explicit videos), which falls under the transparency and disclosure obligations of Limited Risk systems under the EU AI Act.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Video Generation; Image Retouching
• Behaviour type: Tool
• Alleged developer: Synthetic video generation technology developers, Synthetic media generation technology developers, Deepfake technology developers
• Alleged deployer: Synthetic media creators, Sextortionists, Scammers in India, Scammers, Md Hammad Tyagi, Md Faizaan Malik, Md Faisal, Md Amaan Tyagi, Deepfake creators, Cybercriminals in India, Cybercriminals
• Alleged harmed parties: Victims of sextortion, Victims of deepfake abuse, Privacy, Individuals subjected to sexual exploitation imagery

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Minor, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The report describes a total financial loss of approximately 6.58 crore INR (65.8 million INR) across all occurrences since 2023. For the single specific occurrence involving the Canada-based NRI, the attempted extortion amount was 50,000 USD (approximately 4.15 to 4.7 crore INR depending on the report's conversion), though the transaction was prevented by police intervention.

Directly caused: The gang successfully extorted approximately 6.58 crore INR in total from hundreds of victims, averaging roughly 506,153 INR per bank account if distributed across the 130 accounts.

Inferred additional harm: Additional victims who did not report their cases to the police may have suffered further unquantified financial losses.

Malicious content

Reported: The report explicitly describes the creation of AI-generated sexually explicit and objectionable videos used for blackmail.

Directly caused: The suspects created explicit synthetic videos of the victims to blackmail them.

Inferred additional harm: It is highly likely that hundreds of explicit deepfake videos were generated to target the estimated hundreds of victims of this racket.

Civil rights

Reported: The report explicitly describes extortion and the non-consensual creation of sexually explicit synthetic imagery, violating the victims' rights to dignity and privacy.

Directly caused: The Canada-based NRI's right to privacy and personal dignity was violated through the creation of non-consensual explicit AI videos.

Inferred additional harm: The rights of hundreds of other victims were similarly violated through non-consensual synthetic sexualization and extortion.

Privacy

Reported: The report explicitly describes the unauthorized recording of video calls and the creation of explicit synthetic videos of victims.

Directly caused: The privacy of the Canada-based NRI was violated when his video call was recorded and edited into explicit content without consent.

Inferred additional harm: The privacy of hundreds of other victims was systematically violated by the gang using similar methods.

Psychological

Reported: The report explicitly describes blackmail and threats to circulate explicit videos, which inherently causes severe distress and psychological harm.

Directly caused: The Canada-based NRI and other victims were subjected to severe distress, anxiety, and harassment due to extortion threats involving explicit AI-generated videos.

Inferred additional harm: Given that there were hundreds of victims targeted by this sextortion racket, it is highly likely that many experienced severe psychological trauma, anxiety, and fear of social ruin.

People affected

• Occurrences reported: 130
• People reportedly harmed: 130
• People reportedly exposed: 130

Potential causes

Management

• Organized Crime Operation: The gang managed a structured operation distributing proceeds among members.

Technology

• AI Deepfake Video Generation: AI was used to generate sexually explicit, edited videos of the victim.
• Use of Virtual Foreign Numbers: Virtual numbers masked the perpetrators' actual location to target the NRI.
• Social Media Platform Messaging: Facebook Messenger and video calls enabled the initial contact and recording.

Data Inputs

• Recorded Video Call Footage: The gang recorded the victim during video calls to use as source data for AI.
• Fake Social Media Profiles: Fake profiles provided the personal data and bait to lure the victim.

Human Factors

• Victim Compromise: The victim was lured into a compromising position during a video call.
• Financial Motivation of Youth: Young students and associates were enticed by high returns from cybercrime.
• Mule Account Holders: Individuals in need sold their bank accounts for a small fee of 15000 rupees.

Process and Methods

• Mule Bank Account Sourcing: Purchasing and utilizing 130 hired bank accounts to launder extorted funds.
• WhatsApp Coordination: WhatsApp groups were used to share mule account details and coordinate.
• Account Rotation Strategy: Sextortionists abandoned bank accounts once complaints were registered.

Regulatory Environment

• Delayed Bank Fraud Detection: Lack of real-time monitoring allowed 6.5 crore rupees to pass through accounts.
• Easy Online Account Creation: Suspects opened bank accounts online using fake documents with ease.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from multiple reputable news outlets provide consistent details regarding the arrest of the suspects, the operational methods of the gang, the specific targeting of the NRI, and the use of AI to generate explicit videos for extortion.
• Ambiguities identified: The specific AI software or model used to generate the explicit videos is not named.
• Alternative interpretations: None. The facts clearly point to a coordinated cyber-extortion racket utilizing AI deepfake technology.

An international cybercrime gang in India used AI-generated deepfakes to blackmail and extort hundreds of victims, including an overseas NRI. While the incident highlights the growing threat of AI-enabled financial fraud and severe privacy violations, it remains a localized criminal matter with minor national security implications.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: India
• Other affected: Canada
• Alleged perpetrator: An international cybercrime gang based in Ghaziabad, India (Md Faisal, Md Amaan Tyagi, Md Hammad Tyagi, and Md Fezan)

Threat characteristics

• Imminence: Long-term. The perpetrators have been arrested by law enforcement, making this an ongoing criminal justice and strategic monitoring matter rather than an active crisis.
• Autonomy: Human-controlled. The AI was used as a standard software tool by human operators to manually edit and generate explicit videos from recorded calls.
• Novelty: Established threat. Sextortion and the use of deepfakes for blackmail are well-established criminal tactics that have been observed globally for several years.

Impact by dimension

• Physical security: Negligible. The incident is a cyber extortion scam targeting individuals and does not involve kinetic attacks or critical infrastructure compromise.
• Information security: Negligible. No classified networks, national intelligence capabilities, or state-level disinformation campaigns were targeted or compromised.
• Sovereignty: Negligible. This is a criminal enterprise focused on financial extortion and does not threaten state authority, electoral processes, or government decision-making.
• Economic security: Minor. While a substantial amount of money (6.58 crore INR) was stolen from hundreds of victims using 130 mule accounts, it represents localized cybercrime rather than a threat to national financial stability.
• Societal stability: Minor. The racket caused severe psychological distress, privacy violations, and non-consensual sexualization of hundreds of victims, but does not threaten large-scale societal stability or cause mass civil unrest.