Purportedly AI-Generated TikTok Ad Impersonating Digital Payments Company OPay Reportedly Led to ₦150,000 (~US$108.86) Loss for Small-Business Operator in Ilorin, Nigeria

Mohammed Yusuf, a small-business operator in Ilorin, Kwara State, Nigeria, reportedly lost about ₦150,000 (~US$108.86) after responding to a purportedly AI-generated TikTok ad impersonating digital payments company OPay. The ad allegedly promised a free payment terminal and cash grant. A caller reportedly posing as OPay staff requested a one-time password; unauthorized betting-voucher transactions reportedly depleted nearly all the operator's business capital.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves malicious actors using AI-generated deepfakes and voice clones to impersonate trusted brands and individuals to execute targeted financial fraud and phishing scams against specific victims.

Additional risk subdomains

• 3.1 False or misleading information: The AI systems generated highly realistic, false video and audio representations of public figures and corporate representatives to mislead users.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The risk and subsequent financial harms were caused by human malicious actors intentionally deploying AI voice cloning and deepfake generation tools post-deployment to defraud victims.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the use of AI-generated content such as deepfakes and synthetic voices, which under the EU AI Act are subject to specific transparency obligations to ensure users are informed of their synthetic nature.

AI system and alleged parties

• AI system: unspecified
• AI purpose: Deepfake Video Generation; Voice Generation
• Behaviour type: Tool
• Alleged developer: Synthetic video generation technology developers, Synthetic media generation technology developers, Synthetic audio generation technology developers, Deepfake technology developers
• Alleged deployer: TikTok scammers, Synthetic media creators, Scammers impersonating OPay, Scammers, Impersonation scammers, Deepfake creators
• Alleged harmed parties: TikTok users, Targets of scammers in Nigeria, Social media users, Small business owners, OPay, Mohammed Yusuf, Epistemic integrity

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Minor
• Psychological: direct Negligible, indirect Minor
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: The report explicitly describes malicious content in the form of deceptive, unlabelled AI-generated deepfake videos and cloned voices designed to defraud users.

Directly caused: Scammers created and distributed at least 130 distinct AI-generated promotional videos on TikTok impersonating OPay, UBA, MTN, and public figures.

Inferred additional harm: It is highly likely that thousands of additional AI-generated scam ads were created and distributed across TikTok and other social media platforms like Facebook, reaching millions of users.

Privacy

Reported: The report explicitly describes privacy violations where victims' sensitive personal credentials were harvested and exploited.

Indirectly caused: Victims were manipulated into surrendering phone numbers, email addresses, OPay account details, and OTP codes, which scammers used to compromise financial accounts and Bybit crypto wallets.

Inferred additional harm: It is highly likely that thousands of other users who clicked the links in the 130 documented ads had their personally identifiable information harvested and stored for future identity theft or phishing campaigns.

Psychological

Reported: The report explicitly describes psychological distress and emotional suffering experienced by the victims of the fraud.

Indirectly caused: Victims experienced severe distress; [PERSON_002] recalled sweating and crying, stating that losing his business capital 'almost broke me' after being mocked by the scammer.

Inferred additional harm: It is highly likely that many of the thousands of other unnamed victims of these widespread AI-generated ad scams experienced similar levels of severe anxiety, distress, and financial panic.

Epistemic

Reported: The report explicitly describes epistemic harm through the creation of highly realistic fake videos and cloned voices that mimic trusted brands and individuals.

Directly caused: The AI-generated ads fabricated endorsements from public figures like Aliko Dangote and the Emir of Kano, Lamido Sanusi, to deceive users into believing fraudulent schemes were legitimate.

Inferred additional harm: The widespread proliferation of unlabelled synthetic media on major social platforms degrades the overall information ecosystem, making it difficult for users to distinguish real corporate communications from AI-generated fabrications.

People affected

• Occurrences reported: 130
• People reportedly harmed: 3
• People reportedly exposed: 37000000

Potential causes

Management

• Prioritizing Ad Revenue: ByteDance focused on ad revenue growth over robust safety safeguards.
• Inadequate Local Moderation: Platform management failed to moderate local-language content effectively.
• Opaque Ad Transparency: TikTok obscured advertiser identities in the documented scam ads.

Technology

• Deepfake Video Generation: AI tools generated realistic deepfakes of public figures to deceive users.
• Voice Cloning Technology: Cloned voices of trusted individuals were used to make fake ads look real.
• Deficient Automated Moderation: Automated moderation systems struggled to detect evolving AI-generated content.

Data Inputs

• Phished User Credentials: Users submitted OTPs and account details directly into malicious links.
• Harvested Public Media: Scammers used publicly available videos of figures like Aliko Dangote.
• Unlabeled AI Content: Deceptive ads lacked mandatory labels identifying them as AI-generated.

Human Factors

• Trust in Sponsored Ads: Users assumed promoted ads had passed platform verification.
• Fear of Missing Out: Urgency tactics pressured users into making quick, unsafe choices.
• Economic Vulnerability: Financial hardship drove users to seek online grants and opportunities.

Process and Methods

• Weak Advertiser Verification: Flawed verification allowed anonymous scammers to run paid promotions.
• Exploitative Ad Infrastructure: Targeting tools allowed scammers to hyper-personalize deceptive ads.
• Evasive Scammer Tactics: Scammers disabled comments and sharing to prevent public warnings.

Regulatory Environment

• Digital Governance Gap: Nigeria lacked proactive laws holding platforms accountable for ad fraud.
• Weak Regulatory Enforcement: Regulatory bodies failed to enforce strict verification of online ads.

Information quality

• Classification confidence: High
• Reason for confidence: The investigative report is highly detailed, providing specific case studies of named victims, quantifying the number of monitored ads (130), identifying the specific brands and public figures impersonated, and detailing the financial losses and platform mechanics.
• Ambiguities identified: The specific AI software tools used by the fraudsters are not named, and the exact number of total victims across Nigeria is estimated via macro-statistics rather than a precise registry.
• Alternative interpretations: None. The evidence clearly points to a coordinated AI-enabled financial fraud campaign exploiting social media ad networks.

This incident involves the malicious use of AI-generated deepfakes and cloned voices in Nigerian languages to execute financial scams on TikTok. While the campaign targeted a large audience and caused severe individual financial and psychological distress, its primary impact is criminal fraud rather than a direct threat to national security, infrastructure, or state sovereignty.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Nigeria
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The incident represents an ongoing, persistent threat of AI-enabled consumer fraud rather than an active national security crisis requiring immediate intervention.
• Autonomy: Human-controlled. The AI tools (voice cloners and deepfake generators) were directly controlled and deployed by human actors as tools to generate specific deceptive media.
• Novelty: Evolved capability. This represents a significant advancement of existing financial phishing tactics by integrating high-quality, localized synthetic media to scale social engineering.

Impact by dimension

• Physical security: Negligible. The incident is entirely digital and financial in nature, with no threats to physical systems, critical infrastructure, or human safety reported.
• Information security: Minor. While scammers deployed highly realistic AI-generated deepfakes and voice clones on TikTok, these were used for localized financial fraud rather than state-sponsored geopolitical disinformation or intelligence compromise.
• Sovereignty: Negligible. The scam impersonated corporate brands and public figures like business leaders for financial theft, but did not disrupt electoral processes, border controls, or core government decision-making.
• Economic security: Minor. The fraud caused direct financial losses to individual citizens, but does not represent a systemic threat to the nation's financial infrastructure, strategic industries, or technological competitive advantage.
• Societal stability: Minor. The widespread scams targeted a large user base of 37 million, causing psychological distress and financial harm to victims, but did not trigger large-scale civil unrest or systematic, state-level human rights abuses.