Fake AI-Generated Law Firms Sent Fake DMCA Notices to Increase SEO

In March 2024, fake law firms using AI-generated identities sent fraudulent DMCA takedown notices to website owners, demanding backlinks for SEO gains. These AI-generated law firms, like "Commonwealth Legal," used GAN models for realistic attorney images and fabricated bios. The scam involved fake legal threats to coerce site owners into adding backlinks, exploiting AI technology for deceptive practices.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The perpetrators used AI-generated imagery to construct fake professional personas to execute a fraudulent legal threat scam for personal SEO advantage.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was orchestrated by human actors who intentionally deployed pre-existing GAN models to generate fake attorney portraits for a fraudulent SEO scheme.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3: The incident involves the use of AI-generated content (synthetic attorney portraits), which falls under Limited Risk due to transparency concerns regarding users interacting with or being exposed to AI-generated synthetic media.

AI system and alleged parties

• AI system: AI writing assistants, Generative Adversarial Network
• AI purpose: Deepfake Image Generation
• Behaviour type: Tool
• Alleged developer: Unknown deepfake creators
• Alleged deployer: Unknown scammers, Commonwealth Legal
• Alleged harmed parties: Website owners, Website operators, Ernie Smith

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Epistemic

Reported: The report explicitly describes the fabrication of a fake law firm, fake attorneys, and fake legal credentials.

Directly caused: The use of GAN-generated faces directly aided in fabricating a highly realistic but entirely fake law firm website ('Commonwealth Legal') to deceive targets.

Inferred additional harm: The proliferation of highly convincing fake professional personas undermines trust in online legal communications and professional directories.

People affected

• Occurrences reported: 1
• People reportedly harmed: 2
• People reportedly exposed: 2

Potential causes

Management

• Unmonitored SEO Outsourcing: Tech4Gods hired sketchy contractors to build backlinks without oversight.

Technology

• GAN Face Generation: GANs allowed creation of realistic, fake attorney photos to build credibility.
• AI Text Generation: Generative AI drafted professional-sounding but bizarre attorney biographies.

Human Factors

• Susceptibility to Legal Threats: Fear of copyright lawsuits makes victims vulnerable to fake DMCA notices.
• Deceptive Intent by SEO Actors: Malicious actors weaponized AI to scale a fraudulent backlink scheme.

Process and Methods

• Flawed SEO Backlink Metrics: Search engines rely heavily on backlinks, incentivizing manipulative schemes.
• Weak Domain and Identity Check: NameCheap and web hosts did not verify the legitimacy of the law firm site.

Regulatory Environment

• Lax Enforcement of DMCA Abuse: Lack of penalties for fraudulent DMCA notices allows scammers to abuse them.

Information quality

• Classification confidence: High
• Reason for confidence: The report clearly outlines the mechanics of the scam, the role of the AI-generated images, and the parties involved. The identification of GAN-generated images was verified by an external AI detection firm (Reality Defender), leaving little ambiguity about the technology used.
• Ambiguities identified: The exact number of other websites targeted by Commonwealth Legal is not specified, and the identity of the perpetrator remains unconfirmed.

A commercial SEO fraud scheme utilizing GAN-generated attorney portraits to fabricate a fake law firm and send deceptive DMCA notices. The incident has negligible national security implications, representing localized commercial fraud rather than a threat to national infrastructure, sovereignty, or security.

• Overall national security impact: Negligible
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The incident represents an ongoing, low-level fraudulent capability rather than an immediate national security crisis.
• Autonomy: Human-controlled. The GAN model was used strictly as a tool by human perpetrators to generate static images, with no autonomous decision-making or execution.
• Novelty: Established threat. The use of GAN-generated faces for creating fake online personas and executing phishing or SEO scams is a well-established threat method.

Impact by dimension

• Physical security: Negligible. No physical systems, infrastructure, or human safety elements were targeted or affected by this online SEO fraud scheme.
• Information security: Negligible. The incident involves a low-level commercial SEO scam rather than state-sponsored information warfare, intelligence compromise, or large-scale disinformation.
• Sovereignty: Negligible. No government operations, decision-making processes, or sovereign functions were disrupted or targeted by this commercial fraud.
• Economic security: Negligible. The economic impact is limited to localized commercial SEO manipulation and minor potential legal costs for individual website owners, posing no threat to strategic national industries.
• Societal stability: Negligible. While causing localized distress to targeted website owners receiving fake legal threats, the incident does not threaten broader societal stability, civil liberties, or human rights.