Romance Scammer 'Alla Morgan' Allegedly Exploits Deepfake Technology to Defraud Victim of £17,000

A scammer, or scammers, reportedly used AI-generated deepfake videos and documents to impersonate a fictitious person named "Alla Morgan," allegedly convincing a 77-year-old woman, Nikki MacLeod, to send £17,000 through various payment methods. The deepfakes were allegedly used in establishing credibility so as to enable fraud under the pretense of an online romantic relationship.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident is a targeted romance scam where scammers used AI-generated deepfakes to exploit a specific victim for financial gain.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The harm was caused by human scammers who intentionally deployed and used AI deepfake technology to deceive and defraud the victim.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3: Limited Risk. The incident involves the creation and use of AI-generated content (deepfakes), which falls under Limited Risk and requires transparency obligations under the EU AI Act.

AI system and alleged parties

• AI system: unspecified
• AI purpose: Deepfake Video Generation; Voice Generation
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: Unknown scammers, Alla Morgan
• Alleged harmed parties: Nikki MacLeod

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Minor, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Minor
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The report describes 1 incident causing a total financial loss of £17,000, with an average loss of £17,000 per occurrence.

Directly caused: The victim suffered a direct financial loss of £17,000 through bank transfers, PayPal, and gift cards, of which £7,000 was later recovered.

Psychological

Reported: The report explicitly describes psychological harm, noting that the victim experienced heartbreak and felt foolish.

Indirectly caused: The victim suffered severe emotional distress and heartbreak from the romance scam, stating 'not only do they take all your money but they break your heart.'

Inferred additional harm: It is likely the victim suffered long-term psychological distress, anxiety, and a loss of trust due to the intense emotional manipulation.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Platform Safety Gaps: Social media platforms failed to detect or block scam accounts using AI.
• Lack of Payment Portal Alerts: Payment platforms did not sufficiently warn users about romance scam patterns.

Technology

• Accessible Deepfake Tools: Scammers easily created realistic videos using face swap apps and filters.
• Realistic AI Video Generation: AI-generated videos of the persona on an oil rig bypassed initial skepticism.

Data Inputs

• Misused Identity Photos: Scammers used photos of real people to generate deepfakes without consent.
• Lack of Image Verification: Reverse image scanning failed to identify the source of the generated images.

Human Factors

• Emotional Vulnerability: Victim felt lonely after lockdown and a breakup, making her more trusting.
• Overreliance on Video Proof: Victim assumed video messages were absolute proof of the person's identity.
• Lack of Deepfake Awareness: Victim was unaware of deepfakes and how easily AI can fake video and audio.

Process and Methods

• Inadequate Video Verification: Lack of live video calls allowed recorded deepfakes to substitute for proof.
• Irreversible Payment Methods: Use of Steam cards and PayPal friends and family bypassed protections.

Regulatory Environment

• Lack of Deepfake Regulations: Absence of strict laws targeting the creation and use of non-consensual AI.
• Limited AI Generation Oversight: No regulatory standards for watermarking or tracking AI-generated media.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide consistent, detailed accounts of the romance scam, the victim's background, the amount of money lost, and the specific role of AI-generated deepfake videos in reassuring the victim. Multiple news sources corroborate the core facts of the incident.
• Ambiguities identified: The specific AI software or platform used by the scammers to generate the deepfakes is not identified.
• Alternative interpretations: None. The incident is clearly a romance scam facilitated by deepfake technology.

A localized financial fraud incident where scammers used AI-generated deepfakes to conduct a romance scam against a UK citizen, resulting in a loss of 17,000 pounds. The incident constitutes cybercrime with negligible national security implications, as it did not target critical infrastructure, government functions, or state stability.

• Overall national security impact: Negligible
• Scope: Single nation
• Primary target: United Kingdom
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The active fraud has been resolved and is under police investigation, posing no immediate national security crisis.
• Autonomy: Human-controlled. Scammers manually deployed and directed the AI-generated deepfakes to deceive the victim, with no autonomous system decision-making.
• Novelty: Established threat. AI-facilitated romance scams and deepfake impersonations for financial fraud are well-documented and increasingly common tactics.

Impact by dimension

• Physical security: Negligible. No threat to physical systems, infrastructure, or human safety was reported in this localized financial fraud case.
• Information security: Negligible. While AI deepfakes were used, this was a targeted financial scam against a private citizen rather than a state-sponsored disinformation or intelligence operation.
• Sovereignty: Negligible. No disruption to state authority, electoral systems, or core government decision-making processes occurred.
• Economic security: Negligible. The financial loss was limited to an individual and poses no threat to national financial systems or strategic technological advantage.
• Societal stability: Negligible. The incident is an isolated fraud case targeting a single individual, with no wider impact on social cohesion or population-scale civil liberties.