Yahoo Boys Allegedly Used Deepfake Technology to Impersonate Brad Pitt and Defraud French Woman of $850,000 in Romance Scam

Three Nigerian "Yahoo Boys" scammers allegedly used AI-generated image manipulation tools, along with fake social media and WhatsApp accounts, to reportedly impersonate actor Brad Pitt and convince a French interior decorator, Anne, that she was in a romantic relationship with him. Over 18 months, they allegedly fabricated selfies and messages, reportedly leading Anne to divorce her husband and transfer $850,000 under the false pretense that Pitt needed money for kidney treatment while his accounts were frozen.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The scammers used AI-generated deepfakes to impersonate celebrities and execute targeted romance scams, defrauding victims of significant financial sums.

Additional risk subdomains

• 5.1 Overreliance and unsafe use: Vulnerable individuals placed inappropriate trust in AI-generated celebrity personas, leading to severe emotional and material dependence.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by human scammers who intentionally used deployed AI image and video generation tools to defraud specific victims.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the use of AI-generated content such as deepfakes, which are subject to transparency obligations under the EU AI Act to ensure users are informed of their synthetic nature.

AI system and alleged parties

• AI system: unspecified AI image-creating technology
• AI purpose: Deepfake Video Generation; Deepfake Image Generation
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: Yahoo Boys, Scammers impersonating Brad Pitt, Brouteurs
• Alleged harmed parties: General public susceptible to AI-enhanced scams, Brad Pitt, Anne (French interior decorator)

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Minor
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Minor, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Minor
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Minor, indirect Minor
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Physical

Reported: The report explicitly describes indirect physical harm resulting from the incident.

Indirectly caused: A 53-year-old French victim attempted suicide three times and required hospitalization due to severe depression caused by the financial loss and subsequent online harassment.

Financial

Reported: The report explicitly describes significant financial losses, totaling approximately 850,000 USD for the French victim and 255 USD for the UK victim.

Directly caused: The average financial loss per detailed occurrence is approximately 425,127 USD, with the French victim losing 830,000 euros (850,000 USD) and the UK victim losing 200 pounds (255 USD) directly to the scammers.

Inferred additional harm: Given that AI-driven scams are reported to have extracted over 108 million USD in the US alone, it is likely that total global financial losses from similar deepfake romance scams are substantially higher.

Malicious content

Reported: The report explicitly describes toxic and malicious content created and spread as a result of the incident.

Directly caused: Scammers created and sent AI-generated deepfake videos and doctored images of celebrities to manipulate and deceive the victims.

Indirectly caused: The French victim was subjected to a wave of toxic online harassment, cyberbullying, and mockery on social media platforms like X, including public posts by a football club and Netflix France, after her story was broadcast.

Psychological

Reported: The report explicitly describes severe psychological and mental-health harm to the victims.

Directly caused: The French victim suffered from severe depression and was hospitalized. The UK victim, who already battled depression, suffered further emotional trauma and distress from being targeted and scammed.

Indirectly caused: The French victim experienced severe psychological trauma and depression, leading to multiple suicide attempts, which was exacerbated by intense online mockery and cyberbullying after her story aired.

Inferred additional harm: It is highly likely that other victims of similar AI-driven romance scams suffer from un-reported psychological trauma, anxiety, and profound shame.

Epistemic

Reported: The report explicitly describes epistemic harm through the creation of highly convincing fake evidence.

Directly caused: Scammers fabricated fake evidence, including AI-generated photos of Brad Pitt in a hospital bed and a fake news broadcast with an AI-generated anchor, to mislead the victim and maintain the deception.

Inferred additional harm: The widespread availability of highly realistic deepfakes erodes public trust in digital media and makes it increasingly difficult for individuals to verify authentic communications.

People affected

• Occurrences reported: 2
• People reportedly harmed: 2
• People reportedly exposed: 2

Potential causes

Management

• Prioritizing Growth Over Safety: Platforms delayed implementing automatic scam flagging to maintain user growth.
• Poor AI Tool Risk Assessment: Developers released generative models without safeguards against fraud.

Technology

• Convincing Deepfake Generation: AI tools created realistic hospital photos and video clips of celebrities.
• Accessible Voice and Video AI: Scammers easily cloned celebrity voices and created fake news reports.
• High-Fidelity Image Editing: AI allowed seamless face swapping and custom text insertion on images.

Data Inputs

• Exposed Celebrity Personas: Abundant public data allowed scammers to train and craft convincing deepfakes.
• Public Social Media Posts: Scammers used public ski trip photos to target victims.
• Doctored Digital ID Inputs: Scammers used modified digital copies of driving licenses to prove identity.

Human Factors

• Low Social Media Literacy: Victims did not understand platform mechanics or how to spot deepfakes.
• Emotional Vulnerability: Scammers exploited victims struggling with divorce, isolation, or depression.
• Overlooking Red Flags: Victims ignored warnings from family and signs like mismatched lighting.

Process and Methods

• Weak Platform Verification: Social media sites allowed unverified accounts to impersonate celebrities.
• Delayed Content Moderation: Platforms failed to proactively flag or remove deepfake scam accounts.
• Inadequate Reporting Systems: User reporting mechanisms did not stop scammers from continuing harassment.

Regulatory Environment

• Lack of AI Legislation: Governments failed to establish laws protecting citizens from deepfake abuse.
• Weak Cross-Border Enforcement: Jurisdictional issues hindered prosecuting scammers operating from Nigeria.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide consistent, detailed accounts of the two primary scam occurrences, including specific financial losses, the psychological impact on the victims, and the specific ways AI-generated images and videos were used to facilitate the fraud. The role of the AI as a tool for generating deceptive media is clearly outlined across multiple reputable news sources.
• Ambiguities identified: The specific technical platforms used by the scammers to generate the deepfakes are not fully detailed, though Google Veo 3 is mentioned in a general context.
• Alternative interpretations: The incident could be viewed purely as a traditional cybercrime/phishing incident, but the central role of AI-generated deepfakes in overcoming the victims' skepticism makes it a clear AI safety/misuse incident.

Scammers used AI-generated deepfake images and videos to impersonate celebrities in sophisticated romance scams, defrauding individuals of significant sums and causing severe psychological distress. While devastating to the individuals, the national security impact remains minor and manageable under standard law enforcement procedures.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: France, United Kingdom, Nigeria
• Alleged perpetrator: Scammers in Nigeria

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic concern regarding AI-enabled fraud rather than an immediate crisis requiring urgent national security response.
• Autonomy: Human-controlled. The AI systems were used strictly as tools by human scammers who directed the image and video generation.
• Novelty: Evolved capability. Represents an advancement of traditional romance scams through the integration of sophisticated AI image and video generation.

Impact by dimension

• Physical security: Negligible. No threats to physical systems, critical infrastructure, kinetic targeting, or mass casualty events are indicated in the incident details.
• Information security: Negligible. The deepfakes were used for isolated personal financial fraud rather than systematic information warfare, state-sponsored campaigns, or intelligence compromise.
• Sovereignty: Negligible. No impact on state authority, electoral systems, government decision-making, or sovereign functions.
• Economic security: Minor. While significant individual financial losses occurred, there is no threat to national financial systems, strategic industries, or state economic security.
• Societal stability: Minor. The incident caused severe psychological harm and harassment to individual victims, but does not threaten large-scale societal stability or civil liberties.