Yahoo Boys Allegedly Employ Real-Time Deepfake Technology in Romance Scams

Scammers from Nigeria, known as "Yahoo Boys," are reportedly utilizing real-time deepfake technology to impersonate individuals during video calls, deceiving victims in romance scams. By allegedly altering their appearance with face-swapping software, they build trust under false identities to defraud targets of substantial sums.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves scammers using real-time deepfake face-swapping technology to impersonate trusted individuals for financial gain and targeted emotional manipulation.

Additional risk subdomains

• 1.2 Exposure to toxic content: Scammers utilize deepfake nude generators and explicit photographs to harass, degrade, and sextort victims.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The harm is directly caused by the intentional actions of human scammers (the Yahoo Boys) who deploy and manipulate consumer face-swapping tools to defraud and exploit victims.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the deployment of AI-generated content, specifically real-time deepfakes, which fall under transparency obligations to ensure users are aware they are interacting with synthetic media.

AI system and alleged parties

• AI system: face-swapping software
• AI purpose: Deepfake Video Generation; Deepfake Image Generation
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: Yahoo Boys, Scammers in Nigeria, Brouteurs
• Alleged harmed parties: Targets of the Yahoo Boys, Targets of scammers in Nigeria, Targets of romance scams, Targets of brouteurs

Harm severity

Highest direct severity in any category: Severe. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Substantial
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Minor, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Minor, indirect Substantial
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Substantial

Physical

Reported: The report explicitly describes indirect physical harm, noting that scammers have sextorted teenagers and driven them towards suicide.

Directly caused: N/A

Indirectly caused: The report notes that Yahoo Boys have engaged in sextortion of teenagers, driving some victims to commit suicide.

Inferred additional harm: It is highly likely that multiple vulnerable individuals and teenagers targeted by these severe sextortion and romance scams have attempted or completed self-harm, though exact numbers are not quantified in the text.

Financial

Reported: The report explicitly describes massive financial losses, noting that romance fraud cost over 650 million dollars last year and individual victims are tricked into parting with thousands of dollars.

Directly caused: Individual victims directly lose thousands of dollars to scammers using real-time deepfake video calls to build trust.

Indirectly caused: N/A

Inferred additional harm: Given the scale of the Yahoo Boys network and their thousands of members, total financial losses specifically facilitated by their real-time deepfake operations likely run into tens of millions of dollars.

Malicious content

Reported: The report explicitly describes the creation and spread of toxic and malicious content, including real-time deepfake video streams, explicit photographs, and deepfake nude images.

Directly caused: Scammers generate real-time face-swapped video feeds to deceive victims and use deepfake nude generators to create explicit content.

Indirectly caused: N/A

Inferred additional harm: A significant volume of non-consensual deepfake pornography and deceptive media is generated and circulated across Telegram and other social media platforms by these scam networks.

Psychological

Reported: The report explicitly describes psychological harm, including severe emotional manipulation, exploitation of depression, and driving victims to suicidal ideation.

Directly caused: Scammers build intense emotional rapport, leading to severe psychological distress, trauma, and feelings of betrayal when the fraud is revealed.

Indirectly caused: Victims suffer from exacerbated depression and anxiety, with some teenagers experiencing extreme distress leading to suicide due to sextortion.

Inferred additional harm: Thousands of victims globally likely suffer from severe, long-lasting psychological trauma, anxiety, and clinical depression after being emotionally manipulated and financially ruined.

Epistemic

Reported: The report explicitly describes epistemic harm through the creation of highly convincing real-time deepfakes that make it difficult for victims to distinguish real video calls from synthetic ones.

Directly caused: Real-time face-swapping software fabricates a false visual reality during live video interactions, successfully misleading victims.

Indirectly caused: N/A

Inferred additional harm: The proliferation of real-time deepfake tools undermines general societal trust in video communication and digital identity verification methods.

Child sexual exploitation and abuse

Reported: The report explicitly describes CSEA-related harm, noting that Yahoo Boys have targeted and sextorted teenagers, driving them towards suicide.

Directly caused: N/A

Indirectly caused: Scammers use deepfake tools and explicit photo albums to target, groom, and sexually extort teenagers.

Inferred additional harm: Given the active recruitment and sharing of sextortion scripts in Telegram channels with thousands of members, it is highly likely that hundreds of minors have been subjected to AI-facilitated sexual exploitation.

People affected

• Occurrences reported: 1
• People reportedly harmed: 100
• People reportedly exposed: 500

Potential causes

Management

• No App Guardrails against Abuse: Software developers fail to restrict entertainment apps from scam usage.
• Decentralized Crime Structure: Yahoo Boys lack a formal leadership or governance structure to monitor.
• Platform Oversight Failures: Communication platforms fail to proactively ban scam coordination channels.

Technology

• Real-Time Face-Swapping Software: Advanced tools allow real-time face-swapping during live video calls.
• Voice Pitch Manipulation Tools: Software enables scammers to alter their voice pitch to match fake personas.
• Glitch Masking via Low Bandwidth: Unstable mobile connections mask visual glitches in deepfake video feeds.

Data Inputs

• Pre-built App Personas: Existing personas and faces built into apps are leveraged by scammers.
• Explicit Photo Albums: Albums of explicit photographs are sold to build convincing fake personas.
• Pre-written Scam Scripts: Free downloadable scripts are used to manipulate victims systematically.

Human Factors

• Vulnerability of Victims: Scammers exploit victims depression, eating disorders, and loneliness.
• Scammer Social Manipulation Skills: Con artists are highly skilled at building trust and rapport with targets.
• Scammer Lack of Fear: Scammers brazenly show faces because they do not fear legal repercussions.

Process and Methods

• Dual-Phone Setup Technique: Using two phones with ring lights to capture and swap faces in real-time.
• Laptop Webcam Setup Technique: Using laptop webcams and software to stream manipulated video feeds.
• Telegram Collaboration Clusters: Scammers organize in decentralized Telegram clusters to share tools and tips.

Regulatory Environment

• Unregulated Entertainment Apps: No regulations restrict the creation of real-time face-swap software.
• Delayed Platform Moderation: Telegram channels hosting scam networks remain active for long periods.
• Lack of Cross-Border Enforcement: Scammers operate from Nigeria targeting global victims, complicating policing.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides detailed, first-hand observations from fraud researchers and cybersecurity experts who monitored the scammers' Telegram channels, analyzed self-shot setup videos, and documented the exact technical configurations used to execute the real-time deepfakes.
• Ambiguities identified: The exact software applications used are intentionally withheld to prevent copycat attacks, and the precise number of victims specifically defrauded via deepfakes versus traditional romance scams is not fully quantified.
• Alternative interpretations: None, the evidence clearly points to a coordinated, technology-enabled financial fraud and extortion campaign.

Organized cybercriminal networks known as the Yahoo Boys are leveraging real-time face-swapping AI to conduct highly convincing romance scams and sextortion. While the technology represents a significant evolution in synthetic media capabilities and causes devastating financial and psychological harm to individuals, its current impact is classified as a minor national security threat managed under standard law enforcement procedures.

• Overall national security impact: Minor
• Response level: Moderate
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: United States and Western nations
• Alleged perpetrator: Yahoo Boys

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic concern and criminal capability rather than an imminent national security crisis.
• Autonomy: Human-controlled. The AI face-swapping software functions strictly as a tool controlled and operated directly by human scammers.
• Novelty: Evolved capability. Represents a significant technological advancement from static deepfakes to real-time, synchronized video manipulation during live calls.

Impact by dimension

• Physical security: Negligible. No direct threat to physical systems, critical infrastructure, or kinetic military capabilities.
• Information security: Minor. Involves sophisticated real-time deepfake technology, but deployed for criminal financial fraud rather than state-sponsored disinformation or intelligence compromise.
• Sovereignty: Negligible. No impact on state authority, government decision-making, or electoral systems.
• Economic security: Minor. Facilitates significant cumulative financial losses through romance fraud, but does not threaten overall national economic stability or strategic industries.
• Societal stability: Minor. Causes severe psychological harm and sextortion leading to tragic teen suicides, but remains a localized criminal issue rather than population-scale algorithmic oppression.