This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Uruguay's public utility company, UTE, issued a warning regarding a fraudulent investment scam circulating on social media platforms. The scam utilized AI-generated deepfake videos featuring a well-known footballer and a news reporter to promote a fake investment scheme. Victims were directed to a phishing website designed to harvest personal and financial information by impersonating official UTE communications.
On December 26, 2024, UTE, Uruguay's public utility company, warned of an alleged deepfake video circulating on Instagram, Facebook, and Threads. The video reportedly features manipulated images and voice of footballer Luis Suárez, falsely promoting an investment scheme claiming a 10,400 peso investment could yield 175,000 pesos monthly. It also reportedly uses AI-altered Telemundo footage. UTE urged the public not to share personal data, as the scam links to phishing sites posing as official sources.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
The incident involves the use of AI-generated deepfakes to impersonate a public utility company and a famous footballer to execute a targeted financial scam and phishing campaign.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by human actors who intentionally deployed AI tools to generate deepfakes for a financial scam after the AI models were trained and deployed.
Added categories peak at 2: Minor (Epistemic Harm, Direct)
AI-generated deepfakes of a famous footballer and news reporter were used to impersonate Uruguay's public utility (UTE) in a financial scam. While it represents an evolving threat of digital impersonation, it has minor impact on national security, critical infrastructure, or sovereignty.
The AI system was used to perform a specific, well-defined function of altering digital images and voices to create a deepfake video. It operated on direct input without autonomous planning or decision-making.
Risk Level 3. Limited Risk: The report describes the creation of AI-generated deepfakes. According to the definitions, 'AI-generated content such as deepfakes' falls under Limited Risk, which requires notifying users when they are interacting with such content.
The reports explicitly state that tools of artificial intelligence were used to modify a news broadcast, altering both the image and voice of a footballer to make him appear to endorse a scam.
The reports clearly describe the nature of the scam, the platforms used, the specific public figures targeted, and the technical mechanism (AI-altered video and voice). While the exact AI model used is not specified, the classification of the incident as a deepfake-enabled financial scam is highly unambiguous.
None
Technology
AI Deepfake Generation Tools
AI was used to alter the voice and image of a soccer player and reporter.
Social Media Ad Delivery
Meta platforms allowed rapid distribution of fraudulent short-duration ads.
Malicious Domain Registration
Domain registrars permitted quick setup of deceptive phishing domains.
Data Inputs
Unauthorized Media Harvesting
Scammers used existing videos of the reporter and player to train AI models.
Stolen Corporate Branding
Official logos of UTE and ministries were used to make fake sites look real.
Human Factors
User Susceptibility to Scams
Financial vulnerability makes users trust high-return investment promises.
Trust in Public Figures
Users trusted the deepfaked soccer player and recognized news reporter.
Process and Methods
Weak Ad Review Processes
Meta platforms failed to detect and block deepfake scam ads before airing.
Lack of Domain Verification
No verification process prevented the registration of 'uteinvst.online'.
Management
Inadequate Proactive Monitoring
UTE relied on reactive warnings instead of proactive threat intelligence.
Delayed Ad Takedown Response
Social media platforms were slow to remove active scam advertisements.
Regulatory Environment
Lack of Deepfake Regulations
Insufficient legal framework to prevent or penalize AI identity theft.
Poor Cross-Border Enforcement
Difficult to prosecute actors operating from Ukraine or Latvia.
AI system involved
An AI system was involved, but the reports do not identify it.
Identified by automated extraction; can differ from the alleged developers above.
