{"id":54025,"date":"2025-08-04T10:52:37","date_gmt":"2025-08-04T14:52:37","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=54025"},"modified":"2025-08-04T11:03:53","modified_gmt":"2025-08-04T15:03:53","slug":"scam-with-deepfakes-in-instagram-facebook-whatsapp","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/scam-with-deepfakes-in-instagram-facebook-whatsapp\/54025\/","title":{"rendered":"How Meta’s social networks became a platform for investment scams"},"content":{"rendered":"

X (formerly Twitter) has long had a solid reputation as a primary source of crypto scams<\/a>, which are often promoted on the social network by compromised or fake accounts of celebrities or major companies. Meanwhile, Meta\u2019s ubiquitous platforms \u2014 Instagram, Facebook, and WhatsApp \u2014 are earning a similar reputation in a different category: investment fraud involving deepfakes.<\/p>\n

Criminals are eagerly exploiting AI tools to create fake videos of prominent figures in the financial sector \u2014 from famous economists and TV hosts to heads of government. Attackers then promote these videos by placing ads on social media. In this post, we explain how these schemes work, how victims are duped after watching these videos, the role WhatsApp plays in the schemes, and how you can avoid falling for them.<\/p>\n

Instagram, deepfakes, and WhatsApp: investment scams in Canada<\/h2>\n

To understand how these scams work, we\u2019ll start with a recent campaign that targeted customers of Canadian banks. Attackers began by running Instagram ads in the name of BMO Belski<\/a>.<\/p>\n

The abbreviation BMO was a deliberate choice; Canadian users consistently associate it with the country\u2019s oldest bank, the Bank of Montreal<\/a>. The mention of the Belski surname was no accident either: Brian Belski is BMO\u2019s chief investment strategist<\/a> and head of the bank\u2019s investment strategy team.<\/p>\n

The BMO Belski ads showed AI-generated deepfake videos of Belski himself promising users the chance to join a private investment group on WhatsApp. The criminals\u2019 strategy was to dupe unsuspecting Canadian users into believing they\u2019re getting trustworthy financial and investment advice from a recognized expert. The users would then rush to chat with the scammers through WhatsApp.<\/p>\n

\"Instagram<\/a>

This is what an Instagram ad for a fraudulent investment club with a deepfake Brian Belski looks like: users are encouraged to join a private group on WhatsApp. Source<\/a><\/p><\/div>\n

A curious detail: the BMO Belski account that ran these ads on Instagram had no profile on that social media platform at all. The ads ran through BMO Belski\u2019s Facebook page. Meta, the company that owns both social networks, lets advertisers run Instagram ads from a Facebook business page, thus eliminating the need to create a separate Instagram account.<\/p>\n

It\u2019s also interesting that the Facebook page used to promote the fraudulent ads had existed since October 27, 2023, and was previously titled \u201cBrentlinger Matt Blumm\u201d \u2014 whatever or whoever that may be. The scammers likely used a pre-made or previously stolen account that was \u201cmarinated\u201d for a few years to avoid suspicion and bypass moderation.<\/p>\n

\"Ads<\/a>

The ad with the Brian Belski deepfake was launched on Instagram, but on behalf of a Facebook page. Meta allows promoting ads on Instagram even if the advertiser doesn\u2019t have an account there. Source<\/a><\/p><\/div>\n

Researchers don\u2019t know exactly what went on in the WhatsApp private investment chats promoted by the deepfake. There\u2019s also no information about victims of the ad featuring the fake banker, or the amount of their losses. However, other cases involving similar schemes, which we discuss later in this post, give us an idea of how this could\u2019ve looked.<\/p>\n

Scammers impersonate Financial Times\u2019 chief economics commentator<\/h2>\n

Several months ago in the UK, scammers employed a similar scheme, which featured a deepfake of Martin Wolf, the chief economics commentator for the Financial Times<\/a>. Similarly to the Canadian bank scam, the fraudsters disseminated ads on Instagram that showed a fake Martin Wolf inviting people to join his WhatsApp group for investment advice.<\/p>\n

A former colleague of Wolf\u2019s first alerted the journalist to the ad<\/a> in March 2025. Once alerted, Wolf started pushing Meta to block the ads because they violated several of the platform\u2019s own advertising policies. After some back-and-forth with Meta, the journalist managed to get one of the fraudulent ads taken down. However, Wolf soon began receiving links to other similar videos.<\/p>\n

\"Example<\/a>

An example of an investment deepfake video of the Financial Times journalist, which scammers advertised on Instagram. Source <\/a><\/p><\/div>\n

A subsequent investigation by the journalist\u2019s colleagues at the Financial Times showed that the scam campaign included at least three different deepfake videos and several digitally manipulated images of Martin Wolf. These materials appeared in more than 1700 ads across Facebook and Instagram.<\/p>\n

According to data from the Meta Ad Library, these ads reached more than 970\u00a0000 users in EU countries alone (excluding the UK), where legislation requires platforms to disclose such information. At least ten accounts ran the campaign, with new profiles joining the game as soon as the previous ones were blocked.<\/p>\n

\"The<\/a>

In just six weeks, a fraudulent advertising campaign featuring a deepfake of a Financial Times journalist reached nearly a million users in the EU alone. Source<\/a><\/p><\/div>\n

The most shocking part? All of this occurred even though Martin Wolf was enrolled in Meta\u2019s new face recognition system<\/a>, which is specifically designed to automatically detect and remove this kind of content. The journalist himself questions why an organization as large as Meta, with plenty of resources and AI-powered tools, is unable to detect and block such schemes \u2014 if not fully automatically, then at least after direct notifications. Is it really that difficult?<\/p>\n

What goes on inside WhatsApp scam chats: a British victim\u2019s story<\/h2>\n

A British office manager named Sarah shared what happens inside \u201cexclusive communities\u201d on WhatsApp after she became a victim of scammers. She joined a WhatsApp group after watching an Instagram ad that featured Peter Hargreaves<\/a>, the co-founder of the UK\u2019s largest investment platform, Hargreaves Lansdown. You guessed it: the video was also a deepfake.<\/p>\n

After Sarah gave the scammers her number<\/a>, they contacted her and sent her an invitation to the WhatsApp group. Following that, they sent a link to download a supposed investment app to her smartphone. Sarah was told a \u201cmentor\u201d would assist her by telling her when and at what price to buy and sell assets to lock in a profit.<\/p>\n

Initially, Sarah invested \u00a350, but she soon began putting more and more of her savings into assets recommended in the WhatsApp group. Sarah believed she was investing in small, growing companies and quickly earning a profit. In just two weeks, her account showed about \u00a3300 in profits on a total investment of about \u00a32 000.<\/p>\n

Problems only began several weeks later when Sarah wanted to transfer the profit to her bank account. She started receiving requests to pay taxes, withdrawal fees, and regulatory fees. She continued to pay, convinced that she\u2019d soon get her money back with a large profit.<\/p>\n

When Sarah suspected a scam, it was already too late: all the money was gone. The WhatsApp group disappeared, her \u201cmentor\u201d stopped responding, and the investment app quit working. Along with the app, the \u00a34000 she had invested and all of her supposed profits vanished.<\/p>\n

More than 600 advertisements featuring deepfakes of Peter Hargreaves were found on the Meta platform. One of these ads led Sarah into the hands of scammers. Twenty-two fraudulent accounts placed the ads, and Hargreaves Lansdown<\/a> had them removed in May of this year after filing a trademark infringement complaint.<\/p>\n

To lure victims, the scammers also deployed deepfakes of other British financial celebrities besides Peter Hargreaves and Martin Wolf. These included Anthony Bolton<\/a>, a former Fidelity International fund manager, and Stephanie Flanders<\/a>, a former JP Morgan Asset Management economist.<\/p>\n

From The Wolf of Wall Street<\/em> to WhatsApp groups: how deepfake pump-and-dump schemes work<\/h2>\n

Malicious actors also employ deepfake videos in Facebook and Instagram ads to carry out another type of investment scam known as pump and dump<\/a>. This scheme involves genuine financial assets \u2014 not fictional tokens in a fake application. The catch is that criminals buy up cheap, unattractive stocks to inflate their price. They then launch an aggressive advertising campaign on social media urging users to invest and promising rapid returns.<\/p>\n

Due to the heightened interest, the stock price continues to rise for a time, and more people invest with hopes of easy profit. Once the value peaks, the scammers quickly sell off their shares and disappear with the earnings. After that, the price plummets, and everyone else is left with almost worthless stock.<\/p>\n

A similar scheme existed long before the widespread adoption of deepfakes. One of the most famous examples of its execution was the work of Jordan Belfort<\/a>, the inspiration for the main character in the movie The Wolf of Wall Street<\/em>. In the early 1990s, his brokerage firm sold cheap, little-known stocks to clients, artificially inflating demand for them before dumping them at an inflated price.<\/p>\n

Whereas stock market scammers in the past relied on their own asserted authority to convince victims to purchase dubious stocks, deepfake technology now allows them to exploit the reputations of experts and well-known figures.<\/p>\n

For example, a scheme was recently uncovered in Israel where bad actors artificially inflated the stock price<\/a> of Ostin Technology Group Co. Ltd. (OST). To do this, they circulated deepfake videos featuring business journalist Guy Rolnik<\/a>, entrepreneur Eyal Waldman<\/a>, and businesswoman Shari Arison<\/a>. The scammers also impersonated reputable financial institutions, including the Tel Aviv Stock Exchange<\/a>, the Israel Securities Authority<\/a>, Bank Hapoalim<\/a>, and Israel Discount Bank<\/a>.<\/p>\n

The fraudsters distributed fake promotional videos on Facebook and Instagram and, as in the previous scheme, invited users to join WhatsApp groups, where they provided them with advice on how to purchase OST stock. It didn\u2019t take much persuading; a quick Google search confirmed that OST stock was, in fact, on the rise.<\/p>\n

\"How<\/a>

Rise and fall: Ostin Technology Group stock grew multiple times over, and then collapsed by 95% \u2014 after a scam campaign with deepfakes and investment chats in Israel. Source<\/a><\/p><\/div>\n

Over several weeks, the company\u2019s stock rose multiple times, reaching US$9.02 at its peak, after which it collapsed by 93%, with the stock price falling to 13 cents. In the two most serious cases, two victims lost 250\u00a0000 and 150\u00a0000 shekels (about US$75\u00a0000 and US$45\u00a0000), respectively.<\/p>\n

Meta can\u2019t protect users from deepfakes: a story from Australia<\/h2>\n

Scam ads that targeted Australian Facebook and Instagram audiences employed deepfake videos<\/a> of several well-known personalities to promote fraudulent investment schemes. These videos featured TV host and financial journalist David Koch<\/a>, billionaire Gina Rinehart<\/a>, conservationist and TV host Robert Irwin<\/a>, and even Australia\u2019s current prime minister, Anthony Albanese<\/a>.<\/p>\n

\"Fake<\/a>

In a fraudulent ad on Facebook, a deepfake of the Australian prime minister advertises investments Source<\/a><\/p><\/div>\n

In a deepfake video, Anthony Albanese enthusiastically advertised<\/a> an investment program that promised significant returns for minimal outlay. The links within the deepfake videos of him and the other personalities directed viewers to a fake news story. The article included what appeared to be quotes from famous Australian public figures to support investments in cryptocurrencies, or other get-rich-quick schemes. Facebook users were asked to sign up for the program, after which scammers would contact them to convince them to deposit money.<\/p>\n

In response to user complaints about fraudulent ads, Facebook sent out the following boilerplate message:<\/p>\n

\u201cWe didn\u2019t remove the ad. Thanks again for your report. This information helps us improve the integrity and relevance of advertising on Facebook. [\u2026]<\/em><\/p>\n

We understand this might be frustrating, so we recommend influencing the ads you see by hiding ads and changing your ad preferences\u201d.<\/em><\/p>\n

\"The<\/a>

The message suggests that Meta isn\u2019t particularly eager to combat fraudulent advertising \u2014 even when users try to assist the company. Source<\/a><\/p><\/div>\n

In short, Meta\u2019s efforts to fight deepfakes and investment scams on its platforms remain inadequate. Even with its plentiful resources and AI-powered tools, the company is unable to quickly detect and block obviously fake videos that exploit the likeness of public figures.<\/p>\n

These ads appear daily in users\u2019 feeds as paid promotions from fake yet seemingly legitimate accounts. This means that Facebook and Instagram ultimately profit from their being spread.<\/p>\n

How to avoid falling victim to deepfake ads on Instagram and Facebook<\/h2>\n

To avoid suffering from questionable and outright fraudulent investment advice, our primary recommendation is not to make financial decisions based on information from Instagram or Facebook. In addition to that:<\/p>\n