{"schema_version":"0.10.0","id":"LR-2026-0349","record_version":1,"title":"Valueleaf deepfake investment scam case","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":43.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.52,"unhedged_language":4.29},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"238b7b602478fe5d49431fb4ab3d65b50be76d5b0ff52969a0139d061068d86a"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2025-12-01","incident_class":"other","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Valueleaf, an Indian ad tech firm, provided advertising access used by a foreign syndicate. Between July 1 and July 18, 2025, AI-generated videos impersonating Indian stock analysts and news anchors were run as paid Facebook and Instagram ads. Victims clicked the ads, were moved to WhatsApp groups, and deposited money they could not withdraw. Meta flagged the advertisements as suspicious after seven days, while the accused expanded from 18 to 38 advertisement accounts. Meta shut these accounts down on July 18, and the campaign continued through a Dubai company. The scam surfaced after a complaint leading to an FIR on September 29. In October 2025 four senior Valueleaf employees were arrested by Mumbai Police.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK19","secondary_risks":["RK03"],"control_chain":[{"layer":"L1","party":"provider","party_name":"Valueleaf","control_id":"D7","outcome":"got_around","reason":null,"quote":"Expanded the advertising footprint deliberately to evade Meta’s checks","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test: many third parties with a stated count of two or more. The source states thousands of Indian retail investors suffered financial losses.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.varindia.com/news/deepfake-investment-scam-analysis-of-the-valueleaf-case","publisher":"varindia","date":"2025-12-01","type":"press","title":"Deepfake Investment Scam: Analysis of the Valueleaf Case - varindia","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"event.adversarial_actor":"C","context.country":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.adversarial_actor":[{"source_index":0,"quote":"Between July 1 and July 18, 2025, a China based cyber fraud syndicate, allegedly operating behind a Hong Kong front company named First Bridge, carried out one of India’s most significant deepfake driven investment scams."}],"context.country":[{"source_index":0,"quote":"The October 2025 arrest of four senior employees from the ad tech firm Valueleaf by the Mumbai Police marks a pivotal moment in India’s ongoing fight against AI enabled financial crime."}],"event.incident_class":[{"source_index":0,"quote":"This case exposed how deepfake technology, combined with structural weaknesses in the digital advertising ecosystem, can be weaponized to execute large scale financial fraud with alarming ease."}],"impact.severity":[{"source_index":0,"quote":"Thousands of Indian retail investors suffered financial losses estimated in crores."}],"impact.severity_because":[{"source_index":0,"quote":"Thousands of Indian retail investors suffered financial losses estimated in crores."}],"event.control_chain":[{"source_index":0,"quote":"Expanded the advertising footprint deliberately to evade Meta’s checks"}],"event.summary":[{"source_index":0,"quote":"This reputation and privileged access became the perfect gateway for a foreign cyber fraud network to infiltrate India’s digital advertising infrastructure."},{"source_index":0,"quote":"Between July 1 and July 18, 2025, a China based cyber fraud syndicate, allegedly operating behind a Hong Kong front company named First Bridge, carried out one of India’s most significant deepfake driven investment scams."},{"source_index":0,"quote":"At the center of the operation were AI generated deepfake videos impersonating well known Indian stock analysts and business news anchors."},{"source_index":0,"quote":"Once victims clicked the ads, they were redirected to WhatsApp groups handled by overseas scammers posing as financial experts."},{"source_index":0,"quote":"Deputy Commissioner of Police Purushottam Karad explained that Meta flagged the advertisements as suspicious after seven days."},{"source_index":0,"quote":"Meta eventually shut down these accounts on July 18, after which the fraudsters continued the campaign through a company in Dubai."},{"source_index":0,"quote":"The scam surfaced after SEBI registered research analyst Prakash Gaba, age 73, filed a complaint leading to an FIR on September 29."},{"source_index":0,"quote":"The October 2025 arrest of four senior employees from the ad tech firm Valueleaf by the Mumbai Police marks a pivotal moment in India’s ongoing fight against AI enabled financial crime."}]},"notes_on_gaps":"Single press source (varindia, 2025-12-01); allegations of the arrested employees and syndicate are reported as allegations, not findings. No single incident date is stated, only the July 1 to July 18, 2025 window, so event.date_occurred is left out. The article date is not a disclosure date, so event.date_disclosed is left out. The FIR sentence gives no year, so no detection date is set. No AI agent is described, so event.agent_involved, failure_class and trigger are left out. Detection method and responsible party are not clearly stated, so they are left out. Losses are stated only in rupees (Rs 3 crore, Rs 1.64 crore, crores), not USD, so direct_loss_usd is left out. The number of affected investors is stated only as thousands, so third_parties_affected_count is left out. Severity major is my judgement based on the stated thousands of affected investors. Incident class other is my judgement, since the closed list has no fraud category. Root cause oversight is my judgement from the press analysis of lenient review. The Meta control entries reflect the press account of Meta's review, which is not independently verified. Country IN is inferred from the Indian police and Indian firm sources. Reversibility and records exposed are not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"IN","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Fraudsters ran AI-generated deepfake videos impersonating Indian stock analysts and business news anchors as paid ads on Facebook and Instagram.","quote":"At the center of the operation were AI generated deepfake videos impersonating well known Indian stock analysts and business news anchors.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"One advertisement account used in the scam belonged to a former Valueleaf employee who had left in 2024, but her access was still active.","quote":"Investigators discovered that one of the advertisement accounts used in the scam belonged to a woman from Assam who had left Valueleaf in 2024, yet her account access was still active.","source_index":0,"grade":"C"},{"step":"caught","text":"The scam surfaced after a complaint by a SEBI-registered analyst led to an FIR on September 29.","quote":"The scam surfaced after SEBI registered research analyst Prakash Gaba, age 73, filed a complaint leading to an FIR on September 29.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.varindia.com/news/deepfake-investment-scam-analysis-of-the-valueleaf-case"]},"analysis":{"sections":{"timeline":[{"text":"Fraud campaign runs using deepfake ads.","quote":"Between July 1 and July 18, 2025, a China based cyber fraud syndicate, allegedly operating behind a Hong Kong front company named First Bridge, carried out one of India’s most significant deepfake driven investment scams.","source_index":0,"when":"Between July 1 and July 18, 2025"},{"text":"Meta flags the advertisements as suspicious, seven days into the campaign.","quote":"Deputy Commissioner of Police Purushottam Karad explained that Meta flagged the advertisements as suspicious after seven days.","source_index":0,"when":null},{"text":"Accused expand from 18 to 38 advertisement accounts.","quote":"In response, the accused expanded their operations from 18 advertisement accounts to 38 in an attempt to outrun detection.","source_index":0,"when":null},{"text":"Meta shuts down these accounts; the campaign continues through a Dubai company.","quote":"Meta eventually shut down these accounts on July 18, after which the fraudsters continued the campaign through a company in Dubai.","source_index":0,"when":"July 18"},{"text":"Complaint filed, leading to an FIR.","quote":"The scam surfaced after SEBI registered research analyst Prakash Gaba, age 73, filed a complaint leading to an FIR on September 29.","source_index":0,"when":"September 29"},{"text":"Four senior Valueleaf employees arrested by Mumbai Police.","quote":"The October 2025 arrest of four senior employees from the ad tech firm Valueleaf by the Mumbai Police marks a pivotal moment in India’s ongoing fight against AI enabled financial crime.","source_index":0,"when":"October 2025"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.varindia.com/news/deepfake-investment-scam-analysis-of-the-valueleaf-case"]}}