Valueleaf deepfake investment scam case
Preliminary Why: Publisher not yet named · subject to change
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity major: Test: many third parties with a stated count of two or more. The source states thousands of Indian retail investors suffered financial losses.
Valueleaf, an Indian ad tech firm, provided advertising access used by a foreign syndicate. Between July 1 and July 18, 2025, AI-generated videos impersonating Indian stock analysts and news anchors were run as paid Facebook and Instagram ads. Victims clicked the ads, were moved to WhatsApp groups, and deposited money they could not withdraw. Meta flagged the advertisements as suspicious after seven days, while the accused expanded from 18 to 38 advertisement accounts. Meta shut these accounts down on July 18, and the campaign continued through a Dubai company. The scam surfaced after a complaint leading to an FIR on September 29. In October 2025 four senior Valueleaf employees were arrested by Mumbai Police.
What happened
What was done
No source states an action or fix.
Risks
Read from the sources; not yet reviewed by a person.
Controls
ModelNot effective (bypassed) Abuse monitoring and account enforcement
Control failure chain
L1 · ModelProvider not namedModel provider
Model version not linked to a model card.
Other controls for this risk at this layer, not mentioned in the sources: Marking machine-made output, Content safety classifiers.
L2 · HarnessHarness not namedAgent framework vendor
No source mentions a control at this layer.
L3 · ApplicationDeployer not namedDeployer
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: People told they are dealing with AI.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Phishing and fraud filters.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Abuse monitoring and account enforcement | L1 Model | Not effective (bypassed) |
| Content safety classifiers | L1 Model | Not stated in sources |
| Marking machine-made output | L1 Model | Not stated in sources |
| People told they are dealing with AI | L3 Application | Not stated in sources |
| Phishing and fraud filters | L4 Infrastructure / target | Not stated in sources |
Evidence
No source states: what it reached or did, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 6 items from the primary sources
What happened, in order
- Between July 1 and July 18, 2025 Fraud campaign runs using deepfake ads.
- July 18 Meta shuts down these accounts; the campaign continues through a Dubai company.
- September 29 Complaint filed, leading to an FIR.
- October 2025 Four senior Valueleaf employees arrested by Mumbai Police.
Not dated in the sources:
- Meta flags the advertisements as suspicious, seven days into the campaign.
- Accused expand from 18 to 38 advertisement accounts.
Show every field, with its source and grade
What happened
Impact
Context
Notes on gaps
The Meta control entries reflect the press account of Meta's review, which is not independently verified.
LR-2026-0349 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON