A Bengaluru retiree lost Rs 6.88 lakh after an AI-generated deepfake Facebook video falsely showed the finance minister endorsing a fake SBI/Finance-Ministry-linked investment scheme, with WhatsApp callers from a UK number then upselling him into repeated transfers.
Social Engineering Examples·6 sources
Between March and June 2026, a 66-year-old retiree in Bengaluru was defrauded of Rs 6.88 lakh after seeing a Facebook video ad containing an AI-generated deepfake of India's finance minister falsely endorsing a government-backed, SBI-linked investment scheme. He clicked through, submitted KYC and personal details on a fake-official site, was then contacted via WhatsApp by a caller using a UK (+44) number, and was persuaded to make escalating transfers on promises of roughly 150% returns within 10 days. When no returns came and the fraudsters went silent, he filed a complaint; Bengaluru's Northeast Cybercrime Police registered a case against unknown persons. Press reports (published around July 20-22, 2026) note this mirrors an earlier, larger Bengaluru case (a retired professor losing over Rs 61 lakh) using the same deepfake-video technique, and India's Press Information Bureau has separately issued fact-check alerts confirming such investment videos falsely depicting the finance minister circulating on Facebook are fake and AI-generated.
The victim, a 66-year-old retiree from Narayanapura, Bengaluru, came across a Facebook video ad containing an AI-generated deepfake of India's finance minister. The manipulated video falsely showed her endorsing a Ministry of Finance-backed investment platform developed in association with the State Bank of India (SBI), claiming it would let ordinary Indians earn reliable supplementary income and warning that only a limited number of participation slots remained (urgency and scarcity framing), with the fake minister urging viewers to register quickly. The victim clicked the embedded link and submitted his KYC (Know Your Customer) documents and personal/banking details on a site designed to look official. Shortly after, he received a WhatsApp call from a number with the UK country code (+44); the caller claimed the investment was a government initiative being handled on his behalf, building on the false official-endorsement premise from the video. The caller initially had him invest a smaller amount (around Rs 22,000) before upselling him well beyond that, promising that investing more than Rs 6 lakh would return approximately Rs 15 lakh within 10 days. Believing the fabricated official endorsement and the promised returns, the victim wired a total of Rs 6.88 lakh across multiple bank transfers between March and June 2026. When no returns materialized and the fraudsters stopped responding, he realized he had been defrauded and filed a police complaint.
The lure: an AI-generated deepfake Facebook video appeared to show the finance minister personally endorsing a government-backed, SBI-linked investment scheme promising reliable supplementary income, with scarcity framing (limited slots) urging quick registration. The tell (visible in hindsight, and consistent with PIB Fact Check's standing alerts): no legitimate government investment scheme is advertised via a viral, unsolicited Facebook video featuring a minister's endorsement; official schemes are announced through gazette notifications, ministry/PIB/bank websites and verified press releases, never through third-party KYC-collection links embedded in social video ads. The follow-up WhatsApp call from a foreign (+44) number claiming to handle the investment on the victim's behalf, and the promise of roughly 150% returns in 10 days, were additional red flags no legitimate government or bank scheme would ever operate this way.
The victim reported the fraud to police; the Bengaluru Northeast Cybercrime Police (North-East Division Cyber Crime, or CEN, police) registered a case (FIR) against unknown persons, and an investigation was underway as of press reports (around July 20-22, 2026). No FIR number, arrests, or fund recovery had been publicly confirmed in the reporting reviewed. Press coverage also noted a related, larger prior case in Bengaluru in which a retired professor lost more than Rs 61 lakh (with fraudsters reportedly transferring back a small profit to build trust) via a similar deepfake-video investment scam, indicating a broader ongoing campaign using this impersonation pattern.
This case illustrates how deepfake video of a real, highly recognizable government official can be weaponized as a mass-market investment-fraud lure at low cost, borrowing the authority of a national Finance Minister and a major state bank (SBI) to bypass the skepticism that a generic get-rich-quick ad would trigger. It is part of a documented pattern in India in 2026 (corroborated by PIB Fact Check alerts and at least one other Bengaluru case with far larger losses) showing scam networks systematically reusing synthetic video of the same official across multiple victims via ad platforms like Facebook, then closing the loop with human-operated WhatsApp calls from foreign numbers to build false legitimacy and escalate amounts invested. It underscores that deepfake fraud is being deployed at consumer and retail scale, not just against corporations, and that official fact-check warnings are struggling to keep pace with ad-driven distribution.
Treat any celebrity- or official-endorsed investment video as fake by default, especially when found via unsolicited social media ads rather than official channels. Verify investment schemes directly through official government, SEBI, RBI, or bank websites and helplines, not links embedded in videos. Be skeptical of any government-backed scheme requiring KYC submission on a third-party site before any legitimate registration exists. Guaranteed high, fast returns, for example roughly 150 percent in 10 days, are a hard red flag regardless of who appears to endorse them. Treat unsolicited WhatsApp calls from foreign numbers (+44 and similar) directing financial decisions as a trigger for independent verification before any transfer. Check PIB Fact Check and RBI/SEBI alerts, which routinely publish fake-endorsement warnings, before investing off a viral video. Banks and UPI apps should flag repeated, escalating transfers to newly added payees following a social-media-sourced investment as a fraud pattern. Report to India's National Cyber Crime Reporting Portal (cybercrime.gov.in) or the 1930 helpline immediately to attempt a transaction freeze.
Social Engineering Examples. “Finance Minister Deepfake Investment Scam (Bengaluru, 2026)”. Accessed 22 October 2026. https://socialengineeringexamples.com/finance-minister-deepfake-investment-scam-bengaluru-2026
The attackers likely sourced publicly available video and audio of the finance minister from press conferences, broadcast interviews, and government events widely archived on YouTube and news sites, then used commercial or open-source AI face and voice synthesis tools to fabricate a video showing her endorsing a fictitious investment platform, consistent with PIB Fact Check's description of the clip as AI-generated.
Public officials' broadcast footage and speeches are inherently public and cannot practically be locked down as source material; the realistic control sits downstream at distribution (Stage 3) and detection, meaning platform-side synthetic-media screening and public fact-check alerts, rather than trying to prevent source footage from being harvested.
This stage typically involves registering a look-alike KYC-collection website designed to mimic a legitimate government or bank registration portal, opening money-mule bank accounts and UPI IDs to receive victim funds, and acquiring foreign (UK, +44) SIM or VoIP numbers for the follow-up call, patterns consistent with offshore-run fraud networks operating this style of scam.
Banks and payment providers can apply stronger KYC and beneficial-ownership screening to newly opened bank and UPI accounts, and can flag clusters of new accounts and foreign-registered numbers that match known financial-scam calling patterns, though this depends on proactive fraud-operations monitoring rather than any action the eventual victim can take.
The deepfake video was placed as a Facebook video advertisement, using the platform's ad-targeting to reach a broad audience of Indian users (mass targeting) rather than any specific victim, borrowing the Finance Minister's authority and SBI's brand to manufacture legitimacy and urgency through a limited-slots framing.
Ad platforms should run automated deepfake and synthetic-media detection on video ads before they run, especially any ad depicting a named public official, and require verified-advertiser status for financial-services ads; rapid public alerts from bodies like PIB Fact Check are a partial mitigating control at this stage.
The victim clicked the embedded link and was routed to the fake official-looking site, where he submitted KYC documents and personal and banking details, giving the fraud operation both verification material and a live, engaged lead.
Treat any request to submit KYC or banking details tied to a scheme discovered through an unsolicited social-media ad as untrustworthy by default, and verify the scheme only through the actual government, SEBI, RBI, or bank's own website or helpline before submitting anything.
A caller using a UK-country-code number contacted the victim directly, reinforced the false government-initiative framing established by the video, and upsold him from the ad's smaller referenced entry amount to a much larger investment tied to an exaggerated approximately 150% return promise within 10 days.
Independently verify any unsolicited investment-related call, especially from a foreign number, by contacting the purportedly involved institution through an out-of-band channel before acting on anything discussed, and treat guaranteed high, fast returns as an automatic red flag regardless of who appears to endorse them.
The victim wired Rs 6.88 lakh across multiple bank transfers between March and June 2026 to accounts supplied by the fraudsters, consistent with a pattern seen in the related Rs 61 lakh Bengaluru case of directing funds to numerous separate accounts to complicate tracing.
Banks and UPI apps should flag and add friction (delay or step-up verification) to repeated, escalating transfers from an individual account to multiple newly added payees shortly after each payee is added, a pattern strongly associated with investment fraud, and offer customers a rapid transaction-freeze option.
Once funds were extracted, the fraudsters stopped responding to the victim, completing the theft; no returns were paid, and the underlying ad campaign and video asset were left in place to keep converting other victims, consistent with the mass-produced nature of this scam pattern.
Once the fraudsters disengage, there is no upstream control left once funds have left the victim's account; the effective remaining control is speed of reporting, meaning immediate escalation to India's National Cyber Crime Reporting Portal (cybercrime.gov.in) or the 1930 helpline in the hours after Stage 6, which can sometimes freeze funds still sitting in mule accounts.
Browse by what this case has in common with others in the library.
A Singaporean businessman transferred at least S$4.9 million after WhatsApp and email lures citing the Strait of Hormuz crisis drew…
According to its CEO, Toronto podcast-analytics company CoHost spent two months and seven interviews with a candidate it later suspected…
Ahmedabad police alleged that an interstate gang used AI-generated "eye-blink" deepfake videos made from stolen social-media photos to fool Aadhaar…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
Fraudsters posing as Tecnimont's group CEO, other executives, and a fictitious Swiss lawyer used spoofed emails and a staged series…
The CEO of a UK energy firm was tricked into wiring €220,000 (~$243,000) to a Hungarian account in March 2019…
iSpoof was a UK-run, Bitcoin-paid website that let fraudsters display a real bank's number and capture the codes victims keyed…
A Brighton-area kitchen fitter lost roughly £76,000, including four loans he was pressured into taking out, after a Facebook ad…
Russian GRU-linked Forest Blizzard (APT28/Fancy Bear) used OpenAI's GPT-4-family LLM services to research satellite communication protocols and radar.
A smishing text and a follow-up call from a fake IT colleague talked a Retool employee out of two one-time…
A spoofed-email scheme impersonating MacEwan University's trusted general contractor, Clark Builders, tricked staff into redirecting $11.8 million CAD in construction…
Fraudsters hijacked a WhatsApp account via a malicious ZIP file, swapped in their own number while keeping the real display…
A Pune CFO wired Rs 56 lakh after a Microsoft Teams message impersonating her Italian CEO's name and photo demanded…
Fraudsters posing as Tecnimont's group CEO, other executives, and a fictitious Swiss lawyer used spoofed emails and a staged series…
Hours before Maharashtra's 2024 assembly election polling, BJP-amplified audio clips purporting to catch two opposition leaders discussing a bitcoin-funded election…
AT&T Cybersecurity's MTDR SOC documented a client quishing case in which a PDF impersonating a Microsoft MFA-setup notice, hiding a…
CVS pharmacies nationwide tossed pill bottles, prescriptions, and employee SSNs into unsecured public dumpsters; media exposure across a dozen-plus cities…
A victim searching for the AnyDesk remote-access tool hit a typosquatted site with a fake Cloudflare Turnstile that, instead of…
A fraudster impersonating the company's chief executive tricked a Pivotal employee into emailing back affected employees' W-2 tax data.
Spoofed emails impersonating Medidata's president, backed by a fake "lawyer" caller, tricked finance staff into wiring $4.8M to an overseas…
A spoofed-email scheme impersonating MacEwan University's trusted general contractor, Clark Builders, tricked staff into redirecting $11.8 million CAD in construction…