A Bengaluru retiree lost Rs 6.88 lakh after an AI-generated deepfake Facebook video falsely showed Finance Minister Nirmala Sitharaman endorsing a fake.
Social Engineering Examples·6 sources
Between March and June 2026, a 66-year-old retiree in Bengaluru was defrauded of Rs 6.88 lakh after seeing a Facebook video ad containing an AI-generated deepfake of Indian Finance Minister Nirmala Sitharaman falsely endorsing a government-backed, SBI-linked investment scheme. He clicked through, submitted KYC and personal details on a fake-official site, was then contacted via WhatsApp by a caller using a UK (+44) number, and was persuaded to make escalating transfers on promises of roughly 150% returns within 10 days.
When no returns came and the fraudsters went silent, he filed a complaint; Bengaluru's Northeast Cybercrime Police registered a case against unknown persons. Press reports (published around July 20-22, 2026) note this mirrors an earlier, larger Bengaluru case (a retired professor losing over Rs 61 lakh) using the same deepfake-Sitharaman-video technique, and India's Press Information Bureau has separately issued fact-check alerts confirming such Sitharaman-endorsement investment videos circulating on Facebook are fake and AI-generated.
The victim, a 66-year-old retiree from Narayanapura, Bengaluru, came across a Facebook video ad containing an AI-generated deepfake of Union Finance Minister Nirmala Sitharaman. The manipulated video falsely showed her endorsing a Ministry of Finance-backed investment platform developed in association with the State Bank of India (SBI), claiming it would let ordinary Indians earn reliable supplementary income and warning that only a limited number of participation slots remained (urgency and scarcity framing), with the fake minister urging viewers to register quickly.
The victim clicked the embedded link and submitted his KYC (Know Your Customer) documents and personal/banking details on a site designed to look official. Shortly after, he received a WhatsApp call from a number with the UK country code (+44); the caller claimed the investment was a government initiative being handled on his behalf, building on the false official-endorsement premise from the video.
The caller initially had him invest a smaller amount (around Rs 22,000) before upselling him well beyond that, promising that investing more than Rs 6 lakh would return approximately Rs 15 lakh within 10 days. Believing the fabricated official endorsement and the promised returns, the victim wired a total of Rs 6.88 lakh across multiple bank transfers between March and June 2026. When no returns materialized and the fraudsters stopped responding, he realized he had been defrauded and filed a police complaint.
The lure: an AI-generated deepfake Facebook video appeared to show Finance Minister Nirmala Sitharaman personally endorsing a government-backed, SBI-linked investment scheme promising reliable supplementary income, with scarcity framing (limited slots) urging quick registration. The tell (visible in hindsight, and consistent with PIB Fact Check's standing alerts): no legitimate government investment scheme is advertised via a viral, unsolicited Facebook video featuring a minister's endorsement; official schemes are announced through gazette notifications, ministry/PIB/bank websites and verified press releases, never through third-party KYC-collection links embedded in social video ads.
The follow-up WhatsApp call from a foreign (+44) number claiming to handle the investment on the victim's behalf, and the promise of roughly 150% returns in 10 days, were additional red flags no legitimate government or bank scheme would ever operate this way.
The victim reported the fraud to police; the Bengaluru Northeast Cybercrime Police (North-East Division Cyber Crime, or CEN, police) registered a case (FIR) against unknown persons, and an investigation was underway as of press reports (around July 20-22, 2026). No FIR number, arrests, or fund recovery had been publicly confirmed in the reporting reviewed.
Press coverage also noted a related, larger prior case in Bengaluru in which a retired professor lost more than Rs 61 lakh (with fraudsters reportedly transferring back a small profit to build trust) via a similar deepfake-Sitharaman-video investment scam, indicating a broader ongoing campaign using this impersonation pattern.
This case illustrates how deepfake video of a real, highly recognizable government official can be weaponized as a mass-market investment-fraud lure at low cost, borrowing the authority of a national Finance Minister and a major state bank (SBI) to bypass the skepticism that a generic get-rich-quick ad would trigger. It is part of a documented pattern in India in 2026 (corroborated by PIB Fact Check alerts and at least one other Bengaluru case with far larger losses) showing scam networks systematically reusing synthetic video of the same official across multiple victims via ad platforms like Facebook, then closing the loop with human-operated WhatsApp calls from foreign numbers to build false legitimacy and escalate amounts invested.
It underscores that deepfake fraud is being deployed at consumer and retail scale, not just against corporations, and that official fact-check warnings are struggling to keep pace with ad-driven distribution.
Social Engineering Examples. “Nirmala Sitharaman Deepfake Investment Scam (Bengaluru, 2026)”. Accessed 19 September 2026. https://socialengineeringexamples.com/nirmala-sitharaman-deepfake-investment-scam-bengaluru-2026
The attackers likely sourced publicly available video and audio of Finance Minister Sitharaman from press conferences, broadcast interviews, and government events widely archived on YouTube and news sites, then used commercial or open-source AI face and voice synthesis tools to fabricate a video showing her endorsing a fictitious investment platform, consistent with PIB Fact Check's description of the clip as AI-generated.
Public officials' broadcast footage and speeches are inherently public and cannot practically be locked down as source material; the realistic control sits downstream at distribution (Stage 3) and detection, meaning platform-side synthetic-media screening and public fact-check alerts, rather than trying to prevent source footage from being harvested.
This stage typically involves registering a look-alike KYC-collection website designed to mimic a legitimate government or bank registration portal, opening money-mule bank accounts and UPI IDs to receive victim funds, and acquiring foreign (UK, +44) SIM or VoIP numbers for the follow-up call, patterns consistent with offshore-run fraud networks operating this style of scam.
Banks and payment providers can apply stronger KYC and beneficial-ownership screening to newly opened bank and UPI accounts, and can flag clusters of new accounts and foreign-registered numbers that match known financial-scam calling patterns, though this depends on proactive fraud-operations monitoring rather than any action the eventual victim can take.
The deepfake video was placed as a Facebook video advertisement, using the platform's ad-targeting to reach a broad audience of Indian users (mass targeting) rather than any specific victim, borrowing the Finance Minister's authority and SBI's brand to manufacture legitimacy and urgency through a limited-slots framing.
Ad platforms should run automated deepfake and synthetic-media detection on video ads before they run, especially any ad depicting a named public official, and require verified-advertiser status for financial-services ads; rapid public alerts from bodies like PIB Fact Check are a partial mitigating control at this stage.
The victim clicked the embedded link and was routed to the fake official-looking site, where he submitted KYC documents and personal and banking details, giving the fraud operation both verification material and a live, engaged lead.
Treat any request to submit KYC or banking details tied to a scheme discovered through an unsolicited social-media ad as untrustworthy by default, and verify the scheme only through the actual government, SEBI, RBI, or bank's own website or helpline before submitting anything.
A caller using a UK-country-code number contacted the victim directly, reinforced the false government-initiative framing established by the video, and upsold him from the ad's smaller referenced entry amount to a much larger investment tied to an exaggerated approximately 150% return promise within 10 days.
Independently verify any unsolicited investment-related call, especially from a foreign number, by contacting the purportedly involved institution through an out-of-band channel before acting on anything discussed, and treat guaranteed high, fast returns as an automatic red flag regardless of who appears to endorse them.
The victim wired Rs 6.88 lakh across multiple bank transfers between March and June 2026 to accounts supplied by the fraudsters, consistent with a pattern seen in the related Rs 61 lakh Bengaluru case of directing funds to numerous separate accounts to complicate tracing.
Banks and UPI apps should flag and add friction (delay or step-up verification) to repeated, escalating transfers from an individual account to multiple newly added payees shortly after each payee is added, a pattern strongly associated with investment fraud, and offer customers a rapid transaction-freeze option.
Once funds were extracted, the fraudsters stopped responding to the victim, completing the theft; no returns were paid, and the underlying ad campaign and video asset were left in place to keep converting other victims, consistent with the mass-produced nature of this scam pattern.
Once the fraudsters disengage, there is no upstream control left once funds have left the victim's account; the effective remaining control is speed of reporting, meaning immediate escalation to India's National Cyber Crime Reporting Portal (cybercrime.gov.in) or the 1930 helpline in the hours after Stage 6, which can sometimes freeze funds still sitting in mule accounts.
Browse by what this case has in common with others in the library.
A Singaporean businessman transferred at least S$4.9 million after WhatsApp and email lures citing the Strait of Hormuz crisis drew…
Toronto podcast-analytics company CoHost spent two months and seven interview rounds with a candidate later revealed as an AI-fabricated persona…
An interstate Indian gang used AI-generated "eye-blink" deepfake videos made from stolen social-media photos to fool Aadhaar's facial-liveness e-KYC.
A blogger paid $89.95 to an online data broker (CellTolls.com) to buy retired Gen. Wesley Clark's cell-phone call log obtained…
A Chinese national talked her way past three layers of Mar-a-Lago's Secret Service and club-staff checkpoints using a false pool…
Fraudsters posing as Tecnimont's group CEO, other executives, and a fictitious Swiss lawyer used spoofed emails and a staged series…
Censys researchers used passive DNS to unravel a live USPS/UPS "package awaiting action" smishing operation.
The FBI's 2025 Internet Crime Report introduced its first dedicated AI-fraud tracking category, logging $893 million in losses.
The FTC's first major consumer alert on QR-code scams (Dec 6, 2023) warned of fake QR stickers on parking meters…
Two unencrypted TD Bank backup tapes carrying data on 260,000 customers vanished in transit between Massachusetts offices in 2012.
A suspected Chinese state-sponsored group jailbroke Anthropic's Claude Code by role-playing a "defensive security" pretext and used it to autonomously…
Imperva researcher Yohann Sillam showed that whitespace-padded prompt-injection payloads hidden in WhatsApp contact names, vCard FN fields.
Fraudsters hijacked a WhatsApp account via a malicious ZIP file, swapped in their own number while keeping the real display…
Fraudsters posing as Tecnimont's group CEO, other executives, and a fictitious Swiss lawyer used spoofed emails and a staged series…
A Pune CFO wired Rs 56 lakh after a Microsoft Teams message impersonating her Italian CEO demanded an urgent transfer.
Hours before Maharashtra's 2024 assembly election polling, BJP-amplified audio clips purporting to catch opposition leaders Supriya Sule and Nana Patole.
Social Engineering Examples