We've been deepfaked, the email read. It dropped into my inbox from a colleague, with a link to a low-quality video on Facebook.
I watched as a version of me appeared on screen. But instead of Mickey Carroll, science and tech reporter, I was 'Olivia' who had apparently won 拢500,000 on a mobile game and bought my dream car.
Sadly, neither were true.
In the video, which was watched by at least a quarter of a million people on Facebook, I was talking to an AI-generated version of Sky News presenter Matt Barbet, who spoke in an Australian accent, despite being from North Wales.
The deepfake
The deepfake
"Important news for all iPhone owners," said deepfake Matt. "Apple CEO Tim Cook has unveiled an app that will earn money for anyone who has an iPhone." On the bottom of the screen was a poor imitation of the Sky News breaking news strap, pixelated and in the wrong font.
Deepfake of Sky News presenter Matt Barbet
Deepfake of Sky News presenter Matt Barbet
For several minutes, Matt, myself and a fake version of Apple chief executive Tim Cook tried to convince viewers to download a mobile game called Heavenly Sphere.
Heavenly Sphere, the app we were unknowingly promoting
Heavenly Sphere, the app we were unknowingly promoting
"We contacted Olivia, she's already won 拢500,000 in a week," said 'Matt', his voice dropping out of sync with his lips. "Olivia, how did you manage to win such a large amount?" he asked.
"It's very simple, I downloaded the app and started playing," the deepfake version of myself replied.
THE DEEPFAKE
The video was taken from a chat I'd had with Matt on Sky News a few months ago about a lawsuit Apple was facing. But somewhere in the world, scammers were feeding the conversation into an AI generator, which alters real videos and gives them different scripts, voices or visuals.
"We think these videos were created by editing and merging lip-synced footage mixed with some real news scenes," said Dr Siwei Lyu, a professor at the University of Buffalo and an expert in deepfake technology.
"All three faces in the video are lip-synced using AI models." He pointed out the unnatural way our mouths moved and the way our teeth changed shape.
Sky News presenter Sarah-Jane Mee was also deepfaked
Sky News presenter Sarah-Jane Mee was also deepfaked
A search of Meta's Ad Library, a database showing the active and inactive adverts users have posted on Facebook and Instagram, uncovered thousands more deepfakes.
These featured journalists from newsrooms all over the world, as well as more Sky News faces like presenter Sarah-Jane Mee. The journalists appeared to encourage people to download dozens of similar-looking gaming apps. Meta told us these videos violate its policies and it removes this content when it's found.
Dr Jessica Barker, co-founder of Cygenta
Dr Jessica Barker, co-founder of Cygenta
Facebook users were being targeted by country, using journalists from national news organisations, which Dr Jessica Barker, co-founder of security company Cygenta, said is an "increasing trend".
"We've seen journalists, and broadcasters in particular, being targeted with deepfakes. A trusted voice is more likely to be impersonated."
The fake adverts were distributed by around 36 Facebook accounts and most of the apps they advertised were hosted on Apple's App Store. But installing those apps on a secure device led to a shocking discovery that prompted the UK's Gambling Commission and Apple's law enforcement team to take action.
THE APPS
Empirical Sugar Rabbit described itself as a "delightful candy-filled adventure"
Ankh's Shadows promised "mysterious forces" and a "daring hero"
Plinquo Frostfall invited users to "embark on a thrilling cosmic adventure"
Co-co Road told users they'd "uncover the secrets of the farm"
On the App Store, the apps looked like any other game. They featured cartoon animals and lively descriptions that promised players "a maze full of obstacles, riddles and unexpected encounters" or "a thrilling cosmic adventure". Many of them had a 4+ age rating and made no mention of in-app purchases.
But once you opened them, it was a different story.
One of the illegal casinos the apps took users to
One of the illegal casinos the apps took users to
Instead of child-friendly games, users were taken to the homepages of unlicensed casinos that are banned from operating in the UK. Although some said they were blocked for UK users, many were completely open. There, they could play online slot games and roulette, as well as bet on sporting events. There were no age verification or identity checks, no guarantees that players' money or details would be protected, and they weren't labelled with the required warnings.
When we flagged the problem, the Gambling Commission took immediate action, removing the websites linked to the casinos and contacting Apple to remove the apps. The regulator's chief executive told us he was concerned for people's safety.
"If you're gambling on an illegal casino, there's no protection for you," said Andrew Rhodes, chief executive of the Gambling Commission.
"You don't know where your money is being held, where your financial details have gone. You are vulnerable to something bad happening to you.
"They're illegal for a reason."
Andrew Rhodes, chief executive of the Gambling Commission
Andrew Rhodes, chief executive of the Gambling Commission
According to the Gambling Commission, the casino owners were likely stealing money and financial details from victims and identifying documents that could be used to defraud people. That theory was backed up by reviews left by users of the apps; some reported being asked for photos of their credit cards, photo IDs and utility bills in order to withdraw their winnings.
"Something just doesn't seem right," wrote one user.
According to Rhodes, much of the illegal activity the Gambling Commission uncovers is used to fund organised crime.
"It will be used for money laundering, identity theft and simply to make money."
INSIDE THE CODE
Limbo Hopper Frog in the App Store, with a 4+ age rating
Limbo Hopper Frog in the App Store, with a 4+ age rating
Limbo Hopper Frog before it was switched to a casino
Limbo Hopper Frog before it was switched to a casino
Limbo Hopper Frog after it was switched to a casino
Limbo Hopper Frog after it was switched to a casino
When the apps are submitted to Apple's developers to manually check, they look like simple mobile games and according to a cyber security expert, are likely made using AI.
"It's so easy to generate a game, you just tell the AI, 'I want to create a game with falling bricks, and here are my images'," said Adrianus Warmenhoven, a cybersecurity adviser for NordVPN.
Adrianus Warmenhoven, cybersecurity adviser at NordVPN. Pic: NordPass
Adrianus Warmenhoven, cybersecurity adviser at NordVPN. Pic: NordPass
But Apple told us that hidden within the mobile game is a link to the illegal casino, which its vetting team failed to spot. Once the game was on the App Store, the scammers flipped a switch to ensure it redirected users to the illegal casino.
One of the apps, Limbo Hopper Frog, was switched into a casino while we had it downloaded, meaning we could see the app before and after the switch was made.
It started as a simple cartoon game with jumping frogs and then became a Portuguese-language casino.
Although Apple says its developers catch tens of thousands of fraudulent apps every year, the Gambling Commission said the company has a responsibility to stop these casinos being hosted on its platforms.
"If you are presenting something to consumers, you've got an obligation to make sure it is what it says."
THE APP 'OWNERS'
"This is an unbelievable shock." I was on the phone to Carla, a marketing consultant in Merthyr Tydfil, Wales. She'd been listed as the owner of Heavenly Sphere, the app Matt and I were inadvertently advertising.
"I have no idea what this app is."
On the surface, many of the apps were hosted by legitimate-sounding companies from the UK and the US. Warmenhoven said their credentials were likely used to help the scammers look legitimate to Apple - but the business owners had no idea their names had been used.
Jennifer Viccars, co-founder of MyUnit
Jennifer Viccars, co-founder of MyUnit
"This is horrible," said another small business owner, this time in London. Jennifer Viccars runs MyUnit, a platform that helps residents pay fair utility bills. Her company was now listed as the owner of an app called Ankh's Shadows. On the App Store, users were promised "an Egyptian-themed party" that "turns into a thrilling roguelike adventure like no other". Once downloaded, it took users to an online casino.
"This is the antithesis of the brand values of the space we occupy. We're about making sure that the people who have the least aren't exploited."
"We felt confused and scared," said Angy Rivera, co-executive director of an American youth leadership charity. Her organisation was listed as the owner of a casino app called Plimko Rise, which another Sky journalist was deepfaked into advertising.
"It could put our reputation into question," said Rivera.
Although both Apple and the Gambling Commission have now taken action to tackle these apps, the UK's National Crime Agency is worried. It said our investigation demonstrated AI's potential "to increase the speed, scale and sophistication of scams, allowing offenders to target more victims across international and language barriers".
So what can be done?
"It's important that people are vigilant. If an app is routing you to a site that is different to what was advertised, that's almost certainly criminal."
"It's time to delete [the app] because you don't know who you're dealing with."
The idea that criminals had co-opted my image and taken advantage of Sky News' trusted reputation to promote illegal gambling still unnerves me. Deepfakes are easier than ever to create and I am clearly in someone's AI system - there could be infinite versions of me out there advertising anything and I simply wouldn't know.
But at least in this deepfake reality, I've got a nice car.
