Operation “False Witness”: Fake recovery service impersonating authorities
OpenAI banned accounts that very likely originated in Cambodia and used AI to pose as recovery services, law firms, and authorities targeting people affected by fraud.
This case study was originally published in OpenAI’s February 2026(opens in a new window) report on disrupting malicious uses of AI.
Actor
We banned a cluster of ChatGPT accounts using our models to pose as fictitious law firms, as well as impersonate real attorneys and U.S. law enforcement, in a recovery scam targeting fraud victims. This activity very likely originated in Cambodia and aligns with recent public reporting on Chinese-led criminal scam operations in the country.
Behavior
The accounts used ChatGPT to support a fraudulent scam losses recovery operation built around fake law firms and the impersonation of trusted entities, such as real attorneys and the FBI’s Internet Crime Complaint Center (IC3.)
1. Ping: The scammers used ChatGPT to create content that purported to come from at least six fake law firms. Some of this content was then posted by social media accounts and online ads that promoted fictitious scam recovery services. Multiple open-source indicators suggested the firms were fraudulent, including no evidence of state bar licensing, the use of incongruous web domains, contact information at street addresses that do not appear to exist, and directions to contact lawyers via messaging apps.
The scammers used our models to generate social media content promoting fake scam recovery services.
2. Zing: The scammers attempted to gain their targets’ trust by generating comments that tried to emulate the tone and professionalism of attorneys specialized in helping scam victims recover financial losses. They generated content that purported to come from lawyer personas. We identified some of these personas on a range of websites, where their profile pictures were apparently lifted from social media or generated with AI. In some cases, the scammer reused the same “attorney” identities across multiple supposed law firms. One of the websites that we identified posed as IC3.
The contact details published on these various scam websites directed visitors to private messaging apps, such as Telegram. In messages to targets drafted using ChatGPT, the scammers falsely claimed to be operating under the supervision of the International Criminal Court and said no fees would be charged until all of a victim’s funds were successfully recovered
3. Sting: The scammers attempted to extract money from targets by requesting fees and deposits in advance of any “recovery”. This included directing targets to pay a 15% “service fee” before receiving purportedly recovered funds, requesting deposits to activate an account, and charging “consultation fees”. Scammer messages to their targets drafted using ChatGPT included instructions to send cryptocurrency payments and provide screenshots of transaction confirmations as proof of payment.
A website impersonating the FBI’s IC3 unit and linked to this scam. Clicking “file a complaint” directed visitors to an impersonation Telegram account.
Completion
The operation used our models to support multiple parts of its workflow, such as generating promotional content for social media and cold outreach messages to targets. However, the scammers most commonly used ChatGPT to translate messages to and from targets on private messaging apps, including requests to write a reply in “American English” or in the style of a lawyer.
A subset of scam accounts also used our models to create deceptive materials intended to bolster credibility. This included fake attorney registration records and fake bar association membership cards, as well as bogus confidentiality agreements to discourage victims from seeking outside help.
A fake New York State Bar Association membership card generated using our models. Redactions by OpenAI investigators.
Impact
Assessing impact requires care because a primary source of evidence is the scammers’ own inputs. Those inputs suggest the scammers may have defrauded individual victims out of thousands of dollars, but we cannot independently verify those claims. The FBI and at least one impersonated law firm have issued public alerts about this scam. FBI officials warned that the operation targets vulnerable audiences, particularly the elderly, exploiting scam victims’ emotional state and desire to quickly recover lost funds.
OpenAI’s policies strictly prohibit using output from our tools for fraud or scams, and we are dedicated to collaborating with industry peers and authorities to understand how AI is influencing adversarial behavior and to actively disrupt scam activity abusing our services.