Active Deepfake Fraud Using PM Montenegro's Face Targets Portuguese Residents on YouTube

The Portugal Judicial Police (PJ) has confirmed that AI-generated deepfake videos featuring Prime Minister Luís Montenegro are currently circulating on YouTube as part of an active financial scam targeting Portuguese residents. The fraudulent scheme promises returns of €15,000 per month from initial investments as low as €250, using fake investment platforms like "Quantum AI" and cloned identities of trusted public figures including CNN Portugal anchor Ana Sofia Cardoso and the branding of financial daily ECO.

Immediate Actions: How to Protect Yourself

If you encounter ads or websites promoting "Quantum AI," "Zeyphurs," or similar investment schemes featuring videos of government officials or journalists, do not engage. Here are concrete steps:

Verify sources directly: Contact government ministries or financial regulators using official telephone numbers or websites—never through links in ads or emails.

Check website authenticity: The legitimate ECO address is eco.sapo.pt. Any variation with extra hyphens or misspellings is fraudulent.

Spot obvious deepfake markers: Watch for unnatural eye movements, lip-sync delays, robotic voice quality, or inconsistent lighting on faces in videos.

Use detection tools: Browser extensions like WeVerify and platforms such as Deepware can analyze suspicious video files.

Enable banking safeguards: Most Portugal-based banks now offer real-time beneficiary verification before completing transfers—activate this in your online banking settings.

Report immediately: Flag fraudulent YouTube ads using the platform's ad transparency center and report to the CNCS reporting portal.

How the Scam Operates

The scheme begins with YouTube advertisements purchased under the name "Aliya Baimukhamedova," listed as a business based in Kazakhstan. Clicking the ad redirects users to a near-perfect replica of the ECO newspaper website, complete with identical layout and typography.

Within the fake article sits a deepfake video purportedly showing Luís Montenegro at a press conference. The synthetic Montenegro speaks directly to camera, claiming "98% transaction success rates" and guaranteeing €9,000 per week payouts to anyone depositing €220 initially.

The entire video—facial movements, voice, and background—was generated using AI tools that manipulate existing footage. Investigators traced the CNN segment to a genuine 9 February 2026 broadcast in which anchor Ana Sofia Cardoso interviewed economist António Costa (ECO's director) about the presidential election. AI software altered expressions, audio, and backgrounds to transform political analysis into a fake investment pitch.

After registration with personal details, users are forwarded to a "WebTrader" interface branded Zeyphurs—an entity with no legal registration in Portugal or the European Union. The same server hosting the fake ECO site also advertises unrelated products like an "ergonomic lumbar cushion for €39.90," a telltale sign of multi-purpose scam infrastructure.

Investigation Status and Official Response

Google's response: The tech giant initially declined to disclose advertiser details, citing privacy protections. After escalation, Google confirmed the ad was removed and the account permanently suspended for violating its Misrepresentation Policy. In 2024 alone, Google removed 146.9 million ads and suspended 700,000 advertisers for similar violations.

ECO's legal action: Director António Costa reported that his outlet filed repeated complaints with Meta over Facebook-hosted deepfake scams impersonating the newspaper, receiving no meaningful response. ECO has now instructed legal counsel to file a criminal complaint with the Lisbon District Public Prosecutor's Office (DIAP de Lisboa) against unknown perpetrators, citing reputational harm and intellectual property misuse.

PM's prior complaints: Prime Minister Luís Montenegro has previously filed three to four formal complaints with the PJ over deepfake videos misusing his image and voice. His office has not yet commented on this latest incident.

Broader context: Portugal's deepfake fraud problem is escalating. The PJ confirmed two formal deepfake fraud investigations were opened in 2025, though neither resulted in significant financial damage at disclosure. Globally, deepfake fraud losses surpassed €1.3 billion in 2025, with €860 million stolen in that calendar year alone.

Why This Scam Is Particularly Dangerous

Irreversible financial loss: Cryptocurrency-based schemes use blockchain transactions that are irreversible. Once funds leave a victim's account, recovery is virtually impossible.

Regulatory gaps: While Portuguese banks operating under EU Regulation 2024/886 (in force since October 2025) now offer beneficiary verification before authorizing instant transfers, this safeguard does not extend to crypto wallets or offshore trading platforms.

Cross-border complexity: The advertiser's Kazakhstan address places them beyond immediate reach of Portuguese or EU law enforcement, requiring international cooperation through Europol and bilateral treaties. Domain registrars and payment processors—often offshore—add layers of obfuscation, making asset recovery and prosecution exceedingly difficult.

Regulatory Enforcement and Future Safeguards

The Cybersecurity Legal Framework (Decree-Law No. 125/2025), which came into effect on 3 April 2026, transposing the EU NIS2 Directive, expands mandatory incident reporting to 17 critical sectors. It empowers the National Cybersecurity Centre (CNCS) to levy fines up to €10 million or 2% of global annual revenue against non-compliant entities, signaling regulatory pressure to hold platforms accountable.

The European AI Act, taking full effect in August 2026, will mandate visible watermarks and machine-readable metadata alerting viewers when content is AI-generated or altered. Portugal's updated cybercrime law now includes an "ethical hacker" exemption (Article 8-A), shielding security researchers from prosecution when they responsibly disclose vulnerabilities to system owners and the CNCS.

The Council of Ministers designated cybercrime—including deepfake-enabled fraud—as a priority prevention area following a 13% year-on-year increase in cybercrime reports, with 4,497 complaints filed in 2025 and 949 cases logged by the Safe Internet Hotline.

What Comes Next

The ECO criminal complaint filed with the Lisbon DIAP will test the effectiveness of Portugal's updated cybercrime framework. Prosecutors must establish perpetrator identity—difficult given the cross-border operation—and demonstrate clear intent to defraud.

The Portugal Judicial Police is building capacity in digital forensics through partnerships with private-sector AI labs capable of reverse-engineering deepfake algorithms. The CNCS is developing a national deepfake detection protocol expected operational by Q3 2026, integrating with law enforcement databases and platforms operating in Portuguese jurisdiction.

For residents, the takeaway is clear: verify before trusting. The same AI tools democratizing content creation also empower bad actors to fabricate indistinguishable realities. In an era where seeing is no longer believing, critical thinking and institutional safeguards must work together to protect financial security and public trust.