Deepfake Scams Target Bulgarian President and Prime Minister in Online Fraud Campaign

An international network of online scammers is circulating manipulated advertisements and videos featuring the images of Bulgaria’s President and Prime Minister on social media.

The ads direct users to platforms that request personal and financial information, as well as money transfers. This is the latest example of financial exploitation using artificial intelligence. To date, no perpetrators of such scams have been publicly identified in Bulgaria.

According to a recent Reuters investigation, at least 10% of the revenue of one social media platform comes from advertisements for online scams.

In one deepfake video, the President appears to say: “Each of you now has the chance to earn an annual income of BGN 55,152. All you need is to take the first step.”

The video promotes an investment platform claiming that paying BGN 450 weekly will generate thousands in returns. Another advertisement by the same authors uses the image of Prime Minister Rosen Zhelyazkov. In a fake interview with BNT reporter Ivo Nikodimov, it is suggested that a new programme from the Bulgarian National Bank can generate passive income of BGN 6,000 per month, for an upfront payment of BGN 500.

How can users identify such scams?

“These campaigns are not completely amateurish; effort has been made to create a website that mimics a Bulgarian media outlet. The first thing you notice is that the page’s address is, to put it mildly, suspicious. It is not a Bulgarian domain, it is not that media outlet’s official site, and at this point it should be clear it is not a genuine publication,” explained Todor Kiryakov, a media researcher.

Other warning signs include non-functional buttons and links leading only to contact forms, traces of machine translation — including remnants of Russian in the text — and substandard audio. Images of supposedly satisfied users are also misleading; checking the platform’s HTML code shows that names differ — for example, “Victoria” is actually “Isabella.” Reverse image searches reveal that the photos are stock images.

“These fake testimonials from fictitious characters with invented biographies, presented as ordinary people — nurses from Varna, engineers from Stara Zagora — show that the scam is designed to appeal to as many people as possible,” Kiryakov added.

Cyber experts from the Ministry of Interior will investigate who is behind the fake platform. Research also showed that the scammers targeted audiences in North Macedonia. Alerts regarding the fraud have been submitted to both the Presidency and the Council of Ministers, both of which confirmed that this is a scam and have notified the authorities.