AI failures · Fabricated content

EY Canada — Loyalty-Fraud Report Withdrawn After GPTZero Finds Most References Hallucinated

Verified Checked against its sources on October 16, 2026 4 sources quoted

Where it happened: Canada
Organization: EY Canada
Date: Report published late 2025; GPTZero investigation May 14, 2026; EY removed it by May 18-19, 2026
Function: Consulting / published research
Where it happened: Thought leadership publication
System: Not disclosed
Technology: Generative AI
Type of failure: Fabricated content
Caught by: A researcher

Summary

EY Canada's 44-page report 'Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems' (late 2025), credited to two partners and a senior manager, was examined by AI-detection company GPTZero, which found that most of its 27 references were broken, misattributed or nonexistent, including citations credited to Forbes, McKinsey, Gartner, TechCrunch and WIRED, and that its text scanned as 72% AI-generated. A nonexistent McKinsey report it cited had been copied from an earlier fintech blog post that cited the same phantom source. A news article that referenced the report was syndicated to more than 60 Australian newspapers. EY removed the report, said it was reviewing how it was approved, and said it was not tied to client work.

Consequence

EY Canada removed the report from its website.
EY said it was examining how the report was approved and that it was not tied to any client assignment.

Who caught it A researcherFound outside the organization

Analysis

What could have been done

Checking AI output against its sources

Every factual element of AI output (citations, figures, quotations) is checked against its source before reliance.

Most of the report's 27 references were broken, misattributed or nonexistent, including citations credited to Forbes, McKinsey, Gartner, TechCrunch and WIRED, and the report was published that way.

Controls over input data

Inputs and source data are complete, current and fit for the use before the AI acts on them.

A nonexistent McKinsey report it cited had been copied from an earlier fintech blog post that cited the same phantom source, so a secondary source's citation was used without locating the original.

A review that can actually catch the error

The reviewer has the time, information and expertise to catch the error, not only to sign off.

The report was credited to two partners and a senior manager and passed EY's approval; the faults were found by an outside citation audit, and EY said afterwards it was examining how the report was approved.

What would likely have prevented it

Cite a third-party study only after locating it at its publisher, never through another writer's citation of it.
Before publishing research under the firm's name, have someone outside the drafting team confirm that every reference resolves to the cited work and that the work says what the text claims.

What would likely have caught it earlier

Run automated link and bibliographic checks on every reference in a publication before release, and send each failure to a named approver to resolve.

Key dates

May 14, 2026Event
October 16, 2026Checked against sources
October 18, 2026Checked against sources
October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

In late 2025, EY Canada published a 44-page report on cyber security titled Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems . While credited to three employees (two partners and one senior manager), the document is a collage of vibe citations

Supports: report, authorship, fabricated citations

Investigation: Hallucinations in Ernst & Young Report on Loyalty Fraud GPTZero Reporting or analysis
Following the publication of the GPTZero report, EY Canada removed the study “Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems” from its website. The Big Four accountancy said it was reviewing why the study was published.

Supports: removal

EY Canada takes down study after apparent AI hallucinations Consulting.ca Reporting or analysis
EY said it had removed the report and was examining how it was approved, adding that it was not tied to any client assignment.

Supports: EY response; not client work

EY removes loyalty rewards study after AI hallucinations found International Accounting Bulletin Reporting or analysis
Of the 27 citations in the EY report, more than 70 per cent were AI-generated and either made up or referenced incorrectly, according to GPTZero.

Supports: share of 27 citations affected

EY retracts cyber report littered with AI errors Information Age (ACS) Reporting or analysis

Suggested citation. Eminence Scan, “EY Canada — Loyalty-Fraud Report Withdrawn After GPTZero Finds Most References Hallucinated”, Eminence Growth Solutions, last verified October 16, 2026, https://eminencegrowthsolutions.com/tools/eminence-scan/record/fail-096/.

Using our research: you may read and quote Eminence Scan with credit to “Eminence Scan, Eminence Growth Solutions” and a link; all other rights reserved. Terms: Using our research.

Spotted an error, or a development we have missed? Report a correction. How we check records: research methodology.