Check Point recently described an AI-powered ‘Truman Show Scam’ that builds investment worlds to steal funds and identities at scale.
Cyber security solutions Check Point Software Technologies’ researchers Nir Horovitz and Yedidya Vachnish exposed the OPCOPRO ‘Truman Show Scam’, a fraud model that constructs a fully synthetic, AI-powered reality around victims, rather than relying on malware or conventional phishing pages.
Via this method, attackers combine AI-generated personas, fabricated investment communities, WebView-based mobile apps distributed through official app stores, and staged media presence to create the illusion of a legitimate institutional trading programme.
The scam begins with impersonation via SMS, messaging apps, or adverts promoting extraordinary returns, before steering targets into private WhatsApp or Telegram groups where scepticism can be controlled.
Inside these groups, AI-generated “experts” and fabricated members simulate an active trading environment using fluent, native-language interactions and professional-sounding market commentary. Once trust is established, victims are made to install an official OPCOPRO app from legitimate app stores.
Check Point said the app contains no real trading logic and functions as a WebView shell that displays server-generated balances and trades. Victims then complete KYC-style identity verification and deposit funds via bank transfer or crypto, which the researchers said results in the loss of both deposited money and high-value identity data such as government ID and biometric photos.
In this scam, AI acts as a force multiplier by enabling scalable multilingual conversations, consistent personas without human labour, automated emotional manipulation, and rapid deployment across regions and brands.
The impact on enterprises can be significant, including identity harvesting that enables account takeover through SIM swaps and help desk resets, coercion-driven insider risk, and elevated exposure via benign-looking apps installed from official stores.
Check Point said defenders should move beyond traditional code scanning and elevate scrutiny of WebView financial apps, tracking domain clustering tied to app ecosystems, and flagging funnels that move users from chat to app to KYC to deposit.
Stay updated on crypto and AI by following our socials
