|
Getting your Trinity Audio player ready...
|
On June 9, 2026, over 5,300 users reacted to a sponsored Facebook video (archived here) showing Samuel Awuku, the Akuapem North Member of Parliament, being interviewed by Metro TV journalist Moro Awudu. They were purportedly discussing an AI-powered investment platform known as PrimeAura.
The advert claimed users could earn GH¢11,200 within 24 hours without any financial risk. The sponsored video generated hundreds of comments and dozens of shares.
In the comment section, DUBAWA found several Ghanaians who expressed interest in and endorsed the platform. One such user, Esther Tulasi, wrote, “Hmmmmmmmm really good news,” whilst Emmanuel Adu Poku also commented, “Nice project!”
The link attached to the post redirected users to a webpage that closely resembled GhanaWeb, a prominent media platform in Ghana.
However, DUBAWA’s analysis found that the viral video was a deepfake that altered Mr Awuku’s appearance to mischievously promote the investment platform. Also, the verified Facebook account used to publish the advertisement belonged to British Olympic taekwondo athlete Bianca Walkden.
Samuel Awuku subsequently denied any involvement and publicly warned that fraudsters were using his image to promote investment scams.
It is one of many sponsored ads that DUBAWA found while investigating how scammers exploit Facebook’s paid advertising system to reach Ghanaian audiences. These scammers use investment fraud campaigns that impersonate celebrities and credible media platforms to promote their deceptive websites and Telegram bots.
The persistence of these sponsored ads, some with massive engagement rates, calls Meta’s ad moderation effectiveness into question. The investigation also questions the platform’s effort to protect potential victims from deceptive financial content.
The scam ecosystem
Facebook’s ability to reach billions of users has made advertising the backbone of Meta’s business model. In 2025 alone, Meta generated approximately $196.2 billion in advertising revenue, representing nearly 98% of its total revenue of $201 billion.
The platform also reported in its 2025 Annual Report (Form 10-K) that advertising generated an average of more than $6,200 per second during the year.
This indicates the role that automated campaign creation, target audience selection and rapid approvals have played in driving the platform’s commercial success.
However, malicious actors have also exploited the same systems that enable legitimate businesses to reach potential customers efficiently.
DUBAWA found that several investment scams impersonate politicians, journalists, musicians and trusted media organisations to persuade unsuspecting users to invest in fraudulent schemes.
Consumers reported losing approximately $2.1 billion to scams originating on social media in 2025, according to data from the United States Federal Trade Commission (FTC).
DUBAWA observed a recurring pattern in the scams’ designs and execution after examining numerous sponsored advertisements on Facebook.
Although the personalities, company names, and websites varied, the campaigns consistently used the same tactics, promising guaranteed returns and demanding high-pressure deposits before opportunities expired.
We observed the pattern in a sponsored Facebook ad that claimed John Mahama, Ghana’s president, launched an investment scheme that yields GH¢14,300 daily. DUBAWA’s analysis revealed that scammers had altered footage of his 2025 Africa Day address, adding AI narration to promote the scam.
In March 2026, DUBAWA also debunked claims that the late minister Ibrahim Murtala Muhammed left a will promoting a secret AI investment platform, PrimeAura, to generate millions of cedis.
Beyond manipulating the identities of politicians and public officials, scammers were increasingly impersonating trusted Ghanaian television stations to lend credibility to fraudulent investment schemes.
Prime Aura used this tactic in the Murtala Muhammed case, and other “AI-powered investment platforms” deployed it as well, as seen here and here.
Scammers also mimic Ghanaian TV news formats to build trust. Their videos use presenters, testimonials, public endorsements, and Telegram registration links to deceive viewers.
Prime Aura and other platforms used this strategy. A sponsored Facebook ad (archived) used TV3 branding to falsely claim Shatta Wale launched a high-earning gaming app, linking to the Bangbet app download page.
A page, Ghana News, also spoofed Joy News (archived here) and TV3 (archived here) to promote an “Abena Mensah” investment scheme.
Adib Saani, a cybersecurity expert and executive director of Jatikay Centre for Human Security and Peace Building, warned that clicking these unverified links risks phishing—the theft of sensitive personal or financial data—and advised verifying sources before engaging.
“There is nothing secretive about cyberspace. Once you are on it, you are half naked. But to be completely naked, you need to be reckless,” he said. “Clicking on any link without exercising caution can lead to the harvesting of your private data that can be used to harm you,” he said.
Manual analysis revealed key AI indicators, including unnaturally smooth faces, inconsistent ageing, robotic speech, lip-sync errors, and unnatural accents.
Journalists from both TV3 and Joy News also confirmed to DUBAWA that none of the programmes featured in the advertisements had ever been produced or broadcast by their organisations.
Mr Saani noted that scammers impersonate credible media brands because, “one of the core principles of these scammers is believability.” Fraudsters exploit established outlets’ reputation by cloning their websites and branding.
“For example, if you put such advertisements on a platform owned by the Ghana News Agency, the news agency is a respected platform, not only in Ghana but internationally. It would be easy for anyone to believe,” he added.
Most of the pages running ads also had minimal organic activity, few posts, and tiny followings, suggesting they existed mainly to run ads.
The sole exception was the PrimeAura ad featuring Samuel Awuku, published via Bianca Walkden’s verified Facebook account. Her last active date was June 16, 2023.
Meta, home for fraudulent ads?
Although Facebook served as the primary focus of this investigation, DUBAWA observed that the advertisements were not confined to a single platform.
Identical investment campaigns appeared across Facebook and Instagram, showing operators using a coordinated strategy to maximise reach. As similar moderation issues span Meta’s broader ecosystem, tackling fraudulent ads on Facebook alone may be insufficient.
Using new or inactive pages reduces an account’s credibility while enabling operators to switch pages if ads are removed.
These patterns mirror FTC data showing that investment scams drove the largest losses, with over $1.1 billion stolen through fraudulent schemes promoted mainly via social media ads and posts. Consumers lost more money to scams originating on Facebook than on any other social media platform, with WhatsApp and Instagram ranking second and third, respectively.
Faustina Angmor, communications lead at Ghana’s Cybersecurity Authority, said online fraud caused GH¢9,815,160 ($882,549.64) in losses between January and June 2026 alone.
She noted that online fraud was currently the most dominant cyber threat, accounting for approximately 46% of all cases recorded during the period.
The fake videos are often just a start, as sponsored ads lead users to cloned news sites or automated Telegram bots that maintain the fraud.
For instance, the deceptive GhanaWeb website in the Mahama deepfake had reviews or testimonials to endorse the investment’s legitimacy.
A comment from an unknown Seth Antwi read, “I just withdrew my funds… Do it, sign up. You are missing an opportunity, then you will regret it for the rest of your life.”
Saani explained that the bait-driven ecosystem thrived in Africa due to several factors, particularly poverty, desperation, ignorance, and negligence.
“People are desperate. People don’t have jobs. They want to grab any opportunity that comes their way. So when they see some of these things out of desperation, they click without thinking,” he said.
Saani acknowledged that Meta’s platforms had reporting mechanisms and algorithms to detect harmful content. However, he said there’s “a lot more they can do.”
He also advised users to remain cautious, saying safety requires a shared effort from users, platforms, and Ghanaian institutions.
How Facebook’s advertising system works
DUBAWA examined Meta’s advertising submission and review process to understand how fraudulent investment ads reached Facebook users.
Advertisers create Facebook campaigns via Meta Ads Manager by selecting objectives, creative materials, audiences, budgets, and payment methods before submitting them for review. The platform then examines the ads’ text, media, targeting, landing pages, and compliance signals using automated systems and human reviewers against its advertising standards.
However, this investigation identified multiple sponsored ads that passed Meta’s review despite exhibiting clear signs of financial scams. Ad reviews may lead users to trust sponsored content as vetted, spiking fraud risks in Ghana, which ranked 16th among 32 lower-middle-income economies in the World Intellectual Property Organisation’s (WIPO) Global Innovations Index 2025.
Although Meta prohibits deceptive financial practices and impersonation, these approved ads show limitations in its moderation systems against AI-driven scams.
Unlike ordinary Facebook posts, sponsored advertisements are more likely to go viral, causing more victims to fall prey to scams. Although Meta introduced “AI Info” labels for certain AI-generated content on Facebook and Instagram, there is still room to strengthen the system.
DUBAWA contacted Meta via email on Aug. 21, 2026, to seek the company’s response and input on the findings of this investigation. As of Aug. 25, 2026, Meta had not responded to DUBAWA’s request for comment.
The scams’ digital infrastructure
DUBAWA identified and archived 11 different ads about AI-powered investment platforms on Facebook. We analysed some of the attached domains using open-source website analysis tools.
The ads redirected Ghanaians to PrimeAura, GHS 14,300 Daily Investment Scheme by President Mahama, CryptoExplodeAI, the John Dumelo/Umaru Sanda investment scheme, Aliko Dangote/phishing investment scheme, BangBet, Abena Mensah investment scheme, Richard Nii Armah Quaye’s GHC11,200 investment scheme, NezertronixPro, and Ghana Prosperity Initiative.
Privacy protection services redacted domain registration details, limiting publicly available information about those who operate the websites.
Namecheap. Inc, a US-based web hosting company that DUBAWA investigated for hosting a data broker, registered some of the domains. DUBAWA also identified GoDaddy, another US-based domain registrar.
DUBAWA’s website authenticity checks showed that these sites had smaller, less transparent digital footprints than those of established media outlets.
The investigation also found that some domains were registered only days before the corresponding advertisements began appearing on Facebook. An example is the vaderhydra.com domain, which was registered on June 14, 2026, while the sponsored ad began trending four days later.
Domain privacy services hidden behind Withheld for Privacy, an Iceland-based provider, also protected several registrant details that DUBAWA found. A 2024 New York Times investigation linked this company to numerous fraudulent and disinformation sites.
Telegram, another conversion point
Unlike many of these advertisements that led to websites, others left links that redirected users to Telegram pages, where the final stage of the operation often takes place.
To trace the scam progression past the ads, DUBAWA engaged with the fraudulent “Abena Mensah” Telegram channel.
The automated bot promised guaranteed daily earnings in thousands of dollars or tens of thousands of Ghana cedis, before redirecting users to “Reviews Abena,” a channel with 3,314 subscribers as of Jul. 15, 2026.
Visuals of numerous testimonials showing purported successful investors, screenshots of alleged profits and messages littered the channel. The platform also claimed that artificial intelligence, betting algorithms, or insider information consistently generated guaranteed returns.
The conversation led to upfront deposit demands before services were provided. One message stated, “Just make a small investment, and I’ll start working for you immediately. There are 3 available events with high odds.”
Screenshots from interactions with Abena Mensah’s chatbot on Telegram
We also documented repeated use of urgency and psychological persuasion. Whenever we delayed making a payment, the bot followed up hours later with additional messages urging immediate action and suggesting that hesitation was the only obstacle to financial success.
A follow-up message from Abena Mensah urging immediate action
The Telegram bot ultimately directs prospective investors to make an initial deposit of GH¢450 through what it describes as a “secure payment system.”
Clicking the payment link takes users to a webpage offering four payment options at GCB Bank, MTN Mobile Money, Telecel Cash, and CalBank.
Collage of the payment options used by Abena Mensah
Interestingly, none of the payment accounts bears the name “Abena Mensah,” the identity under which the investment scheme is promoted. Instead, each payment channel is registered to different male individuals.
Although this alone does not identify the operators, using multiple account holders with names distinct from the promoted identity makes it harder to trace the fund controller or seek redress.
We also used DUBAWA Audio, an AI-powered local-accent transcription tool, to analyse the three voice notes sent by the Telegram bot during the interaction. The speaker’s accent did not appear to be consistent with a typical Ghanaian accent and was likely recorded by a non-Ghanaian for Ghanaian audiences.
The foreign accent made the transcription process take several hours. While two of the audios uploaded on Aug. 21, 2026, were eventually transcribed, the 12-second-long third was still pending as of Aug. 23, 2026. The audio files were also saved with Russian-language labels, “1 блок ГС,” “2 блок ГС,” and “ПОСЛЕ РЕКОВ 2.”
“Cybersecurity requires collective action”- CSA
Despite the challenges associated with social media use, the Cyber Security Authority (CSA) says it is intensifying public education, capacity building, incident reporting, investigations, enforcement and collaboration with technology platforms and other stakeholders to protect Ghanaians from cyber threats.
Ms Faustina Maner Angmor, the agency’s communications lead, said public awareness remained one of the Authority’s key preventive measures, noting the difficulty of recovering from financial losses caused by online fraud.
“For us, we believe awareness is the foremost means of preventing fraud because usually when the fraud happens, it’s difficult to locate the fraudsters. It’s more expensive to do the investigations.”
“And the chances of people even recovering their money or what they have lost are very slim. We advocate prevention through awareness. People must be aware; they should know what they are doing on their phones and be careful,” she said.
Ms Angmor said the CSA conducted awareness and capacity-building programmes in schools, institutions and communities, with its Child Online Protection Unit focusing on young people.
She said the Authority also encouraged schools, particularly senior high schools, to establish cybersecurity clubs through which students participate in webinars, quizzes, competitions and other activities.
Alongside enforcement efforts, the annual National Cyber Security Awareness Month event had been a major platform for educating the public about online fraud and other emerging digital threats.
Funded by the Czech Republic, the agency also partnered with the Africa Centre for Digital Transformation (ACDT) to pilot the National Community Media Cyber Capacity Building Project (NCMCCBP) from August 3 to 10, 2026.
She explained that the project trained community and mainstream journalists in cybersecurity, digital safety, cybercrime reporting, source protection, verification, and responsible reporting. It also supported their efforts to promote cybersecurity awareness and combat misinformation.
Ms Angmor noted that the CSA’s Law Enforcement Liaison Unit also investigated leads and collaborated with security agencies to prosecute cybercriminals.
Enforcement actions led to several arrests, including 39 suspects during an August 2025 cyber-fraud raid in Tema and 65 across four joint operations from May to July 2025.
She cited key milestones, including the 2025 arrest of the romance-scam suspect Abu Trica, among others that even require collaboration with the Ghanaian police and Interpol.
Angmor said the Authority operated 24-hour incident-reporting points of contact, including its 292 shortcode for calls and text messages and email at report@csa.gov.gh for citizens seeking assistance.
Reports received covered a wide range of cases, including child online protection concerns, investment scams, account takeovers and other cyber incidents.
On social media platforms, Angmor said the CSA worked with Meta, TikTok, X, and Telegram, particularly to remove fraudulent accounts, advertisements, and other harmful content.
“We work with them a lot, especially on the takedowns. The issues we are not able to handle just by ourselves, we collaborate with them to assist us with the takedowns,” she said.
She noted, however, that response times varied depending on the nature of a case, as platforms conducted their own internal reviews before taking action.
While acknowledging the platforms’ efforts, Angmor said there was still room for improvement, particularly in understanding and responding to threats targeting Ghanaian users.
She also called for greater public-awareness efforts by the platforms.
“They are doing well, but I think there’s always room for improvement for every institution,” she said.
She identified resource, financial, and tool limitations for better investigation as key obstacles for the Authority. She added that tackling cybersecurity demands collective effort.
“Cybersecurity is not a job that we can do alone as a community,” she said, calling for stronger collaboration among government agencies, the media, technology platforms and the public.
Meanwhile, Ghana’s new National AI strategy offered a framework for solutions to deepfake, AI, and synthetic content threats. Angmor pledged that the CSA is committed to innovation and collaboration to address them.
“We are committed to intensifying our innovation and sensitisation. We are also committed to collaborating with all stakeholders to make the space safe for all,” she said.
She urged Ghanaians to take greater personal responsibility for their digital safety.
“When it comes to cybersecurity issues, it should be everybody’s business. Nobody should lose so much before they take it seriously,” she advised.
This report was produced under the 2026 Kwame Karikari Fact-checking and OSINT Fellowship, co-hosted by DUBAWA and the Digital Technology, Artificial Intelligence, and Information Disorder Analysis Centre (DAIDAC), with support from the Centre for Journalism Innovation and Development (CJID).
