EY Canada cybersecurity report found to rely on hallucinated citations

An investigation by the AI-detection company GPTZero has found that a cybersecurity report published by EY Canada in late 2025 leans heavily on fabricated and misattributed citations — a practice the company calls “vibe citing.”

What the investigation found

The 44-page report, “Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems,” is credited to three employees: two partners and one senior manager. It uses no footnotes; sources appear in the text or in a resources table on pages 41 to 43. According to GPTZero, almost every URL in that table is broken or fake, and more than half of the titles listed do not match a real source.

GPTZero says the text itself scans as AI-generated and carries the usual fingerprints of large language models.

Contradictory numbers and laundered sources

In the executive summary the authors state that the global loyalty points market is worth $200 billion and that 30–50% of those points go unused. Page 42 supports the figure with a fake Forbes citation, while page 10 treats the same $200 billion as the value of unredeemed points — a claim that, by the authors’ own logic, would require a market of at least $400 billion.

A McKinsey & Company report cited on page 43 does not exist. GPTZero traced it to a Financial IT blog post published six months earlier, which claims that “more than $200 billion in points sit idle each year” and lists “McKinsey & Company: Loyalty Economics Report (2022)” as its source. That invented reference appears verbatim in the EY table.

Other claims are attributed to different sources in different places. A statistic that 72% of loyalty programs have reported theft or fraud is credited to Paystone on page 6 and to Forter on page 11, though neither appears in the reference table; the original source appears to be a 2017 Ipsos survey. A claimed 89% rise in fraud attacks is dated from 2019 on page 6 but limited to 2018–2019 on page 11.

Why it matters

The public reach of the report is hard to measure, but GPTZero notes it was referenced in a Canberra Times story syndicated to more than 60 Australian newspapers. In the company’s tests, ChatGPT, Claude and Perplexity all repeated its claims when asked about average loyalty fraud detection times. Fake material published by a well-known firm on a high-traffic site, GPTZero argues, poisons the pool of data that future researchers and AI “deep research” tools draw on.

GPTZero has run its Hallucination Check tool since 2025; it has previously flagged problems in a government publication and two Deloitte reports. EY is one of the “big four” consulting firms, with 150 offices worldwide, and its Canadian member firm provides millions of dollars of services to the Canadian government each year.