CanadaProfessional services2025–2026EY Canada
AI-assisted research on cybersecurity and fraud in loyalty programmes
EY Canada withdrew its loyalty-fraud report after researchers identified apparent AI hallucinations and false references
Problem
EY Canada published research on cybersecurity weaknesses in loyalty programmes. Its consultants used the study to market their cybersecurity business.
Approach
EY published Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems in December 2025. In May 2026, GPTZero reported apparent AI-generated text, nonexistent references and inconsistent claims, including a citation to a McKinsey report it could not find. EY Canada removed the study from its website and said it was reviewing the circumstances of publication. EY said the report was unrelated to client work and affirmed its commitment to accurate content and responsible AI use.
Results
No published figures
Takeaway
A report used to market EY's cybersecurity expertise contained references that did not support its claims. External scrutiny led to its withdrawal and a review of how it had reached publication.
Categories
- Size
- Large enterprise
- Industry
- Professional services
- Business function
- Marketing and salesInternal work and knowledge management
- Innovation type
- Process innovation
- AI technology
- Generative AI
- Adoption
- Off-the-shelf tool or platform
- Evidence
- Press reporting
Sources
Source summaries
Sherwood dated the report to December 2025 and examined GPTZero's findings about nonexistent sources and inconsistent claims. It reported that the investigation combined automated checks with human review; EY had not responded before publication.
Consulting.ca confirmed that EY Canada removed the study after GPTZero published its investigation. It reported that EY was reviewing why the report had been published.
The article reported that consultants used the study to market cybersecurity services. It included EY's statement that the publication was unrelated to client work and that the firm was reviewing its publication.
Full details are in the original sources.
