Ernst & Young Cybersecurity Report Found Riddled With Fake Citations, AI-Generated Text, and Contradictory Statistics

A 2025 EY Canada report on loyalty fraud — Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems — turns out to be a masterclass in what GPTZero calls "vibe citing": letting an LLM hallucinate your references so you don't have to. An investigation found broken URLs, nonexistent Gartner documents, a fabricated McKinsey report, and a Forbes article that doesn't exist — all in a 44-page publication credited to two partners and a senior manager at one of the world's biggest consulting firms.

The damage doesn't stop at embarrassment. The report has since been cited in a Canberra Times article syndicated to over 60 Australian newspapers, and Claude, ChatGPT, and Perplexity have all been caught surfacing its hallucinated claims in response to queries. A fake McKinsey citation was apparently laundered from an obscure fintech blog, which itself made up the source — a game of telephone where every player is an AI and nobody checks the tape.