When Scammers Use AI-Generated Pets for Extortion

What happened

Scammers have started using generative artificial intelligence tools to create realistic photographs of missing pets. They then post these images online or send them directly to distraught owners who are searching for their lost animals. When the desperate owners reach out, the scammers demand reward money or ransoms, often claiming the animal is injured and needs immediate veterinary care. Once the money changes hands, the scammers vanish.

This tactic exploits human emotion using easily accessible image generation tools. It takes minutes to create a convincing photo of a specific breed in a generic distressed setting. For the pet owner, the emotional stakes make verification difficult. They want to believe the animal has been found.

The governance failure pattern

This incident sits squarely in the deepfakes and AI-enabled fraud failure pattern class. The core governance failure is the absence of verification infrastructure for consumer-facing media and the lack of accountability across generative tool platforms.

Platforms that host pet loss groups and social media feeds rarely verify the authenticity of user-uploaded images. Meanwhile, the companies building image generators often place minimal friction on creating deceptive content, relying on post-hoc moderation rather than built-in provenance. When bad actors can generate convincing synthetic media without any traceable signature, fraud flourishes.

Obligations and rules

For organizations deploying or hosting generative AI systems, the regulatory landscape is shifting to target this exact vulnerability. Under the EU AI Act's transparency rules, which have been in force since August 2026, providers of systems that generate synthetic audio, image, video, or text content must ensure their outputs are marked in a machine-readable format. Furthermore, systems must be detectable as artificially generated.

While these rules primarily target the providers of AI models and large platforms, organizations building customer-facing applications must also implement provenance checks. Waiting until fraud occurs is no longer an acceptable risk posture.

Measuring the risk

Managing this class of risk requires tracking specific metrics rather than relying on qualitative hope. Key risk indicators for deepfakes and fraud include tracking sensitive actions authorised on a single channel, aiming for a target of zero. Organizations should also measure their time-to-warn staff after a confirmed impersonation attempt and monitor the share of published synthetic media that carries machine-readable marking.

Tools like autogovern.io can help teams monitor compliance with content marking and provenance standards across deployed systems.

What to do

• Audit all customer-facing and user-generated content channels for synthetic media detection capabilities.
• Implement machine-readable watermarking or content credentials for any AI-generated images or media your organization produces.
• Establish clear verification protocols for financial transactions or reward payouts tied to digital imagery.
• Track the percentage of your published media that carries verifiable provenance metadata.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.