Faceless Phantom Firms

Why I am writing this

In 2012, shortly after the Independent Commission Against Corruption raided the Obeids’ offices, I was served with a summons at Brisbane International Airport.

The next day I took advice from Terry O’Gorman. He was not coming to Sydney with me. The advice was given in Brisbane before I travelled and I carried it into the hearing room on my own. It was this. If something is put to you that you know has nothing at all to do with the matter you have been called about, the Obeids or Cascade, do not push back on it. Move on and stay on what you are there for. It is a private hearing.

That was not timidity and it was not improvised. O’Gorman cross-examined Joh Bjelke-Petersen at the Fitzgerald Inquiry and spent a career on what commissions of inquiry do to the people who appear before them. He knew what anyone who has never sat in one does not. A standing anti-corruption commission is not bound by the rules that protect a defendant in a courtroom, and there is no clean mechanism to contest a collateral slur. Fight it and you give it oxygen, you lose the thread of your own evidence, and you look like a man with something to defend. The experienced play is to stay on the matter you were called about.

So when a fabricated CV was put to me in the private examination, I did not push back on it. I had never seen it before and I took it for an error. I did not contest it, on O’Gorman’s advice, because I knew it was not material and had nothing at all to do with my dealings with the Obeids or with Cascade. I stayed on the evidence I had been called to give, and it never came up again while I was under oath. The advice worked exactly as it was intended to.

A signed statement about me was already in circulation by then, one its own signatory later swore had been made under duress. My account of the fabricated CV is that it belonged to the same campaign and was made to damage my standing. No commission or court has ruled on the CV itself and I say so plainly, although other instruments of the same campaign are established on oath.

Then the testimony became public.

The cost of leaving something uncontested in a closed room is zero. That holds only while the room stays closed.

Once a transcript is public, uncontested does not read as immaterial and therefore ignored. It reads as unanswered. Unanswered is now a permanent, indexed and machine-readable condition, and I have lived with it for fourteen years. Whether I have any recourse for that is an open question and not one I have tested.

The tribunals were never troubled by any of it. They preferred my evidence at every stage: ICAC in 2013, the Federal Court in 2018, the convictions in 2021 and the High Court in 2026. The search results were a different matter, and they do not adjourn. I keep the whole of it, with the transcripts and the judgments attached, on the record page of this site, for the reason this paper is about: the alternative is to leave a space and let whoever cares to fill it do the filling.

What has changed since

I set that out because the lesson in it is not about me.

In 2012 an attack of that kind needed people. It needed a motive, a network, somebody willing to put their name to a document, and the nerve to run the thing while a corruption commission was sitting. It was expensive, it carried real risk for the people doing it, and it left fingerprints, which is why so much of the surrounding conduct is now on oath and on the public record.

None of that is required any more. One person with a laptop can now build something more convincing than anything built about me in 2012, in an afternoon, for the price of a domain name, and leave nothing behind to trace. What was once available only to organised interests with something substantial at stake is now available to a competitor, a disgruntled former employee, or anybody with a grudge and a free evening. That is the shift this paper is about.

Fraud directed at corporations has been industrialised by generative artificial intelligence, and the exposure is global. The controls most companies rely on were built for a world in which faking credibility was expensive.

The growth is worldwide and it is steep. Sumsub, an identity verification provider, recorded deepfake attempts on its own platform rising one thousand seven hundred and forty per cent in North America between 2022 and 2023, one thousand five hundred and thirty per cent in Asia-Pacific, seven hundred and eighty per cent in Europe including the United Kingdom, and four hundred and fifty per cent across the Middle East and Africa. That is platform telemetry rather than an official statistic and I treat it as such throughout, but no region in it is untouched. The United Nations puts the South-East Asian scam economy alone at up to one hundred and fourteen billion United States dollars in 2025.

None of the underlying techniques is new. Business email compromise, invoice and procurement fraud, shell and nominee company networks, trade-based laundering. What has changed is that the expensive part, making the deception convincing, has been automated. Three developments follow from that, and they are what this paper covers.

• A face and a voice on a video call are no longer evidence of identity. Arup lost twenty-five point six million United States dollars from its Hong Kong office in January 2024 to a video conference on which every other participant was fabricated. No internal system was compromised and nothing was hacked.
• Entire counterparties are now manufactured rather than impersonated. In June 2026 the FBI disabled thirteen fake consulting company websites in a single action. One of them had cloned the identity of a real Brisbane consultancy, which had been receiving applications for jobs it never advertised for roughly a year before anyone understood why.
• The tool a director now uses to find an adviser cannot establish whether the firm it recommends exists. In a study of one hundred and fifty-eight thousand assistant answers published in October 2026, forty-six per cent of the cases in which a leading system named a brand had no cited source behind the mention at all.

Inside that third development sits the least defended category of the lot, and the one this paper names. A counterparty that presents as an expert advisory, research or cybersecurity practice and has no verifiable legal existence of any kind: no company number, no jurisdiction of incorporation, no registered office, no named human being. It is not a shell company, which exists and can be traced to an owner. It is not an impersonation, which has a genuine party at the other end who can confirm or deny. It is a complete professional identity assembled from nothing. I call these Faceless Phantom Firms, and they are multiplying because they are the cheapest fraud in the inventory to manufacture and the one almost nobody tests for.

The governance exposure is live now and does not wait for legislation on artificial intelligence. Australia’s regulator has stated that directors’ duties of care and diligence extend to the adoption and use of artificial intelligence, including reliance on third-party vendors, and that licensees remain responsible for outsourced functions. Equivalent duties apply to directors in Singapore, Hong Kong, the United Kingdom and most comparable jurisdictions. The question a board is asked afterwards is never whether it anticipated the technique. It is whether ordinary verification steps, cheap and available at the time, were applied.

I have written this because every control that defeats these attacks already exists, and almost nobody applies them to the one category they do not fit. Registry diligence assumes there is an entity to find, so a nil result reads as an incomplete search rather than as the answer. What follows sets out the scale, the vectors, a ladder for placing any counterparty on it, a twelve-marker test that takes twenty minutes and needs no subscription service, the documented record of cases, and what has to be true before money moves. The rule it arrives at is one line. No verifiable legal existence, no engagement, no payment.

The rest of the paper is the evidence. I begin with one live specimen, examined on 3 November 2026, because a category is easier to recognise against something real. It is an illustration of the problem and not the problem itself.

A firm that sells verification ought to be the easiest firm in the world to verify. Theory Intelligence, trading at theoryintelligence.com, publishes a standard requiring that every source be real, every figure be traced to its origin and every recommendation be signed by a named researcher. I applied that standard to the firm.

It has no company number, no jurisdiction of incorporation, no registered office, no telephone number and no named person anywhere on the site, including on the articles it publishes. Its terms of business decline to state a governing law. Its privacy policy invites complaints to United Kingdom and European data protection authorities while identifying no controller to complain about. The LinkedIn page it links to from its own footer does not exist. It says it was founded in 2019. Everything it has ever published is dated within eight days of September 2026.

I make no allegation of dishonesty or unlawful conduct against Theory Intelligence or anyone connected with it, and none should be inferred. The point is narrower and more uncomfortable than an allegation. That firm would clear third-party onboarding at a great many companies today, because onboarding tests for documents a website can produce and not for an identity a registry can confirm. It is not the worst example of its kind. It is the clearest, which is why I have set it out in full.

1. What took a conspiracy in 2012 now takes an afternoon

Reputational attack has always been possible. What has changed is its price, and price is what decides how often a thing happens.

1.1 The attacker’s side of the ledger

Consider what an operation of the sort I described had to assemble in 2012. A motive strong enough to justify the risk. A network of people prepared to act together. At least one person willing to put a name to a document. Enough knowledge of the target to make the fabrication plausible to people who knew him. A channel to place it where it would be seen by the right audience at the right moment. And the nerve to run all of that while a corruption commission was sitting and raids were under way.

Every one of those requirements is a cost, and every one of them is also a point of failure. That is why the surrounding conduct is now on the public record and on oath. Operations of that kind leave people behind them, and people can be examined.

None of it is necessary now. A single person, working alone, with no particular skill and no accomplices, can generate a plausible document, a supporting article, a website to host it, photographs of people who do not exist and a body of corroborating writing, in an afternoon. The marginal cost is a domain registration. There is no second person to lose their nerve, no signature to be disavowed later, and nothing that can be put to a witness under cross-examination, because there is no witness.

The cost of manufacturing a convincing lie about a person or a company has fallen to approximately nothing. The cost of correcting one has not moved at all.

1.2 The defender’s side has not moved

Correcting a record still costs what it always cost. In my own case the corrective process ran through a commission in 2013, the Federal Court in 2018, a criminal trial resulting in convictions in 2021 and the High Court in 2026. That is fourteen years and the full apparatus of the Australian legal system, and the fabricated material is still retrievable by anyone who looks.

I am not complaining about that. I had the resources and the standing to run it, the tribunals preferred my evidence at every level, and the substantive outcome was the right one. The point is what it implies for everybody who does not have fourteen years, a documentary record and a High Court judgment at the end of it.

The arithmetic is the whole problem. An attack that costs nothing and takes an afternoon is answered by a remedy that costs a great deal and takes years. No market survives that kind of asymmetry without adaptation, and the adaptation has not happened. Most individuals and most companies are still operating on the assumptions of the cheap-lie, expensive-fabrication era that ended somewhere around 2023.

1.3 Who is exposed now

In 2012 this was a thing that happened to people who were in somebody’s way: witnesses, journalists, regulators, the occasional executive in a contested transaction. The barrier was not law or ethics. It was effort, and effort rationed the behaviour to targets worth the trouble.

That rationing is gone. The same capability now reaches a supplier competing in a tender, a candidate for a senior appointment, a professional in a fee dispute, a director on the wrong side of a board disagreement, and private individuals with no public profile at all. Not because the world has become more malicious, but because the price of acting on malice that already existed has collapsed. Anybody with a computer can now do, in an evening and at no risk, what in 2012 required a conspiracy.

1.4 The advice that was right in 2012 is wrong now

This is the part I would press on anyone reading, and it is the reason I set out my own experience rather than writing an impersonal paper about other people’s problems.

The advice I was given was the orthodox advice, and for most of the last century it was correct. Do not dignify a lie. Do not amplify it. Do not hand it the attention it is fishing for. Let it die of neglect. That advice rested on an assumption so obvious that nobody stated it: that the record fades. Newspapers were thrown out. Transcripts sat in registries. An allegation nobody repeated simply stopped existing.

The record no longer fades. It is permanent, it is indexed, and it is now read by systems that cannot distinguish between a claim that was never answered and a claim that was never true. An unanswered allegation is not forgotten. It is retrieved, summarised and repeated, by machines that have no mechanism for noticing that nobody ever contested it and no way of knowing why.

Silence used to be the cheapest defence available. It is now the most expensive one.

Section 4 of this paper sets out the measured version of that mechanism in a commercial setting: the research showing that nearly half the brand names a leading assistant produces rest on no cited source, and that the thinner a subject’s genuine footprint, the more the gap gets filled from whatever happens to be lying around. A person with an uncontested allegation and no published account of their own is a thin footprint with a space in it. The space does not stay empty.

The practical conclusion runs in the opposite direction to the 2012 advice, and it applies to companies as much as to people. Occupy the space yourself. Put the primary documents where they can be found, dated, complete and machine-readable, including the parts that are unflattering. Do not argue, because argument is not retrievable as fact. Publish the record and let it be checked. That is the only defence that scales at the same speed as the attack, and it is precisely the same mechanism the firms described in this paper are using against buyers. They fill the void deliberately and dishonestly. There is no reason the honest party should leave it empty.

2. A Faceless Phantom Firm is a counterparty with no registrable existence

Three things are routinely confused, and the distinction decides what control catches them.

A shell company exists. It is registered, it has a number, it files something somewhere, and the deception sits in who ultimately owns it and what it is used for. Registry diligence finds the entity and then has to work out the beneficial owner behind it.

An impersonation borrows an existence. The fraudster takes a real firm, or a real executive, and poses as them. Callback verification to a previously known number finds it, because there is a genuine party at the other end who can confirm or deny.

A Faceless Phantom Firm has no existence to find and no genuine party to call. There is a name, a domain, a body of competent writing, a price list and an email address. Behind them there is nothing a registry, a court or a process server could reach. Registry diligence returns no result, and the absence of a result is then misread as an incomplete search rather than as the finding itself.

The absence is the finding. In a market where a convincing corporate identity now costs a weekend, nil identification is the single strongest signal available to a buyer.

2.1 This is a ladder, not a line

The barriers to appearing expert have collapsed, and they have collapsed faster than the barriers to appearing legitimate. Anyone can look like a specialist overnight. Scrape a competitor’s site, replace the graphics, present the result as your own work, publish a price and start asking for money. That is a weekend, and it requires no particular ability.

What separates one operator from another is not the quality of the facade. It is how much of a real identity sits behind it. There are four rungs, and where a counterparty sits tells you what you are dealing with before you read a word of its material.

• Fully identified. A registration number you can pull, a registered office that exists, named officers with histories that can be traced independently, and a filing record consistent with the operating history claimed. This is almost every real business, and demonstrating it costs nothing.
• Technically identified, materially false. A genuine registration, bought for a few hundred dollars through an incorporation agent, carrying fabricated particulars. The number checks out. The registered address is a mailbox, a residential flat or, in one documented case set out in section 5, an abandoned lot. The officers are invented. This rung defeats a registry check and nothing beyond it.
• Thinly identified. A name, perhaps a jurisdiction, no number, no officers and no address. Enough to be mistaken for an oversight by a buyer who wants to get on with it.
• Faceless. No number, no jurisdiction, no office, no telephone, no named person, no governing law and no identifiable data controller. Nil identification. The specimen in section 2 sits here, and it is the cleanest example of the rung I have seen.

Most commentary on this subject stops at the second rung, because that is where conventional fraud lives and where anti-money-laundering controls are pointed. The fourth rung is the one this paper is about, and it is growing, because it is cheaper than the others and because almost nobody is testing for it.

2.2 The question nobody asks the faceless counterparty

Moving from the fourth rung to the first costs a few hundred dollars and about an hour. Incorporation is a commodity service sold online in every jurisdiction that matters. Any firm that wanted to be identifiable could be identifiable by the end of the afternoon.

So the question is not whether a faceless counterparty is legitimate. The question is why a firm advertising engagements at seventy-five thousand United States dollars has declined to spend a few hundred becoming someone you could sue.

There is no innocent answer to that which survives contact with how money actually moves, and this is the part a banker notices before anyone else does. A firm invoicing corporations in US dollars has to be paid. Being paid requires a bank account. A bank account requires an identified account holder, whether that is a company with a number or an individual with a name and a passport. The identity therefore exists. It has to. The only question is when the buyer is permitted to see it.

On the evidence, the answer is after they have committed. The engagement agreement carries the governing law, and the governing law is withheld until the engagement agreement. The invoice will carry a payee, and the payee is not disclosed until there is an invoice. Every piece of identifying information is sequenced to arrive after the decision to engage rather than before it.

That sequencing is the product. It is not an oversight by people who forgot to put an address in the footer. A firm that has thought carefully enough about its positioning to publish a four-rule verification standard has thought about its footer.

2.3 The test

Placing a counterparty on the ladder takes about twenty minutes and needs no subscription service. Twelve markers, each of which an ordinary trading business in any serious jurisdiction can satisfy on request and within the hour. The question is not whether a counterparty scores well. It is whether any marker at all can be independently confirmed outside the counterparty’s own website. Section 2 applies the test to a live example.

3. Anatomy of a specimen

I examined theoryintelligence.com on 3 November 2026 by direct inspection, together with the authoritative domain registry records and a search of a professional network from an authenticated account. What follows is a record of what the public sources do and do not contain. It is not an allegation of wrongdoing, and I have not formed or expressed a view on the quality of any work the firm may have performed.

I have set this one out at length because it is unusually clean. The writing is good. The positioning is coherent. The pricing is published, which most advisory firms will not do. There is nothing crude about it, and that is precisely why it is worth a banker’s attention. The crude ones are already caught.

3.1 The firm sells verification and fails its own standard

The proposition is verification. The site publishes four rules it calls The Theory Standard: every source is real, every claim is traceable, artificial intelligence use is disclosed, and a person signs the recommendation. It states that one hundred per cent of sources are verified by a named researcher, that every person is checked and every document opened, and that if something cannot be verified it does not appear.

Apply those four rules to the firm. No person is named, so nothing is signed in any sense a counterparty could rely on. No claim the firm makes about itself is traceable to anything outside its own website. The firm cannot be verified, and on its own rule it should therefore not appear.

3.2 Twelve markers, and what the site contains against each

Each marker is something an ordinary trading business in any serious jurisdiction can satisfy within the hour.

Two of those warrant expansion, because they are the ones a lawyer notices.

The terms of business decline to state a governing law. The wording is that the terms and the engagement agreements are governed by the law stated in the engagement agreement. The engagement agreement is the document a counterparty sees only after it has decided to engage. So the answer to the question of which law governs, and therefore which courts have jurisdiction and what rights a buyer has, is withheld until after the point at which it is useful. The same page caps liability at the fees paid. A liability cap is a promise by somebody. Here there is no identified somebody to be bound by it, and nobody to serve.

The privacy policy identifies no data controller. Under the heading setting out who the firm is, the text states in full that Theory Intelligence, also Theory Intel, operates the two domains, and gives an email address. That is the whole of it. The same policy expressly contemplates United Kingdom and European data subjects and tells them they may complain to their data protection authority. A trading name and a mailbox do not identify a controller, and no representative is named. The firm also states that interview recordings are held for twenty-four months and that client material sits in encrypted storage, while the contact form on the site transmits nothing and simply opens the visitor’s own email client. There is no server-side infrastructure visible at all.

3.3 Seven years claimed, eight days of evidence

The firm states that it was founded in 2019 and writes of seven years and one generative artificial intelligence wave since. Its structured site data carries a founding date of 2019.

Both domains, theoryintelligence.com and theoryintel.com, were first registered on 11 March 2021, three seconds apart, which is a single paired registration. That alone proves little, since a firm can predate its domain. The publication record is another matter. The entire published output of I is eight briefing articles, dated 2, 3, 4, 5, 6, 7, 8 and 9 September 2026. There is nothing before and nothing since. The terms page and the privacy page both record a last update of 9 September 2026. Both domain registry records were last changed on 9 September 2026.

Every datable artefact the firm has produced falls inside one week of September 2026. Against a claimed history of seven years, that is the whole of the evidence.

3.4 I applied its standard to its own homepage

The firm publishes four statistics on its front page, each with a named source and a year. Its own rule is that every figure is traced to its origin before it is used, and that if something cannot be verified it does not appear. I traced them.

Most of the material checks out. The firm’s account of the Deloitte Australia matter is accurate, and its reference to fabricated citations in published consulting reports is well founded. I say that plainly, because the point of this exercise is not to assemble a case against a website.

One figure does not hold. The homepage attributes to Kantar the proposition that thirty to forty per cent of online survey responses are compromised by bots, farms or inattentive respondents. I could not locate a Kantar publication stating that. What Kantar does publish is that researchers discard on average thirty-eight per cent of the survey data they collect because of quality concerns, and that sixty-nine per cent of data-quality flags are attributable to forms of fraud. Those are different propositions. Data discarded on quality grounds includes material rejected for reasons that have nothing to do with bots or fraud, and the published figure is a single average rather than the range given.

A second figure, the finding that seventy per cent of three thousand eight hundred and eighty-seven companies would not trust a report prepared with artificial intelligence, is real and was reported by The Telegraph on 3 August 2026. The underlying survey does not appear to have been published with its methodology or fieldwork dates, so a reader cannot in fact trace it to origin in the way the firm’s standard requires. The same reporting carries a narrower figure of thirty-two per cent, which the homepage does not mention.

This is the ordinary citation drift that the firm exists to criticise, on the page where it criticises it.

I make no claim that this was deliberate. Citation drift of exactly this kind is common, it is usually careless rather than dishonest, and it happens in good firms. That is the point. A standard is not what a firm publishes about its method. It is what survives when somebody checks, and nobody had checked this one, because there was nobody identifiable to ask.

Sources: theoryintelligence.com, inspected 3 November 2026; Verisign registry records for both domains, retrieved 3 November 2026; Kantar published material on survey data quality; The Telegraph, 3 August 2026.

4. The phantom is built to be recommended by machines, and the machines have a gap

This is the part most third-party risk frameworks have not caught up with, and it is the reason the category is about to get larger.

4.1 The intent is stated on the site

The specimen publishes two machine-readable files, llms.txt and llms-full.txt. These are structured dumps of the entire site in a format intended for ingestion by language models, placed at the conventional path where an automated agent would look. The site states the purpose in plain words on its own briefing page. The writing, it says, is for people who make decisions, and for the answer engines they ask.

Alongside them sits a set of comparison pages built against named real competitors. Theory versus expert networks. Theory versus management consulting. Theory versus synthetic research. Theory versus artificial intelligence research tools. A separate guide sets out what calls cost at GLG, AlphaSights, Guidepoint, Third Bridge and Tegus. Every one of those is a real and substantial business. None of them is the subject of this paper and nothing here reflects on any of them. They appear because naming them is the mechanism: the page exists to be retrieved when a buyer asks about the firm that actually exists.

4.2 The file itself does not work, which tells you something

I expected to report that llms.txt is how this is done. The evidence does not support it and I am not going to pretend otherwise.

Google’s John Mueller has stated publicly that no artificial intelligence service has said it uses llms.txt, and that server logs show the crawlers do not even check for it. A controlled measurement published by Search Engine Land, covering ten sites across finance, software, ecommerce, insurance and consumer categories, with ninety days of data before and after implementation, found no measurable change in crawl frequency or assistant-referred traffic at eight of the ten, and attributed the other two to concurrent changes. No major model provider has committed to parsing the file.

A firm publishing llms.txt is performing legitimacy for an audience that is not reading. It is a tell, not a mechanism.

That is a more useful finding than the one I went looking for. It tells a buyer something about who the material was written for, and it should go on the list of things to notice. It does not tell you how a phantom actually reaches a board.

4.3 The mechanism is the data void, and it has been measured

Consider how a director actually behaves in November 2026. She does not open a search engine and work through ten blue links. She asks an assistant for independent alternatives to an expert network, or for firms that will give a straight view on a vendor. The assistant retrieves, synthesises and recommends. It has no mechanism for establishing whether the firm it is naming exists.

Netcraft measured the consequence in July 2025. Asking a current generation model for the login address of each of fifty well-known brands, using plain questions and no manipulation, it received one hundred and thirty-one distinct hostnames. Only sixty-six per cent were the correct domain. Twenty-nine per cent were unregistered, parked or inactive. Five per cent belonged to unrelated legitimate businesses. Thirty-four per cent were not owned by the brand at all. Netcraft’s own observation is the one that matters here: smaller institutions fared worse than global ones, because they are more thinly represented in the training data.

In October 2026, researchers at the University of Toronto published a study of one hundred and fifty-eight thousand assistant answers and four hundred and sixty-eight thousand citations across three commercial systems. They found that in forty-six per cent of cases where one of those systems named a brand, there was no cited page supporting the mention at all.

Nearly half of the brand names an assistant produces rest on no cited source. The thinner a firm’s genuine footprint, the more the gap gets filled from whatever happens to be available.

That is the opening, and it is not theoretical. Netcraft documented a live attack built precisely to exploit it. An operator created a fake blockchain interface company and populated the internet with the material a model would retrieve: tutorials, forum answers, dozens of code repositories and multiple fabricated developer accounts carrying biographies, photographs and credible activity history. Netcraft’s assessment is that this content was crafted to be indexed by artificial intelligence training pipelines. At least five developers, some working with assisted coding tools, copied the malicious code into their own public projects, which then became further material for retrieval.

Two further pieces of work show the same effect against invented entities. Ahrefs built a fictional manufacturer, published an artificial-intelligence-generated site for it, then planted three conflicting third-party accounts including an invented founder and location, and tested eight assistants across fifty-six questions. Five of the eight adopted the invented details in preference to the company’s own published position. That study has a fair methodological criticism against it, published by Search Engine Journal, which is that most of the questions presupposed the company existed, and I record that criticism here rather than leave a reader to find it. Separately, NewsGuard documented a network of one hundred and fifty sites publishing fabricated material aimed at machine retrieval rather than at human readers, and found that seven of ten leading assistants cited those sites directly. That finding also drew a peer-reviewed challenge, in the Harvard Kennedy School’s Misinformation Review, arguing that the behaviour reflects gaps in available information rather than successful manipulation. I accept that challenge, and it does not help the reader: a gap in available information is exactly what an unknown advisory firm presents, and filling it cheaply is exactly what a phantom does.

4.4 What I am not claiming

I have found no documented case of a fabricated advisory or research firm being cited to a buyer by an artificial intelligence assistant. I looked for one and it does not appear to exist in the public record. I are not going to assert it.

What exists is this. The conditions have been measured and they are present. The technique has been documented in an adjacent market. The incentive is obvious and the cost is near zero. A reasonable board should treat that as a risk to control now rather than a risk to confirm later, because the confirmation will arrive in the form of somebody’s loss.

The control is specific and I recommend it be adopted immediately. Where an artificial intelligence tool has suggested or shortlisted a counterparty, record that fact in the procurement file, and treat the shortlist as unverified until every name has been through the identification test. An assistant’s recommendation is a lead. It is not diligence, and it will not be treated as diligence by a court asked later whether the board took reasonable steps.

Sources: John Mueller, quoted in Search Engine Land, “Does llms.txt matter?”; Netcraft, “Large language models are falling for phishing scams”, 1 July 2025; Chen and Koudas, University of Toronto, arXiv 2610.15033, 10 October 2026; Ahrefs, “AI vs made-up brand experiment”, 10 December 2025, and the critique in Search Engine Journal, 28 December 2025; NewsGuard, 6 March 2025, and the response in Harvard Kennedy School Misinformation Review.

5. Polish used to be expensive, and buyers still price it as though it is

Experienced people judge an unfamiliar counterparty by the quality of its material. That was rational for as long as quality was expensive, because a costly signal is hard to fake. Quality is no longer a costly signal. A senior executive reading a well-argued paper on a well-built site and concluding that serious people must be behind it is applying a rule that worked for thirty years and stopped working in about eighteen months.

Set that against the economics on the other side. There is no office, no staff, no infrastructure and no recurring expense of any kind, while a single engagement at the rates in section 2 runs from seven and a half thousand United States dollars to seventy-five thousand.

5.1 Why the artificial intelligence budget is the softest target in the business

Phantoms do not pick this costume at random. Four things make advisory work on artificial intelligence the most attractive line to attack, and three of them are features of a well-run company rather than failings.

• The budget moves faster than any other. Boards have told management to show progress, and management is measured on it. A fixed-price engagement below the threshold that triggers full procurement is approved in days where a core systems vendor would face months.
• The buyer frequently cannot assess the expertise, which is usually the stated reason for buying it in. The assessment falls back on presentation.
• The category explains away the absence of history. A small specialist firm nobody has heard of is normal here and often preferred, so the usual warning sign has been reclassified as a selling point. No other category offers a fraudster that gift.
• Independence is the pitch, and independence is unfalsifiable. A buyer who wants a straight answer about a technology purchase is predisposed to believe the one party claiming no stake in the answer.

Put those together and the picture is specific. The counterparty is small, new, unknown, highly polished, sells expertise the buyer cannot test, claims an independence that cannot be checked, prices below the procurement threshold and asks for payment in advance. Every one of those facts is innocuous on its own and normal in this market. That is why the identification test has to be mechanical. Judgement will not catch this, because judgement is what is being exploited.

6. The category is documented, and the capable end buys a real registration

None of this is hypothetical, and the record is better than most boards realise. It sits in two places that rarely reach a procurement committee: counter-intelligence announcements and threat-research publications.

6.1 Thirteen sham consultancies, and one of them was Australian

On 10 June 2026 the United States Department of Justice announced that the Federal Bureau of Investigation had disabled thirteen internet domains, every one of them a fake consulting company website, operated by suspected agents of a foreign state. The Department’s own description is that the conspirators created at least thirteen fake consulting company websites and that the sham consulting sites were crafted to deceive. The method was job advertisements for vaguely defined consulting work carrying invented titles, aimed at current and former government and military personnel, with payment offered for research reports.

One of those thirteen domains matters directly to readers in this region. It had taken the identity of a real Brisbane consultancy, Horizzen, copying its name, its business address, its telephone number and its content behind a different design. Horizzen is the victim here and nothing in this paper suggests otherwise. The detail worth sitting with is the timeline. The firm began receiving applications for jobs it had never advertised from the middle of 2025, and the scale of what had been done with its identity only became apparent in June 2026. For roughly a year, a counterparty calling itself by an Australian firm’s name, at that firm’s address and telephone number, was transacting with people who had no reason to doubt it.

A week earlier, on 3 June 2026, the intelligence services of Australia, Canada, the United States, the United Kingdom and New Zealand issued a joint bulletin warning that foreign intelligence officers were posing as online recruiters and consultants representing fake cover companies located outside their own country, targeting people with access to privileged information. The Australian Security Intelligence Organisation was a party to that bulletin. The domain impersonating the Brisbane firm was seized within a day of its publication.

6.2 The model works without artificial intelligence, which is the uncomfortable part

In 2021 a cybercrime group associated with ransomware operated a wholly fabricated cybersecurity company. It had a professional website, a social media presence and active profiles on a professional network for staff who did not exist. It hired real, qualified security professionals on well-paid remote contracts. Those people believed they were conducting legitimate penetration testing. They were in fact mapping the networks of target corporations and identifying vulnerabilities, and in some instances the work resulted in backdoors and malware being placed.

Both of those predate generative artificial intelligence entirely. The business model was already proven. What has changed is that it no longer requires a team.

There was already a priced market in synthetic professional identity before the current tooling existed. Researchers at the Stanford Internet Observatory identified more than one thousand profiles on a professional network using machine-generated faces, listing more than seventy real businesses as their employers. One firm found sixty profiles claiming to work for it, none of whom ever had. The service was being sold openly, with one vendor advertising fully branded avatar profiles at one thousand three hundred United States dollars a month and another offering generated avatars at three hundred. That was in 2022.

6.3 Why a registration number does not close the question

This is the objection every experienced reader will raise, and it is correct, so I will deal with it rather than wait for it.

In April 2025 threat researchers documented three front companies operating in cryptocurrency consulting on behalf of a state-linked group. The staff were fabricated, with profiles across three social platforms and photographs generated by a commercial image tool. Reuters reviewed the companies’ filed registration documents. One of the three was a properly registered limited liability company in New Mexico, with a real registered agent engaged through a well-known incorporation service. Its registered address, used for every member and organiser, was an abandoned lot in South Carolina. The Bureau later seized the domain.

A registration number proves that a filing was made. It does not prove that a business exists.

So the twelve markers in section 2 are the first stage, and they will catch the cheap end of this category, which is most of it. They will not catch an operator willing to spend a few hundred dollars on an incorporation service. For any engagement of consequence, the second stage is short and it is where the capable phantom fails.

• Does anything exist at the registered address. A satellite image and a street view take two minutes, and an abandoned lot, a mailbox service or a residential flat shared with forty other companies is an answer.
• Do the named officers have histories that exist independently of the counterparty’s own material. A person who appears on the internet only in connection with this one firm, and whose photograph returns nothing on a reverse image search, has not been verified by the existence of a profile.
• Can you reach a human being on a number you found yourself, rather than one the counterparty supplied.
• Will a named client confirm the relationship, contacted on details you obtained independently. References supplied by the counterparty test nothing, because the referee is as easy to fabricate as the firm.
• How long has the entity existed, and does its filing history match the operating history it claims. A company incorporated last quarter that describes seven years of work has told you something.

6.4 No prudential regulator has addressed this, and that is the point

I looked for a regulatory warning aimed squarely at the fabricated counterparty in third-party risk management. I did not find one, and I think the absence is worth stating plainly rather than papering over.

What exists sits beside the problem without covering it. The United States Financial Crimes Enforcement Network issued an alert in November 2024 on generative artificial intelligence being used to create falsified documents, photographs and video, and to build synthetic identities that pass verification. That alert is directed at customer onboarding, not at vendor onboarding, and it does not address fabricated corporate records. The Bureau’s own public service announcement of December 2024 warns that criminals use generative tools to create fictitious profiles in volume, to generate content for fraudulent websites, and to generate video for real-time calls with people posing as company executives or authorities. The Five Eyes bulletin addresses fake cover companies used for intelligence recruitment. Supervisory material from Australian regulators on artificial intelligence addresses whether a firm can govern its vendors’ models.

Every one of those is about something adjacent. None of them asks the question this paper asks, which is whether the vendor exists at all. The conclusion I draw is not that boards should wait for the guidance. It is that the duty to ask the question already sits with them, and that when the guidance does arrive it will be describing losses that have already happened.

Sources: United States Department of Justice, press release 26-629, 10 June 2026; Guardian Australia, August 2026, on the Brisbane firm whose identity was cloned; Five Eyes joint bulletin “Safeguarding My Secrets”, 3 June 2026; Gemini Advisory, October 2021; Google Threat Analysis Group, 31 March 2021; Silent Push, 24 April 2025, and Reuters, 24 April 2025; Stanford Internet Observatory research reported by NPR, 27 March 2022; FinCEN Alert FIN-2024-Alert004, 13 November 2024; FBI IC3 alert I-120324-PSA, 3 December 2024.

7. The exposure in Asia-Pacific, in numbers that survive checking

A word first about the numbers themselves, because this paper is in no position to be careless with them.

Several of the most widely quoted figures in this field are drawn from the internal detection data of commercial verification platforms. They are useful and they are the best series available, but they measure attempts caught on one vendor’s systems by one vendor’s definitions. They are not official statistics and no one has audited them. Where a figure below comes from that kind of source, I say so in the sentence that carries it. Two figures in my earlier draft of this paper did not survive checking and have been removed rather than softened.

7.1 The aggregate

The United Nations Office on Drugs and Crime reported in July 2026 that transnational online scam operations in South-East Asia cost victims up to one hundred and fourteen billion United States dollars in 2025. That is the aggregate for the region’s organised online fraud economy, not a corporate-only figure, and it is the scale of the industry that the techniques in this paper are drawn from.

7.2 The deepfake curve

7.3 The vector that actually takes the money

Deepfakes attract the headlines. Invoice and vendor fraud takes the money, and it mostly does so without any artificial intelligence at all.

The Singapore Police Force issued an advisory on 20 May 2026 recording that since 1 January that year at least sixty-six business email compromise cases had been reported, with total losses of at least nineteen million dollars. The pattern described is the oldest one there is: the victim is told that a vendor’s bank account details have changed and is instructed to pay the new account. The advisory attributes the mechanism to spoofed or compromised email accounts. It records no artificial intelligence element, and I am not going to imply one.

The Association for Financial Professionals, surveying organisations in January 2025 about the year before, found that forty-five per cent reported vendor imposter fraud among the payments fraud they faced in 2024, up eleven percentage points on the previous survey. The FBI’s Internet Crime Complaint Centre recorded two point nine five billion United States dollars of adjusted losses across twenty-one thousand four hundred and eighty-nine business email compromise complaints in 2023, an average of about one hundred and thirty-seven thousand dollars for each complaint reported.

The corporate structure problem is already on the supervisory record in this region. Following the August 2023 case in which Singapore police seized or restrained more than three billion Singapore dollars in assets and ten people were convicted, the Inter-Ministerial Committee published recommendations in October 2024 on deterring the misuse of companies and on the standards expected of corporate service providers acting as gatekeepers. The concern is the same one this paper raises, approached from the laundering side rather than the procurement side.

Sources: UNODC press release, July 2026; Sumsub third and fourth annual Identity Fraud Reports, 28 November 2023 and 20 November 2024 (platform detection data); Singapore Police Force advisory, 20 May 2026; Association for Financial Professionals Payments Fraud and Control Survey, released 15 April 2025; FBI IC3 Internet Crime Report 2023; Singapore Inter-Ministerial Committee recommendations, 4 October 2024.

8. A face and a voice on a call are no longer evidence of identity

In January 2024 a finance employee at the Hong Kong office of Arup, the engineering firm, took part in a video conference about a confidential transaction. Every other participant on that call was fabricated, constructed from material that was publicly available. The employee authorised fifteen transfers totalling two hundred million Hong Kong dollars, about twenty-five point six million United States dollars, to five local bank accounts.

One detail is routinely reported wrongly and I will state it carefully. Early police comment described a video conference in which the employee was the only real participant. In June 2024 Hong Kong’s Secretary for Security told the Legislative Council that the meeting had been pre-recorded, assembled from publicly available video and audio of the people impersonated, rather than generated live and interactively. The distinction matters to anyone designing a control, because it means the attack did not require real-time synthesis. It required a video call the victim could not interrupt and a reason not to question it.

I have found no public report of any arrest, charge or recovery in that matter as at the date of this paper.

Twenty-five million dollars moved because a face on a screen was accepted as proof of who was speaking. No system failed. The control that failed was an assumption.

A closer case sits in Singapore. The Singapore Police Force reported in April 2025 that the finance director of a multinational had been induced to transfer more than four hundred and ninety-nine thousand United States dollars after a video call on which the company’s chief executive, among others, had been impersonated using deepfake technology, the approach having begun with a message purporting to come from the chief financial officer. The fraud was exposed the following day when a further request for one point four million dollars was made. Hong Kong police withheld the onward transfer and the money was recovered, which is unusual and should not be planned for.

The FBI’s public service announcement of December 2024 describes the general method plainly: criminals generate video for real-time calls with people posing as company executives or authorities, create fictitious profiles in volume, and generate the content of fraudulent websites. Payment approval processes that treat a recognisable face and voice as sufficient proof of identity are built on an assumption that stopped being true. Standard email filtering and identity management controls do not see a video call at all.

Sources: South China Morning Post and Hong Kong Police Force statements, February and May 2024; Hong Kong Secretary for Security, Legislative Council, 26 June 2024; Singapore Police Force release, 7 April 2025; FBI IC3 alert I-120324-PSA, 3 December 2024.

9. Directors are already exposed, under duties that already exist

Boards waiting for artificial intelligence legislation before they act on this have misread their position. The duty that bites is the ordinary duty of care and diligence, and it bites now.

9.1 What ASIC has already said

In Australia, section 180 of the Corporations Act 2001 requires directors to exercise their powers and discharge their duties with the care and diligence that a reasonable person would exercise. On 29 October 2024 the Australian Securities and Investments Commission published Report 798, Beware the gap: Governance arrangements in the face of AI innovation, following a review of twenty-three financial services and credit licensees.

Two sentences from that report do the work. The first is that company directors and officers must discharge their duties with a reasonable degree of care and diligence, and that those duties extend to the adoption, deployment and use of artificial intelligence. The second is that licensees remain responsible for outsourced functions. The report also records that the regulatory framework is technology neutral, which disposes of the argument that the law has not caught up.

The review found that thirty per cent of the use cases examined ran on models developed by third parties, that some licensees did not have robust third-party management procedures, and that at least one could not identify the technique used in all of its own models and produced no third-party supplier policy or documented process. That is the state of third-party artificial intelligence governance as the regulator found it, among licensed entities, in a reviewed population.

9.2 Where this leaves a board

Directors of Singapore companies are subject to a statutory duty to use reasonable diligence in the discharge of their office, and directors of Hong Kong companies to a duty to exercise reasonable care, skill and diligence. The analysis does not change materially across the three jurisdictions.

Engaging a counterparty that later proves to have no legal existence, or paying on an instruction verified only by a video call, creates a clean evidentiary record of what was and was not done. The question asked afterwards will not be whether the board anticipated the specific technique. It will be whether ordinary verification steps, available and cheap at the time, were applied. Reliance on an external expert has to be reasonable reliance, and reliance on a party whose identity could not be established is difficult to characterise that way.

Boards should not expect to transfer this. Cover for fraudulently induced payment and for losses arising from artificial intelligence is frequently narrow or excluded, and the position differs by policy. Treat it as residual risk to be controlled operationally, and have someone read the policy wording before assuming otherwise.

Sources: Corporations Act 2001 (Cth) s 180; ASIC Report 798, published 29 October 2024. This paper is not legal advice and the position should be confirmed with counsel in the relevant jurisdiction.

10. The hard gate: what has to be true before money moves

Five controls. None of them is novel, which is the point. The failures I are describing are not failures of control design. They are failures to apply controls that are already written down, against a counterparty whose polish made the application feel unnecessary.

10.1 Identity before engagement, with no exceptions for small amounts

Verify the registration number and obtain the extract from the relevant registry, whether ACRA, Companies House, ASIC or the local equivalent. Verify the registered office and that something is actually at it. Identify the principals and confirm their histories independently of what the counterparty tells you. Where the engagement is material, confirm beneficial ownership.

Email-only contact and the absence of registry data should be disqualifying. I would go further. A counterparty that cannot produce a registration number within one business day of being asked has answered the question, and the engagement should stop there rather than proceed while someone chases the document. In my experience the chase is where these engagements are won, because the file stays open, the deadline arrives, and the work starts before the gap is closed.

10.2 Out-of-band verification for every payment instruction

A face and a voice on a video call are no longer evidence of identity. That sentence should be written into the payments policy in those words, because the control only works if the person approving the payment has been told plainly that what their own eyes are reporting is not reliable.

Callback to a number held on file before the request arrived, never a number supplied in or alongside the request. Dual authorisation. Separation of requestor from authoriser. Any change to vendor bank details treated as a new counterparty rather than an amendment. Urgency and confidentiality treated as risk indicators rather than as reasons to move faster, since both are standard features of the attack. Document the steps taken, because the documentation is what later demonstrates that the process existed.

10.3 An inventory of every artificial intelligence dependency

Maintain a register of artificial intelligence vendors and advisers, what each one touches, and what would happen if it failed or proved to be something other than it claimed. Require evidence of prior delivery and references that can be contacted independently, which means contact details obtained other than from the counterparty. Contract for audit and termination rights.

10.4 Treat an answer-engine recommendation as a lead, not a reference

Record when a counterparty was surfaced by an artificial intelligence tool. Verify the name against a registry before it reaches a shortlist. The recommendation carries no diligence with it, however authoritative the tool sounds.

10.5 Put it in front of the board, with the scenarios run

Directors should receive regular reporting on artificial intelligence use, material third-party dependencies and the effectiveness of fraud controls. Scenario testing should include a deepfake payment instruction and the onboarding of a counterparty that does not exist. Both scenarios are cheap to run and uncomfortable in the right way. A board that has run them and documented the result is in a materially different position from one that has not, both operationally and in evidence.

11. Conclusion

Faceless Phantom Firms are the cleanest expression of it. They require no stolen identity, no compromised mailbox and no technical intrusion. They require a plausible name, competent writing, a published price and the reasonable assumption on the buyer’s part that something this polished must be attached to something real. They are aimed at the one budget line that is currently approved faster than any other, and at buyers who are under visible pressure to demonstrate progress.

They also sit at the end of a range rather than in a category of their own, and a buyer should hold the whole range in mind. Plenty of counterparties carry some identification and fabricate the rest, and those are the ones a registry check is designed to catch. The faceless end carries none of it, and there the right response is not suspicion of a particular firm. It is a single question asked of any of them. Becoming identifiable costs a few hundred dollars and an hour. Why has this counterparty, asking for tens of thousands, declined to spend it.

None of the controls that defeat them is new. Verify existence before engaging. Verify instructions out of band before paying. Keep a register of who you depend on. Treat a machine’s recommendation as a lead. Report it to the board. Every one of these was in the manual before generative artificial intelligence existed, and every one of them still works.

What has changed is the cost of not applying them, and the ease with which a competent facade now survives a cursory look. Residual risk cannot be eliminated, and will rise further as agentic systems reduce the cost of reconnaissance and personalised approach. But the exposure narrows sharply the moment one rule is applied without exception, including to the counterparty whose website is better than yours.

No verifiable legal existence, no engagement, no payment.

12. How I verified this, and an open offer

A paper arguing that people and firms publish claims they have not checked is obliged to show its own working. Mine is set out here so that any reader can repeat it.

The examination of theoryintelligence.com was carried out on 3 November 2026 by direct inspection of the live site, including the home, about, briefing, terms and privacy pages, the structured organisation data embedded in the site, and the machine-readable llms.txt file. Domain facts were taken from the Verisign registry record for each domain, retrieved the same day, and not from a commercial lookup service. The professional network page was tested from an authenticated account, which matters, because an unauthenticated visitor is shown a sign-in prompt rather than the true status of the page. Company and people searches on that network were run from the same account. A screenshot of the result is retained.

Every figure drawn from a third party carries its source and the date of that source in the text beside it. Where a figure is widely repeated in commentary but could not be traced to a primary source, I have either dropped it or said so in terms. Two figures in an earlier draft did not survive checking and were removed rather than softened. Nothing here is cited from memory.

The account of my own experience in 2012 is given as my account, which is what it is. The surrounding matters that are established on oath or by judgment are identified as such. The primary documents, including the public inquiry transcripts and the judgments, are published in full on the record page of this site. I have not asked anyone to take my word for any of it.

12.1 The offer

This paper records what the public record contained on 3 November 2026. If Theory Intelligence provides a registered name, a registration number, a jurisdiction of incorporation and a named principal, I will verify them against the relevant registry and publish a correction. That offer is open and stands without qualification. I extend the same offer to any firm named in this paper, and I would expect any firm that names me to extend it to me.

There is a structural point inside that offer worth stating plainly, because it is the same point the paper makes about counterparty risk. You cannot defame something that cannot be identified. For anyone to take issue with what is recorded here, they would first have to say who they are, under which law, and in which jurisdiction. Those are the very particulars whose absence is the subject of the record. The same gap that leaves a buyer with nobody to sue leaves the firm with nobody to sue on its behalf. That is not a clever position anyone has engineered. It is what nil identification means, looked at from the other side, and any firm that finds itself in it has put itself there.

I say that for a reason that goes beyond courtesy. The entire argument of this paper is that identity should be cheap to confirm and expensive to fake. A firm which can close the question in one email has every incentive to do so, and the ones that will not are telling you something you should price.

About the author

Paul Gardner Brook is a merchant banker with more than thirty years in international investment banking, including senior roles at Lehman Brothers and Nomura, and is Chief Executive Officer of PanEuro Special Situations Limited, London and Singapore. He writes on capital markets, energy, critical minerals, technology and public policy.

The documentary record of the matters referred to in section 1, including the public inquiry transcripts, the judgments and the supporting material, is published in full and without charge at paulgardnerbrook.com/record.html.

This paper is published for general information. It is not legal advice, it is not financial product advice, and it does not take account of the objectives or circumstances of any particular person. Third-party figures are reported as their sources state them. The paper records what public sources did and did not contain on the date stated. It makes no allegation of dishonesty or unlawful conduct against any firm or individual named in it, and no such allegation should be inferred. Statements concerning the author’s own experience are identified as his account where no court or commission has made a finding.