Case Study: How a Deepfake Campaign Targeting Ana Botín Grew to 34 Ads in a Single Day

A deepfake ad campaign impersonating Ana Botín grew from three test ads in December 2025 to 34 fraudulent ads in a single day by June 2026: a clear picture of how organized impersonation operations probe, refine, and scale over months when no one is watching.

This is a real case. The data comes from Revelum’s detection systems, which began tracking this campaign in December 2025, though the campaign may have been active before that; December is simply when our monitoring first picked it up.

The target is Ana Botín, Executive Chairman of Banco Santander, one of the world’s largest financial institutions. Her name and face carry enormous authority across Europe and Latin America, exactly the kind of credibility that makes someone valuable to impersonate.

The campaign is still active. And it is still growing.

One important note on scope: everything described here was identified using Revelum’s light alert detection model, a baseline monitoring layer designed for early signal detection. The full scope of this campaign, across all platforms and variants, is almost certainly larger than what is shown here. This is a sample, not a ceiling.

---

How It Started: Testing the Waters

On December 5, 2025, Revelum first detected fraudulent ads impersonating Ana Botín, documented on various social media platforms including Facebook and Instagram. The ads were in Spanish, targeting audiences in Spain, and promoted a fabricated investment platform, the standard template for this type of fraud.

Three ads is not a campaign. It is a probe.

This is a pattern we see consistently in organized deepfake ad fraud operations. Attackers do not go all-in immediately. They run a small number of ads first, testing which creatives get approved by the platform, which targeting parameters reach the right audiences, and which versions of the fabricated content generate the most engagement and clicks. The investment is minimal. The risk of detection is low. And the data they collect shapes everything that comes next.

Over the following weeks, a handful more ads appeared, one here, two there. Quiet. Methodical.

---

First Escalation: January 2026

In early January, the operation shifted. On January 7 and 8, five then nine new fraudulent ads launched in two days. This was the first real campaign push, a clear transition from testing to execution.

Then it went quiet again. Not because the attackers stopped, but because they were watching results and preparing the next wave.

---

The Scaling Phase: March Through April

March brought the first sustained wave. The campaign relaunched with a new burst of ads across mid-March, five to nine per day, then settled into a rhythm of escalating volume through the end of the month and into April.

By April 13 and 14, the operation was running 15 and 16 new fraudulent ads per day. By this point, the attackers had refined their approach across months of testing. They knew which ad formats worked, which audiences converted, and how to rotate creative variants fast enough to stay ahead of platform moderation.

This is what scaling looks like in practice: not a sudden explosion, but a steady, deliberate ramp built on accumulated intelligence.

---

The Peak: June 17, 2026

On June 17, 2026, Revelum detected 34 new fraudulent ads in a single day, the highest daily volume recorded in this campaign to date.

By this point, the campaign had run for more than six months and generated hundreds of individual ads across multiple waves. The operation behind it had iterated through dozens of creative variants, tested different audience segments, and built the infrastructure to spin up new ads as quickly as old ones were removed.

This is what an unmonitored deepfake campaign looks like over time. Not a single incident, but a compounding operation.

Below are examples of fraudulent ads detected by Revelum. The fabricated content uses Ana Botín’s likeness to promote fake investment schemes targeting Spanish-speaking audiences.

---

What This Campaign Reveals

A few things stand out about this case.

The target is chosen deliberately. Ana Botín is one of the most recognized faces in European and Latin American banking. Her authority is the product being sold. Attackers do not pick targets randomly. They pick people whose credibility transfers most effectively to a fraudulent pitch, and they invest in building convincing fabrications of those specific people.

The platform is the distribution channel. This campaign runs on paid advertising. The fraudulent content is not just circulating organically, it is being actively promoted to targeted audiences. Real money is being spent to reach real victims, which is exactly why executive impersonation scams thrive on social platforms.

Speed of escalation is the risk. The distance between three test ads in December and thirty-four ads in a single day in June is six months. For organizations without proactive monitoring in place, the first sign of a campaign like this is often a journalist calling, a customer complaining, or a regulator sending a letter. By that point, the operation has been running for months. This campaign was covered by RTVE, Spain’s national public broadcaster, confirming that deepfakes impersonating Ana Botín in fake investment schemes had already reached mainstream public awareness by August 2025, nearly six months into the campaign Revelum had been tracking.

Early detection changes the outcome. The cases where damage is contained are almost always the ones where detection happened early, while the campaign was still in its testing phase and before the infrastructure behind it was fully built out. A campaign caught at three ads is a very different problem than one caught at three hundred.

This is a sample, not the full picture. Revelum’s light alert model, used to track this case, is designed for early signal detection across a broad surface area. It is not the full depth of what our systems can see. The real volume of this campaign, across all platforms, variants, and distribution channels, is likely significantly higher than what is shown here. In cases we have handled across Latin America, we have documented executives targeted by more than 8,000 fraudulent deepfake ads in a single month. Ana Botín’s case is notable for the reach of the target, not for its scale.

---

What Revelum’s Technology Detected

This campaign was identified and tracked using Revelum’s proprietary detection infrastructure, which combines biometric face and voice matching, ad library monitoring across major social platforms, and pattern recognition built on hundreds of real-world deepfake campaigns.

The light alert model operates continuously, surfacing new instances of a target’s likeness appearing in fraudulent content without requiring manual submission of content for review. When a new ad appears using Ana Botín’s face, Revelum’s system flags it, logs it, and tracks it as part of the broader campaign, whether or not it shares creative elements with previous ads.

That continuous, proactive monitoring is what makes it possible to see the full arc of a campaign like this one, from the first detection in December to the peak in June, rather than encountering it as a series of disconnected incidents.

---

The Bottom Line

This campaign has been running for more than six months. It is still active. And because it has not been fully disrupted at the infrastructure level, the volume is continuing to grow.

The organizations that fare best in situations like this are the ones that are monitoring before something surfaces publicly, and that have a response ready when it does.

If someone you protect could be a target, the question is not whether monitoring is worth it. The question is how much of a head start you are willing to give the people running campaigns like this one.

Contact Revelum

We will assess your exposure and tell you what we are seeing, typically within 24 hours.

---

Revelum is a deepfake detection and removal service operating globally, with a focus on the Americas and Europe. We protect executives, public figures, political leaders, and organizations from AI-generated disinformation and fraud.

Disclaimer: This article is intended for informational purposes only and does not constitute legal advice. Every situation is different, and we strongly recommend consulting a qualified legal professional for guidance specific to your circumstances. Revelum’s services are operational in nature and do not replace legal counsel.

---

A note on responsible disclosure: Revelum did not discover this campaign by monitoring Ana Botín or Santander specifically. The fraudulent ads were identified incidentally through Revelum’s broad monitoring of deepfake activity across social platforms, the same process by which hundreds of impersonation campaigns are detected. All content referenced in this report consists of publicly observable paid advertisements accessible via public ad libraries. This campaign has been previously reported by mainstream media, including Spain’s national public broadcaster RTVE, which covered deepfakes impersonating Ana Botín in investment fraud schemes in August 2025. Revelum has made good-faith efforts to notify Banco Santander of this campaign and remains open to working with them directly. This report is published in the public interest, to document a real and growing form of fraud and to help organizations understand the threat. No private, confidential, or proprietary information belonging to Ana Botín or Banco Santander is disclosed here.