Inside the Deepfake Scam Machine Impersonating David Vélez

An organized operation ran 51 fraudulent ads in a single 30-day window, all cloning the face and voice of David Vélez, founder of the digital bank Nu, to sell a fake investment scheme on Facebook and Instagram. The campaign was detected by Revelum’s monitoring systems and investigated by Forbes Colombia, which published an exclusive report on April 9, 2026. Forbes called it a “machine,” and the description fits: this was not one viral fake but a production line.

This is our breakdown of how that machine worked, and what it reveals about how deepfake fraud operates at scale.

---

The Target: Borrowed Trust

David Vélez is one of the most recognizable figures in Latin American fintech, the founder of Nu (Nubank), a digital bank serving tens of millions of customers across the region. That recognition is exactly what made him valuable to impersonate.

Deepfake scammers do not clone strangers. They clone people whose credibility already exists, because that authority is what they are actually selling. When a familiar, trusted founder appears to personally endorse an investment opportunity, the pitch borrows his legitimacy. Vélez himself had to push back publicly, stating plainly that neither he nor Nu offers investment products or shortcuts to easy money.

---

How the Machine Worked

What made this campaign notable was not a single convincing fake. It was the industrial logic behind it.

Revelum’s detection systems documented 51 fraudulent ads over 30 days (mid-March to early April 2026) across several unrelated Facebook pages, built from only a handful of distinct deepfake videos. These are the findings Forbes Colombia investigated and published. A small library of fakes was recycled across dozens of ad placements, the signature of an operation optimizing for volume and survival rather than craft.

The mechanics followed a repeatable pattern:

• The format mimicked news. The deepfake videos were styled as news interviews, lending the fabricated endorsement the look of legitimate journalism.
• The destinations impersonated real outlets. Victims who clicked were funneled to counterfeit websites dressed up to look like established Colombian news media, where the fake investment pitch continued.
• The distribution was mainstream. The ads ran through the advertising systems of the largest social platforms, served to targeted audiences, not hidden on the fringes of the internet.
• The pressure was engineered. The pitch promised outsized returns and used artificial urgency to push viewers to act before they could verify anything.

---

Why It Was Clearly Organized

The strongest signal that this was a criminal network, not an opportunist, came from the infrastructure. Revelum’s monitoring tied the campaign’s web domains to earlier impersonations of other Colombian business figures, a connection the Forbes investigation documented. Reused infrastructure across multiple high-profile targets is the fingerprint of an organized operation that treats impersonation as a repeatable business, swapping one trusted face for the next while the underlying machinery stays the same.

This is consistent with the broader pattern of deepfake attacks across Latin America and with how executive impersonation on social platforms typically scales.

---

What Happened After the Story Ran

Forbes published its exclusive on April 9, 2026. That did not end the campaign. Since publication, Revelum has detected 356 additional deepfakes of David Vélez circulating online.

This is the same lesson visible in the parallel campaign impersonating Mario Hernández, which kept scaling for months after its own Forbes coverage. A news story does something real and valuable: it warns the public so fewer people fall for the scam. What it does not do is remove a single ad or shut down the infrastructure generating them. The operation kept producing new fakes because nothing was stopping it at the source. Awareness is necessary, but on its own it does not shrink the attack surface, a pattern we examine across cases in why media coverage barely dents a deepfake attack surface.

---

What This Case Teaches

Catching these campaigns early is everything. A campaign detected while it is still recycling six videos across a few pages is a containable problem. The same operation left alone becomes hundreds of ads and counterfeit news sites. Understanding how the takedown process works before you are targeted is the difference between a contained incident and a public crisis.

If your face carries trust, it is a target. Any founder, executive, or public figure whose credibility moves markets or audiences is an asset that an organized network can clone and weaponize, usually without warning.

---

What Revelum Does

Revelum detected this campaign through the same monitoring infrastructure that supplied the evidence for Forbes Colombia’s reporting: continuous scanning of advertising and social platforms for synthetic media that impersonates executives, public figures, and brands, followed by takedown filings tracked until the content is removed.

If you want to understand your exposure, or put a plan in place before a campaign targets you, we’re here.

Contact Revelum

We’ll assess your situation and tell you what we’re seeing, typically within 24 hours.

---

This case was first investigated and published by Forbes Colombia, based on detection data from Revelum. See also our full media coverage of the Forbes and Teleamazonas investigations.

Revelum is a deepfake detection and removal service operating globally, with a focus on the Americas and Europe. We protect executives, public figures, political leaders, and organizations from AI-generated disinformation and fraud.

Disclaimer: This article is intended for informational purposes only and does not constitute legal advice. Every situation is different, and we strongly recommend consulting a qualified legal professional for guidance specific to your circumstances. Revelum’s services are operational in nature and do not replace legal counsel.