EY, one of the world’s Big Four consulting firms, has withdrawn a 44-page cybersecurity report after researchers discovered that 60% of its citations were fabricated — fake Forbes articles, phantom WIRED stories, and a McKinsey report that doesn’t exist. The report was used by EY consultants in Canada to market cybersecurity business.
🔍 THE BOTTOM LINE
A $53 billion consulting firm published AI-generated nonsense and used it to sell work — and only pulled it because a startup caught them. The “slop over substance” problem isn’t just a government issue. It’s everywhere AI touches professional credibility.
What Happened
EY Canada published “Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems” in December 2025 — a glossy 44-page report on loyalty program fraud. Standard Big Four fare: authoritative-looking, data-rich, designed to position EY as a trusted advisor.
GPTZero, the AI-detection firm founded by Edward Tian, ran the report through its hallucination-detection workflow and found:
- 60% of references were hallucinated — citations to articles and reports that simply don’t exist
- A Forbes article by Blake Morgan titled “The $200 Billion Loyalty Economy” — linked from the report, returns a 404 error, and was never indexed on the Internet Archive
- A WIRED story on “AI Voice Deepfakes Targeting Call Centers” — also doesn’t exist
- A McKinsey “Loyalty Economics Report” — no such report can be found anywhere
- A CyberNews report link that leads nowhere
- The claim that 30-50% of loyalty points go unredeemed was attributed to a McKinsey study that appears to have been a “secondhand hallucination” scraped from a separate FinancialIT.net article
EY withdrew the study after being contacted by the Financial Times. They did not respond to multiple requests for comment before publication.
The Ironic Twist
EY — the same firm that publishes thought leadership on managing hallucination risk in LLM deployments — couldn’t manage hallucination risk in its own consulting reports.
As Oxford Internet Institute professor Sandra Wachter put it: “It doesn’t understand the question that you’re asking. It doesn’t understand the concepts that you are trying to convey. It doesn’t go back to a well-curated library to help you find an answer to your question.”
Why This Matters
This isn’t a small consulting shop cutting corners. EY generated $53.2 billion in global revenue in fiscal year 2025, with $16.4 billion from consulting alone. Their reports shape corporate decisions, influence regulators, and are cited by governments.
GPTZero’s investigation found five other consulting reports from various firms with similar hallucination problems, out of more than 3,000 PDFs scraped and analyzed. This is likely the tip of the iceberg.
The EY report was specifically used by consultants in Canada to market cybersecurity services. Clients were being sold solutions based on data and citations that were fabricated by an AI that made things up — and nobody at EY checked.
🔍 THE BOTTOM LINE
If a $53 billion firm can’t tell when its own reports are AI-generated fiction, what chance does a small business have? The EY withdrawal isn’t just embarrassing — it’s proof that the “slop over substance” problem has reached the highest levels of professional services. And as NZ experts have pointed out, the same dynamic is playing out in government AI adoption here: deploying first, governing later, and hoping nobody checks the footnotes.
❓ Frequently Asked Questions
Q: What does this mean for NZ? NZ has no mandatory AI accuracy standards for consulting firms advising government or business. The same EY that published hallucinated research operates extensively here. If Big Four firms can’t verify their own citations, the threshold for trusting any AI-assisted professional output needs to rise — fast.
Q: Was the whole report fake? Not necessarily — some citations and data points were legitimate. But 60% fabricated references means the report’s core claims are unreliable. You can’t trust the parts if you can’t identify which parts to trust.
Q: What should I do? If you’re consuming research from any consulting firm, verify citations independently. If you’re producing research with AI assistance, build verification into your workflow before publication — not after someone else catches it.
SOURCES
- Financial Times — Stephen Foley, “EY retracts study after researchers discover AI hallucinations”
- Sherwood News — “AI hallucinations appear to be creeping into consulting reports”
- GPTZero Investigation — Hallucinations in Ernst & Young Report on Loyalty Fraud
- AFR — “EY removes loyalty rewards report containing fabricated data and non-existent citations”
