EY retracts loyalty rewards report after AI hallucinations and fake footnotes discovered
EY withdrew a cybersecurity report on loyalty rewards programs after researchers found it contained fabricated data and non-existent citations. The report was used by EY Canada for marketing purposes but was retracted once the AI-generated errors were exposed.
The report referenced a McKinsey study that does not exist and used identical figures for different metrics.
Key facts
- What
- EY withdrew a cybersecurity report on loyalty rewards programs after researchers found it contained fabricated data and non-existent citations.
- Incident date
- May 15, 2026
- Who
- EY
- Failure mode
- Hallucination
- AI surface
- Search / RAG
- Severity
- Medium
What happened
EY Canada published a report titled 'Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems' to promote its cybersecurity business. Researchers from GPTZero discovered the document contained fabricated data, misattributed citations, and references to a non-existent McKinsey report. EY subsequently removed the report and launched an internal review of its approval process.
What broke inside the model
- 01 · TriggerA user asks for a fact, a citation, or a figure.
- 02 · Model stepThe model writes a fluent, confident answer.
- 03 · Control gapNothing ties the claim back to a real source.
- 04 · FailureA fabricated fact ships as if it were verified.
- 05 · ConsequenceThe false claim reaches a customer, a court, or the public.
Confidence holds, and even spikes, as the claim detaches from any source.
The AI used to assist in the report's creation hallucinated footnotes and data, including a $200bn figure applied inconsistently to both the market size and unredeemed points. The firm's internal quality control and approval mechanisms failed to verify the citations and data before the report was published online.
What it cost
Sources
- PressEY retracts study after researchers discover AI hallucinationsft.com
- PressAI hallucinations in consulting: EY removes loyalty rewards report containing fabricated data and non-existent citationsafr.com
- PressEY removes loyalty rewards study after AI hallucinations foundinternationalaccountingbulletin.com
Cite this entry
https://failureindex.ai/failures/retracts-loyalty-rewards-hallucinations-fake-footnotesAI Failure Index. "EY retracts loyalty rewards report after AI hallucinations and fake footnotes discovered" (FI-0502). Realm Labs. https://failureindex.ai/failures/retracts-loyalty-rewards-hallucinations-fake-footnotes (indexed Jun 16, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0502. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
- AI Detection & Response (AIDR)
A runtime layer that watches the model's internal state can flag the moment a model commits to a claim it has no support for, and hold or reroute the response before it reaches a user. Realm reads those signals in real time rather than grading the transcript after the fact.