The Hyper-Realistic AI Face Swapping Tool Fueling Romance Frauds

The Chinese-language artificial intelligence application Haotian has proven to be so effective that it has generated millions from selling its face-swapping technology on Telegram. The service seamlessly integrates with messaging platforms like WhatsApp and WeChat, offering users the ability to modify up to 50 settings—such as cheekbone size and eye position—to closely mimic the face they want to impersonate. Nevertheless, while Haotian is a powerful and adaptable platform, both researchers and an analysis by WIRED have discovered that it has been targeted by “pig butchering” scammers and others involved in online fraud in Southeast Asia.

Scammers have leveraged Haotian and similar deepfake tools to enhance their deceptions, enabling victims to “video chat” with the personas they think they are engaging with in contexts such as investment opportunities, friendships, or romantic ties. An analysis by the cryptocurrency tracing firm Elliptic of four cryptocurrency wallets associated with Haotian reveals that the company has received at least $3.9 million in payments over recent years, including funds from wallets connected to alleged criminal activities like fraud. Furthermore, nearly half of its financial transactions have links to a scam marketplace sanctioned by the US government, according to Elliptic.

Hieu Minh Ngo, a former criminal hacker now turned cybercrime investigator at the Vietnamese nonprofit ChongLuaDao, states that Haotian, which emerged around 2021, was “one of the first of its kind and very popular.” Ngo has conducted extensive research into Haotian and its operations. “Its results are nearly perfect,” he remarks. “And they are improving daily. If you check the crypto wallet, you will see money coming in every single day.”

Haotian represents just one segment of the broader technology ecosystem that has developed alongside Southeast Asia’s flourishing cybercrime industry and forced labor scam compounds. As face-swapping and other video deepfake tools have become more accessible, they have increasingly been adopted in scamming and various forms of cybercrime globally. Over the past two years, officials from the United Nations Office on Drugs and Crime have identified more than 10 face-swapping tools that may be utilized by cybercriminals in Southeast Asia, including for cryptocurrency scams and impersonating police officers.

Haotian has a dedicated website for its face-swapping service, but it primarily promotes its desktop application through a public Telegram channel that launched in October 2023, based on Ngo’s findings. This channel, which currently boasts over 20,000 subscribers, is used to market new app versions, provide development updates, and offer technical support. While promoting software through Telegram is not inherently malicious, researchers note that Haotian’s clientele has increasingly leaned towards scammers who seek information about various gray market services on the messaging platform.

Telegram declined to comment. However, following WIRED’s inquiry, the main public Haotian Telegram channel and several associated accounts have become inaccessible or seem to have been deleted. Telegram has not responded to a request for clarification about whether the company was responsible for taking these accounts down.