EY has withdrawn a research report on loyalty rewards programmes after investigators found that it contained fabricated data, incorrect references, and apparent AI-generated hallucinations. The report had been used by EY consultants in Canada to promote their cyber security services but was later flagged by researchers who identified multiple inconsistencies and false citations.
The study, titled “Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems,” was removed from EY Canada’s website after the research group GPTZero reported that it relied on misleading or entirely invented information. Among the issues identified were references to a McKinsey report that does not exist, mismatched statistics regarding the size of the loyalty market, and claims suggesting both the total market value and unclaimed loyalty points amounted to $200bn.
GPTZero researchers also found that more than half a dozen footnotes in the document linked to non-existent web pages or sources that did not support the claims attributed to them. They warned that publishing such material online risks polluting the broader information ecosystem, particularly when produced by large consulting firms whose reports are widely shared and trusted.
The incident adds to a growing list of cases in which professional services firms have been caught out by generative AI errors. Rival firm Deloitte previously had to correct a report prepared for a Canadian provincial government after fake academic citations were discovered, while law firm Sullivan & Cromwell recently apologised to a New York court after filing documents containing incorrect legal references and misquotations.
Despite these setbacks, consulting firms continue to rapidly integrate AI into their operations and client offerings. EY has previously highlighted significant growth in its AI-related revenue and has trained thousands of employees in AI deployment and governance frameworks, positioning itself as a leader in responsible adoption of the technology.
EY stated that it had removed the report and was reviewing how the publication occurred, emphasising that the study was not linked to any client engagement. The firm also reaffirmed its commitment to accuracy and responsible use of AI, even as the incident underscores the ongoing risks of relying on systems that can generate plausible but incorrect information.
