Faceless Phantom Firms

A category of counterparty is operating across Asia-Pacific that sells expertise and has no verifiable legal existence.

We call them Faceless Phantom Firms, and your onboarding process will not catch one.

We are issuing this paper as an alert to boards, audit and risk committees and the people who approve payments. These firms present as expert advisory, research or cybersecurity practices. They carry no company number, no jurisdiction of incorporation, no registered office and no named human being. They are not shell companies, which exist and can be traced to an owner, and they are not impersonations of real businesses, which have a genuine party at the other end. They are complete professional identities assembled from nothing.

They exist because the cost of looking credible has collapsed and the cost of checking has not. Forty pages of competent writing, a coherent market position and a published price list is now a weekend of work and a few pounds in domain fees. The signal experienced buyers have relied on for thirty years, that quality is expensive and therefore hard to fake, stopped being true in about eighteen months.

Two related vectors travel with them, and they are why this paper covers more than one subject. Payment fraud no longer needs a compromised mailbox, because a face and a voice on a video call are no longer evidence of identity, and twenty-five million dollars has already moved on that basis in Hong Kong. And the tool a director now uses to find an adviser cannot establish whether the firm it recommends exists. In a study of one hundred and fifty-eight thousand assistant answers published in October 2026, forty-six per cent of the cases where a leading system named a brand had no cited source behind the mention at all.

The governance exposure is already live and does not wait for legislation on artificial intelligence. Australia’s regulator has stated that directors’ duties of care and diligence extend to the adoption and use of artificial intelligence, including reliance on third-party vendors, and that licensees remain responsible for outsourced functions. Equivalent duties apply to directors in Singapore and Hong Kong. The question a board is asked afterwards is never whether it anticipated the technique. It is whether ordinary verification steps, cheap and available at the time, were applied.

We have written this because every control that defeats these firms already exists, and almost nobody applies them to the one category they do not fit. Registry diligence assumes there is an entity to find, so a nil result reads as an incomplete search rather than as the answer. This paper sets out what these firms are, a ladder for placing any counterparty on it, a twelve-marker test that takes twenty minutes and needs no subscription service, the documented record of cases, and what has to be true before money moves. The rule it arrives at is one line. No verifiable legal existence, no engagement, no payment.

The rest of the paper is the evidence. We begin with a live specimen, examined on 3 November 2026, because the argument is easier to follow against something real.

A firm that sells verification ought to be the easiest firm in the world to verify. Theory Intelligence, trading at theoryintelligence.com, publishes a standard requiring that every source be real, every figure be traced to its origin and every recommendation be signed by a named researcher. We applied that standard to the firm.

It has no company number, no jurisdiction of incorporation, no registered office, no telephone number and no named person anywhere on the site, including on the articles it publishes. Its terms of business decline to state a governing law. Its privacy policy invites complaints to United Kingdom and European data protection authorities while identifying no controller to complain about. The LinkedIn page it links to from its own footer does not exist. It says it was founded in 2019. Everything it has ever published is dated within eight days of September 2026.

We make no allegation of dishonesty or unlawful conduct against Theory Intelligence or anyone connected with it, and none should be inferred. The point is narrower and more uncomfortable than an allegation. That firm would clear third-party onboarding at a great many companies in this region today, because onboarding tests for documents a website can produce and not for an identity a registry can confirm. It is not the worst example of its kind. It is the clearest, which is why we have set it out in full.

The absence is the finding. In a market where a convincing corporate identity now costs a weekend, nil identification is the single strongest signal available to a buyer.

A counterparty with no registrable existence, and no genuine party to call.

Three things are routinely confused, and the distinction decides what control catches them.

A shell company exists. It is registered, it has a number, it files something somewhere, and the deception sits in who ultimately owns it and what it is used for. Registry diligence finds the entity and then has to work out the beneficial owner behind it.

An impersonation borrows an existence. The fraudster takes a real firm, or a real executive, and poses as them. Callback verification to a previously known number finds it, because there is a genuine party at the other end who can confirm or deny.

A Faceless Phantom Firm has no existence to find and no genuine party to call. There is a name, a domain, a body of competent writing, a price list and an email address. Behind them there is nothing a registry, a court or a process server could reach. Registry diligence returns no result, and the absence of a result is then misread as an incomplete search rather than as the finding itself.

1.1 This is a ladder, not a line

The barriers to appearing expert have collapsed, and they have collapsed faster than the barriers to appearing legitimate. Anyone can look like a specialist overnight. Scrape a competitor’s site, replace the graphics, present the result as your own work, publish a price and start asking for money. That is a weekend, and it requires no particular ability.

What separates one operator from another is not the quality of the facade. It is how much of a real identity sits behind it.

1.2 The question nobody asks the faceless counterparty

Moving from the fourth rung to the first costs a few hundred dollars and about an hour. Incorporation is a commodity service sold online in every jurisdiction that matters. Any firm that wanted to be identifiable could be identifiable by the end of the afternoon.

So the question is not whether a faceless counterparty is legitimate. The question is why a firm advertising engagements at seventy-five thousand United States dollars has declined to spend a few hundred becoming someone you could sue.

There is no innocent answer to that which survives contact with how money actually moves, and this is the part a banker notices before anyone else does. A firm invoicing corporations in US dollars has to be paid. Being paid requires a bank account. A bank account requires an identified account holder, whether that is a company with a number or an individual with a name and a passport. The identity therefore exists. It has to. The only question is when the buyer is permitted to see it.

On the evidence, the answer is after they have committed. The engagement agreement carries the governing law, and the governing law is withheld until the engagement agreement. The invoice will carry a payee, and the payee is not disclosed until there is an invoice. Every piece of identifying information is sequenced to arrive after the decision to engage rather than before it.

That sequencing is the product. It is not an oversight by people who forgot to put an address in the footer. A firm that has thought carefully enough about its positioning to publish a four-rule verification standard has thought about its footer.

The firm sells verification, and fails its own standard at every point.

We have set this one out at length because it is unusually clean. The writing is good. The positioning is coherent. The pricing is published, which most advisory firms will not do. There is nothing crude about it, and that is precisely why it is worth a banker’s attention. The crude ones are already caught.

The proposition is verification. The site publishes four rules it calls The Theory Standard: every source is real, every claim is traceable, artificial intelligence use is disclosed, and a person signs the recommendation. It states that one hundred per cent of sources are verified by a named researcher, that every person is checked and every document opened, and that if something cannot be verified it does not appear.

Apply those four rules to the firm. No person is named, so nothing is signed in any sense a counterparty could rely on. No claim the firm makes about itself is traceable to anything outside its own website. The firm cannot be verified, and on its own rule it should therefore not appear.

2.1 Twelve markers, and what the site contains against each

Each marker is something an ordinary trading business in any serious jurisdiction can satisfy within the hour.

Two of those warrant expansion, because they are the ones a lawyer notices.

The terms of business decline to state a governing law. The wording is that the terms and the engagement agreements are governed by the law stated in the engagement agreement. The engagement agreement is the document a counterparty sees only after it has decided to engage. So the answer to the question of which law governs, and therefore which courts have jurisdiction and what rights a buyer has, is withheld until after the point at which it is useful. The same page caps liability at the fees paid. A liability cap is a promise by somebody. Here there is no identified somebody to be bound by it, and nobody to serve.

The privacy policy identifies no data controller. Under the heading setting out who the firm is, the text states in full that Theory Intelligence, also Theory Intel, operates the two domains, and gives an email address. That is the whole of it. The same policy expressly contemplates United Kingdom and European data subjects and tells them they may complain to their data protection authority. A trading name and a mailbox do not identify a controller, and no representative is named. The firm also states that interview recordings are held for twenty-four months and that client material sits in encrypted storage, while the contact form on the site transmits nothing and simply opens the visitor’s own email client. There is no server-side infrastructure visible at all.

2.2 Seven years claimed, eight days of evidence

The firm states that it was founded in 2019 and writes of seven years and one generative artificial intelligence wave since. Its structured site data carries a founding date of 2019.

Both domains, theoryintelligence.com and theoryintel.com, were first registered on 11 March 2021, three seconds apart, which is a single paired registration. That alone proves little, since a firm can predate its domain. The publication record is another matter.

Every datable artefact the firm has produced falls inside one week of September 2026. Against a claimed history of seven years, that is the whole of the evidence.

2.3 We applied its standard to its own homepage

The firm publishes four statistics on its front page, each with a named source and a year. Its own rule is that every figure is traced to its origin before it is used, and that if something cannot be verified it does not appear. We traced them.

Most of the material checks out. The firm’s account of the Deloitte Australia matter is accurate, and its reference to fabricated citations in published consulting reports is well founded. We say that plainly, because the point of this exercise is not to assemble a case against a website.

One figure does not hold. The homepage attributes to Kantar the proposition that thirty to forty per cent of online survey responses are compromised by bots, farms or inattentive respondents. We could not locate a Kantar publication stating that. What Kantar does publish is that researchers discard on average thirty-eight per cent of the survey data they collect because of quality concerns, and that sixty-nine per cent of data-quality flags are attributable to forms of fraud. Those are different propositions. Data discarded on quality grounds includes material rejected for reasons that have nothing to do with bots or fraud, and the published figure is a single average rather than the range given.

A second figure, the finding that seventy per cent of three thousand eight hundred and eighty-seven companies would not trust a report prepared with artificial intelligence, is real and was reported by The Telegraph on 3 August 2026. The underlying survey does not appear to have been published with its methodology or fieldwork dates, so a reader cannot in fact trace it to origin in the way the firm’s standard requires. The same reporting carries a narrower figure of thirty-two per cent, which the homepage does not mention.

This is the ordinary citation drift that the firm exists to criticise, on the page where it criticises it.

We make no claim that this was deliberate. Citation drift of exactly this kind is common, it is usually careless rather than dishonest, and it happens in good firms. That is the point. A standard is not what a firm publishes about its method. It is what survives when somebody checks, and nobody had checked this one, because there was nobody identifiable to ask.

The phantom is built to be recommended by machines, and the machines have a gap.

This is the part most third-party risk frameworks have not caught up with, and it is the reason the category is about to get larger.

3.1 The intent is stated on the site

The specimen publishes two machine-readable files, llms.txt and llms-full.txt. These are structured dumps of the entire site in a format intended for ingestion by language models, placed at the conventional path where an automated agent would look. The site states the purpose in plain words on its own briefing page. The writing, it says, is for people who make decisions, and for the answer engines they ask.

Alongside them sits a set of comparison pages built against named real competitors, and a guide setting out what calls cost at the large expert networks. Every one of those is a real and substantial business. None of them is the subject of this paper and nothing here reflects on any of them. They appear because naming them is the mechanism: the page exists to be retrieved when a buyer asks about the firm that actually exists.

3.2 The file itself does not work, which tells you something

We expected to report that llms.txt is how this is done. The evidence does not support it and we are not going to pretend otherwise.

Google’s John Mueller has stated publicly that no artificial intelligence service has said it uses llms.txt, and that server logs show the crawlers do not even check for it. A controlled measurement published by Search Engine Land, covering ten sites across finance, software, ecommerce, insurance and consumer categories, with ninety days of data before and after implementation, found no measurable change in crawl frequency or assistant-referred traffic at eight of the ten, and attributed the other two to concurrent changes. No major model provider has committed to parsing the file.

A firm publishing llms.txt is performing legitimacy for an audience that is not reading. It is a tell, not a mechanism.

3.3 The mechanism is the data void, and it has been measured

Consider how a director actually behaves in November 2026. She does not open a search engine and work through ten blue links. She asks an assistant for independent alternatives to an expert network, or for firms that will give a straight view on a vendor. The assistant retrieves, synthesises and recommends. It has no mechanism for establishing whether the firm it is naming exists.

In October 2026, researchers at the University of Toronto published a study of one hundred and fifty-eight thousand assistant answers and four hundred and sixty-eight thousand citations across three commercial systems. They found that in forty-six per cent of cases where one of those systems named a brand, there was no cited page supporting the mention at all.

Nearly half of the brand names an assistant produces rest on no cited source. The thinner a firm’s genuine footprint, the more the gap gets filled from whatever happens to be available.

That is the opening, and it is not theoretical. Netcraft documented a live attack built precisely to exploit it. An operator created a fake blockchain interface company and populated the internet with the material a model would retrieve: tutorials, forum answers, dozens of code repositories and multiple fabricated developer accounts carrying biographies, photographs and credible activity history. Netcraft’s assessment is that this content was crafted to be indexed by artificial intelligence training pipelines. At least five developers, some working with assisted coding tools, copied the malicious code into their own public projects, which then became further material for retrieval.

Two further pieces of work show the same effect against invented entities. Ahrefs built a fictional manufacturer, published a generated site for it, then planted three conflicting third-party accounts including an invented founder and location, and tested eight assistants across fifty-six questions. Five of the eight adopted the invented details in preference to the company’s own published position. That study has a fair methodological criticism against it, published by Search Engine Journal, which is that most of the questions presupposed the company existed, and we record that criticism here rather than leave a reader to find it. Separately, NewsGuard documented a network of one hundred and fifty sites publishing fabricated material aimed at machine retrieval rather than at human readers, and found that seven of ten leading assistants cited those sites directly. That finding also drew a peer-reviewed challenge, in the Harvard Kennedy School’s Misinformation Review, arguing that the behaviour reflects gaps in available information rather than successful manipulation. We accept that challenge, and it does not help the reader: a gap in available information is exactly what an unknown advisory firm presents, and filling it cheaply is exactly what a phantom does.

3.4 What we are not claiming

We have found no documented case of a fabricated advisory or research firm being cited to a buyer by an artificial intelligence assistant. We looked for one and it does not appear to exist in the public record. We are not going to assert it.

What exists is this. The conditions have been measured and they are present. The technique has been documented in an adjacent market. The incentive is obvious and the cost is near zero. A reasonable board should treat that as a risk to control now rather than a risk to confirm later, because the confirmation will arrive in the form of somebody’s loss.

Polish used to be expensive, and buyers still price it as though it is.

Until very recently, a convincing professional facade was genuinely costly to build. Someone had to write forty pages of competent, consistent English on a specialist subject. Someone had to hold a market position steady across every page. Someone had to produce a visual identity, a tone of voice and a body of writing that read as though it came from people who had done the work. That was weeks of skilled labour, and the cost of it was the real control. It did not stop determined fraud. It stopped casual fraud, and casual fraud is most of it.

That cost is now close to zero. The entire output described in this paper is a weekend of work for one competent person with a generative model and a static site host. The domains cost a few pounds a year. There is no office, no staff, no infrastructure and no recurring expense of any kind. Against that, the expected value of a single engagement at the advertised rates runs from seven and a half thousand United States dollars to seventy-five thousand.

The cost of manufacturing a credible identity has fallen by orders of magnitude. The cost of verifying one has not moved at all.

That asymmetry is the whole of it, and it is worse than it first appears, because the heuristic buyers actually use was calibrated to the old cost structure. Experienced people judge an unfamiliar counterparty by the quality of its material. That was rational for as long as quality was expensive, because quality was a costly signal and costly signals are hard to fake. Quality is no longer a costly signal. A senior executive reading a well-argued paper on a well-built site and concluding that serious people must be behind it is applying a rule that worked for thirty years and stopped working in about eighteen months.

4.1 Why the artificial intelligence budget is the softest target in the business

Phantoms do not pick this costume at random. Four things make advisory work on artificial intelligence the most attractive line to attack, and three of them are features of a well-run company rather than failings.

• The budget moves faster than any other. Boards have told management to show progress, and management is measured on it. A fixed-price engagement below the threshold that triggers a full procurement process will be approved in days where a core systems vendor would face months.
• The buyer frequently cannot assess the expertise. That is usually the stated reason for buying it in. A counterparty selling scarce expertise is being assessed by someone who by definition lacks that expertise, so the assessment falls back on presentation.
• The category itself explains away the absence of history. In this market, a small specialist firm nobody has heard of is entirely normal and often preferred. The usual warning sign, that there is no track record, has been reclassified as a selling point. No other category offers a fraudster that gift.
• Independence is the pitch, and independence is unfalsifiable. A firm that takes no vendor fees cannot easily prove it, and a buyer who wants a straight answer about a technology purchase is predisposed to believe the one party claiming to have no stake in the answer.

Put those together and the picture is specific. The counterparty is small, new, unknown, highly polished, sells expertise the buyer cannot test, claims an independence that cannot be checked, prices below the procurement threshold and asks for payment in advance. Every one of those facts is innocuous on its own and every one of them is normal in this market. That is why the identification test has to be mechanical. Judgement will not catch this, because judgement is what is being exploited.

The category is documented, and the capable end buys a real registration.

None of this is hypothetical, and the record is better than most boards realise. It sits in two places that rarely reach a procurement committee: counter-intelligence announcements and threat-research publications.

5.1 Thirteen sham consultancies, and one of them was Australian

On 10 June 2026 the United States Department of Justice announced that the Federal Bureau of Investigation had disabled thirteen internet domains, every one of them a fake consulting company website, operated by suspected agents of a foreign state. The Department’s own description is that the conspirators created at least thirteen fake consulting company websites and that the sham consulting sites were crafted to deceive. The method was job advertisements for vaguely defined consulting work carrying invented titles, aimed at current and former government and military personnel, with payment offered for research reports.

One of those thirteen domains matters directly to readers in this region. It had taken the identity of a real Brisbane consultancy, Horizzen, copying its name, its business address, its telephone number and its content behind a different design. Horizzen is the victim here and nothing in this paper suggests otherwise. The detail worth sitting with is the timeline. The firm began receiving applications for jobs it had never advertised from the middle of 2025, and the scale of what had been done with its identity only became apparent in June 2026. For roughly a year, a counterparty calling itself by an Australian firm’s name, at that firm’s address and telephone number, was transacting with people who had no reason to doubt it.

A week earlier, on 3 June 2026, the intelligence services of Australia, Canada, the United States, the United Kingdom and New Zealand issued a joint bulletin warning that foreign intelligence officers were posing as online recruiters and consultants representing fake cover companies located outside their own country, targeting people with access to privileged information. The Australian Security Intelligence Organisation was a party to that bulletin. The domain impersonating the Brisbane firm was seized within a day of its publication.

5.2 The model works without artificial intelligence, which is the uncomfortable part

In 2021 a cybercrime group associated with ransomware operated a wholly fabricated cybersecurity company. It had a professional website, a social media presence and active profiles on a professional network for staff who did not exist. It hired real, qualified security professionals on well-paid remote contracts. Those people believed they were conducting legitimate penetration testing. They were in fact mapping the networks of target corporations and identifying vulnerabilities, and in some instances the work resulted in backdoors and malware being placed.

In the same year, a state-backed group stood up a fake offensive security firm, claiming to be based in Turkey and selling penetration tests and security assessments. It was supported by a company page on a professional network, six fabricated staff profiles and eight social media accounts, all created within a day of each other.

Both of those predate generative artificial intelligence entirely. The business model was already proven. What has changed is that it no longer requires a team.

There was already a priced market in synthetic professional identity before the current tooling existed. Researchers at the Stanford Internet Observatory identified more than one thousand profiles on a professional network using machine-generated faces, listing more than seventy real businesses as their employers. One firm found sixty profiles claiming to work for it, none of whom ever had. The service was being sold openly, with one vendor advertising fully branded avatar profiles at one thousand three hundred United States dollars a month and another offering generated avatars at three hundred. That was in 2022.

5.3 Why a registration number does not close the question

This is the objection every experienced reader will raise, and it is correct, so we will deal with it rather than wait for it.

In April 2025 threat researchers documented three front companies operating in cryptocurrency consulting on behalf of a state-linked group. The staff were fabricated, with profiles across three social platforms and photographs generated by a commercial image tool. Reuters reviewed the companies’ filed registration documents. One of the three was a properly registered limited liability company in New Mexico, with a real registered agent engaged through a well-known incorporation service. Its registered address, used for every member and organiser, was an abandoned lot in South Carolina. The Bureau later seized the domain.

A registration number proves that a filing was made. It does not prove that a business exists.

So the twelve markers in section 2 are the first stage, and they will catch the cheap end of this category, which is most of it. They will not catch an operator willing to spend a few hundred dollars on an incorporation service. For any engagement of consequence, the second stage is short and it is where the capable phantom fails.

• Does anything exist at the registered address. A satellite image and a street view take two minutes, and an abandoned lot, a mailbox service or a residential flat shared with forty other companies is an answer.
• Do the named officers have histories that exist independently of the counterparty’s own material. A person who appears on the internet only in connection with this one firm, and whose photograph returns nothing on a reverse image search, has not been verified by the existence of a profile.
• Can you reach a human being on a number you found yourself, rather than one the counterparty supplied.
• Will a named client confirm the relationship, contacted on details you obtained independently. References supplied by the counterparty test nothing, because the referee is as easy to fabricate as the firm.
• How long has the entity existed, and does its filing history match the operating history it claims. A company incorporated last quarter that describes seven years of work has told you something.

5.4 No prudential regulator has addressed this, and that is the point

We looked for a regulatory warning aimed squarely at the fabricated counterparty in third-party risk management. We did not find one, and we think the absence is worth stating plainly rather than papering over.

What exists sits beside the problem without covering it. The United States Financial Crimes Enforcement Network issued an alert in November 2024 on generative artificial intelligence being used to create falsified documents, photographs and video, and to build synthetic identities that pass verification. That alert is directed at customer onboarding, not at vendor onboarding, and it does not address fabricated corporate records. The Bureau’s own public service announcement of December 2024 warns that criminals use generative tools to create fictitious profiles in volume, to generate content for fraudulent websites, and to generate video for real-time calls with people posing as company executives or authorities. The Five Eyes bulletin addresses fake cover companies used for intelligence recruitment. Supervisory material from Australian regulators on artificial intelligence addresses whether a firm can govern its vendors’ models.

Every one of those is about something adjacent. None of them asks the question this paper asks, which is whether the vendor exists at all. The conclusion we draw is not that boards should wait for the guidance. It is that the duty to ask the question already sits with them, and that when the guidance does arrive it will be describing losses that have already happened.

The numbers that survive checking, and the ones that do not.

The United Nations Office on Drugs and Crime reported in July 2026 that transnational online scam operations in South-East Asia cost victims up to one hundred and fourteen billion United States dollars in 2025. That is the aggregate for the region’s organised online fraud economy, not a corporate-only figure, and it is the scale of the industry that the techniques in this paper are drawn from.

6.1 The vector that actually takes the money

Deepfakes attract the headlines. Invoice and vendor fraud takes the money, and it mostly does so without any artificial intelligence at all.

The Singapore Police Force issued an advisory on 20 May 2026 recording that since 1 January that year at least sixty-six business email compromise cases had been reported, with total losses of at least nineteen million dollars. The pattern described is the oldest one there is: the victim is told that a vendor’s bank account details have changed and is instructed to pay the new account. The advisory attributes the mechanism to spoofed or compromised email accounts. It records no artificial intelligence element, and we are not going to imply one.

The Association for Financial Professionals, surveying organisations in January 2025 about the year before, found that forty-five per cent reported vendor imposter fraud among the payments fraud they faced in 2024, up eleven percentage points on the previous survey. The FBI’s Internet Crime Complaint Centre recorded two point nine five billion United States dollars of adjusted losses across twenty-one thousand four hundred and eighty-nine business email compromise complaints in 2023, an average of about one hundred and thirty-seven thousand dollars for each complaint reported.

A face and a voice on a call are no longer evidence of identity.

In January 2024 a finance employee at the Hong Kong office of Arup, the engineering firm, took part in a video conference about a confidential transaction. Every other participant on that call was fabricated, constructed from material that was publicly available. The employee authorised fifteen transfers totalling two hundred million Hong Kong dollars, about twenty-five point six million United States dollars, to five local bank accounts.

One detail is routinely reported wrongly and we will state it carefully. Early police comment described a video conference in which the employee was the only real participant. In June 2024 Hong Kong’s Secretary for Security told the Legislative Council that the meeting had been pre-recorded, assembled from publicly available video and audio of the people impersonated, rather than generated live and interactively. The distinction matters to anyone designing a control, because it means the attack did not require real-time synthesis. It required a video call the victim could not interrupt and a reason not to question it.

No internal system at Arup was compromised. Nothing was hacked. We have found no public report of any arrest, charge or recovery in that matter as at the date of this paper.

Twenty-five million dollars moved because a face on a screen was accepted as proof of who was speaking. No system failed. The control that failed was an assumption.

A closer case sits in Singapore. The Singapore Police Force reported in April 2025 that the finance director of a multinational had been induced to transfer more than four hundred and ninety-nine thousand United States dollars after a video call on which the company’s chief executive, among others, had been impersonated using deepfake technology, the approach having begun with a message purporting to come from the chief financial officer. The fraud was exposed the following day when a further request for one point four million dollars was made. Hong Kong police withheld the onward transfer and the money was recovered, which is unusual and should not be planned for.

Payment approval processes that treat a recognisable face and voice as sufficient proof of identity are built on an assumption that stopped being true. Standard email filtering and identity management controls do not see a video call at all.

Directors are already exposed, under duties that already exist.

Boards waiting for artificial intelligence legislation before they act on this have misread their position. The duty that bites is the ordinary duty of care and diligence, and it bites now.

In Australia, section 180 of the Corporations Act 2001 requires directors to exercise their powers and discharge their duties with the care and diligence that a reasonable person would exercise. On 29 October 2024 the Australian Securities and Investments Commission published Report 798, Beware the gap: Governance arrangements in the face of AI innovation, following a review of twenty-three financial services and credit licensees.

Two sentences from that report do the work. The first is that company directors and officers must discharge their duties with a reasonable degree of care and diligence, and that those duties extend to the adoption, deployment and use of artificial intelligence. The second is that licensees remain responsible for outsourced functions. The report also records that the regulatory framework is technology neutral, which disposes of the argument that the law has not caught up.

The review found that thirty per cent of the use cases examined ran on models developed by third parties, that some licensees did not have robust third-party management procedures, and that at least one could not identify the technique used in all of its own models and produced no third-party supplier policy or documented process. That is the state of third-party artificial intelligence governance as the regulator found it, among licensed entities, in a reviewed population.

Directors of Singapore companies are subject to a statutory duty to use reasonable diligence in the discharge of their office, and directors of Hong Kong companies to a duty to exercise reasonable care, skill and diligence. The analysis does not change materially across the three jurisdictions.

Engaging a counterparty that later proves to have no legal existence, or paying on an instruction verified only by a video call, creates a clean evidentiary record of what was and was not done. The question asked afterwards will not be whether the board anticipated the specific technique. It will be whether ordinary verification steps, available and cheap at the time, were applied. Reliance on an external expert has to be reasonable reliance, and reliance on a party whose identity could not be established is difficult to characterise that way.

Boards should not expect to transfer this. Cover for fraudulently induced payment and for losses arising from artificial intelligence is frequently narrow or excluded, and the position differs by policy. Treat it as residual risk to be controlled operationally, and have someone read the policy wording before assuming otherwise.

What has to be true before money moves.

Five controls. None of them is novel, which is the point. The failures described here are not failures of control design. They are failures to apply controls that are already written down, against a counterparty whose polish made the application feel unnecessary.

9.1 Identity before engagement, with no exceptions for small amounts

Verify the registration number and obtain the extract from the relevant registry, whether ACRA, Companies House, ASIC or the local equivalent. Verify the registered office and that something is actually at it. Identify the principals and confirm their histories independently of what the counterparty tells you. Where the engagement is material, confirm beneficial ownership.

Email-only contact and the absence of registry data should be disqualifying. We would go further. A counterparty that cannot produce a registration number within one business day of being asked has answered the question, and the engagement should stop there rather than proceed while someone chases the document. In our experience the chase is where these engagements are won, because the file stays open, the deadline arrives, and the work starts before the gap is closed.

9.2 Out-of-band verification for every payment instruction

A face and a voice on a video call are no longer evidence of identity. That sentence should be written into the payments policy in those words, because the control only works if the person approving the payment has been told plainly that what their own eyes are reporting is not reliable.

Callback to a number held on file before the request arrived, never a number supplied in or alongside the request. Dual authorisation. Separation of requestor from authoriser. Any change to vendor bank details treated as a new counterparty rather than an amendment. Urgency and confidentiality treated as risk indicators rather than as reasons to move faster, since both are standard features of the attack. Document the verification steps taken, because the documentation is what later demonstrates that the process existed.

9.3 An inventory of every artificial intelligence dependency

Maintain a register of artificial intelligence vendors and advisers, what each one touches, and what would happen if it failed or proved to be something other than it claimed. Require evidence of prior delivery and references that can be contacted independently, which means contact details obtained other than from the counterparty. Contract for audit and termination rights.

9.4 Treat an answer-engine recommendation as a lead, not a reference

Record when a counterparty was surfaced by an artificial intelligence tool. Verify the name against a registry before it reaches a shortlist. The recommendation carries no diligence with it, however authoritative the tool sounds, and it will not be treated as diligence by a court asked later whether the board took reasonable steps.

9.5 Put it in front of the board, with the scenarios run

Directors should receive regular reporting on artificial intelligence use, material third-party dependencies and the effectiveness of fraud controls. Scenario testing should include a deepfake payment instruction and the onboarding of a counterparty that does not exist. Both scenarios are cheap to run and uncomfortable in the right way. A board that has run them and documented the result is in a materially different position from one that has not, both operationally and in evidence.

No verifiable legal existence, no engagement, no payment.

The cost of manufacturing a credible professional identity has fallen to approximately nothing, while the cost of verifying one has not moved. That gap is the whole opportunity, and it is being taken.

Faceless Phantom Firms are the cleanest expression of it. They require no stolen identity, no compromised mailbox and no technical intrusion. They require a plausible name, competent writing, a published price and the reasonable assumption on the buyer’s part that something this polished must be attached to something real. They are aimed at the one budget line that is currently approved faster than any other, and at buyers who are under visible pressure to demonstrate progress.

They also sit at the end of a range rather than in a category of their own, and a buyer should hold the whole range in mind. Plenty of counterparties carry some identification and fabricate the rest, and those are the ones a registry check is designed to catch. The faceless end carries none of it, and there the right response is not suspicion of a particular firm. It is a single question asked of any of them. Becoming identifiable costs a few hundred dollars and an hour. Why has this counterparty, asking for tens of thousands, declined to spend it.

None of the controls that defeat them is new. Verify existence before engaging. Verify instructions out of band before paying. Keep a register of who you depend on. Treat a machine’s recommendation as a lead. Report it to the board. Every one of these was in the manual before generative artificial intelligence existed, and every one of them still works.

What has changed is the cost of not applying them, and the ease with which a competent facade now survives a cursory look. Residual risk cannot be eliminated, and will rise further as agentic systems reduce the cost of reconnaissance and personalised approach. But the exposure narrows sharply the moment one rule is applied without exception, including to the counterparty whose website is better than yours.

How we verified this, and an open offer.

A paper arguing that firms publish claims they have not checked is obliged to show its own working. Ours is set out here so that any reader can repeat it.

The examination of theoryintelligence.com was carried out on 3 November 2026 by direct inspection of the live site, including the home, about, briefing, terms and privacy pages, the structured organisation data embedded in the site, and the machine-readable llms.txt file. Domain facts were taken from the Verisign registry record for each domain, retrieved the same day, and not from a commercial lookup service. The professional network page was tested from an authenticated account, which matters, because an unauthenticated visitor is shown a sign-in prompt rather than the true status of the page. Company and people searches on that network were run from the same account. A screenshot of the result is retained.

Every figure drawn from a third party in this paper carries its source and the date of that source in the text beside it. Where a figure is widely repeated in commentary but we could not trace it to a primary source, we have either dropped it or said so in terms. Nothing in this paper is cited from memory.

11.1 The offer

This paper records what the public record contained on 3 November 2026. If Theory Intelligence provides a registered name, a registration number, a jurisdiction of incorporation and a named principal, PanEuro will verify them against the relevant registry and publish a correction. That offer is open and stands without qualification. We would extend the same offer to any firm named in this paper, and we would expect any firm that names us to extend it to PanEuro.

There is a structural point inside that offer worth stating plainly, because it is the same point the paper makes about counterparty risk. You cannot defame something that cannot be identified. For anyone to take issue with what is recorded here, they would first have to say who they are, under which law, and in which jurisdiction. Those are the very particulars whose absence is the subject of the record. The same gap that leaves a buyer with nobody to sue leaves the firm with nobody to sue on its behalf. That is not a clever position we have engineered. It is what nil identification means, looked at from the other side, and any firm that finds itself in it has put itself there.

We say that for a reason that goes beyond courtesy. The entire argument of this paper is that identity should be cheap to confirm and expensive to fake. A firm which can close the question in one email has every incentive to do so, and the ones that will not are telling you something you should price.

Primary and originating sources, with dates.

Every web source was retrieved on 3 November 2026.

• theoryintelligence.com, inspected directly, 3 November 2026; Verisign registry records for theoryintelligence.com and theoryintel.com, retrieved the same day.
• United States Department of Justice, press release 26-629, 10 June 2026, on the disabling of thirteen fake consulting company websites
• Guardian Australia, August 2026, on the Brisbane consultancy whose identity was cloned by one of those domains
• Five Eyes joint bulletin, Safeguarding Our Secrets, 3 June 2026 (ASIO, CSIS, FBI, MI5, NZSIS)
• Gemini Advisory, October 2021, on the fabricated cybersecurity company operated by a ransomware-linked group
• Google Threat Analysis Group, 31 March 2021, on a fake offensive security firm and its fabricated staff profiles
• Silent Push, 24 April 2025, on three cryptocurrency consulting front companies and their machine-generated staff images; Reuters, 24 April 2025, having reviewed the filed registration documents
• Stanford Internet Observatory research reported by NPR, 27 March 2022, on more than one thousand profiles using machine-generated faces
• Netcraft, Large language models are falling for phishing scams, 1 July 2025
• Chen and Koudas, University of Toronto, What drives AI citations, arXiv 2610.15033, 10 October 2026
• Ahrefs, AI versus made-up brand experiment, 10 December 2025, together with the methodological critique in Search Engine Journal, 28 December 2025
• NewsGuard, 6 March 2025, together with the response published in the Harvard Kennedy School Misinformation Review
• Search Engine Land, Does llms.txt matter?, reporting measured results across ten sites and John Mueller’s statement that the crawlers do not fetch the file
• United Nations Office on Drugs and Crime, July 2026, on South-East Asian scam losses of up to US$114 billion in 2025
• Sumsub third annual Identity Fraud Report, 28 November 2023, and the fourth annual report, 20 November 2024. Platform detection data.
• Singapore Police Force advisory on business email compromise, 20 May 2026
• Singapore Police Force release on the recovery of funds in a deepfake matter, 7 April 2025
• Association for Financial Professionals Payments Fraud and Control Survey, released 15 April 2025, reporting on calendar 2024
• FBI Internet Crime Complaint Centre, Internet Crime Report 2023; IC3 alert I-120324-PSA, 3 December 2024
• FinCEN Alert FIN-2024-Alert004, 13 November 2024, on generative artificial intelligence and synthetic identity in customer onboarding
• South China Morning Post and Hong Kong Police Force statements, February and May 2024, and the Secretary for Security’s account to the Legislative Council, 26 June 2024
• ASIC Report 798, Beware the gap: Governance arrangements in the face of AI innovation, published 29 October 2024; Corporations Act 2001 (Cth), section 180
• GPTZero findings on four PwC Middle East thought-leadership reports, independently verified and reported by the Financial Times, July 2026, and the separate withdrawals of reports by KPMG and EY during 2026
• Deloitte Australia and the Department of Employment and Workplace Relations, October 2025; fabrications identified by Dr Chris Rudge, University of Sydney
• Source Global Research survey of 3,887 companies, reported by The Telegraph, 3 August 2026; Kantar published material on survey data quality
• Brook, Infrastructure Misallocation, PanEuro, November 2026; Brook, Don’t Tar All Natural Resources With the Same Brush, PanEuro, October 2026