Introduction
None of these six men have launched a gambling app. Cristiano Ronaldo has not built a trading bot. Neymar did not create a R$9.90 World Cup sticker album subscription. Lionel Messi is not fishing for pesos on a platform called Ice Fishing. James Rodríguez did not receive a presidential endorsement for a casino brand, because no such endorsement exists to receive.
Every one of those claims ran as a paid advertisement, somewhere, in the twelve months tracked by the ad-monitoring firm Revelum. The company’s investigation identified at least 10,000 deepfake scam ads impersonating football players, drawing on a confirmed sample of 2,736 ads across six of the sport’s most recognizable names: Ronaldo, Messi, James Rodríguez, Luis Díaz, Moisés Caicedo, and Neymar. When the 2026 World Cup began, the volume didn’t just continue. It spiked — in one case by seventeen times its baseline rate. And the detail that turns this from a pile of scam ads into a documented operation isn’t the deepfakes themselves. It’s a single phrase that shows up, almost unchanged, in Spanish, Portuguese, and English: a 72-hour countdown, ticking on ads that have no reason to share a clock unless someone built them from the same template.
What the Surge Looked Like
Revelum’s daily-rate data, collected through July 1, 2026, shows the World Cup didn’t just draw attention to these six players — it drew attention to the ads impersonating them. Luis Díaz’s daily ad rate rose from 1.5 to 7.7 — a 413% increase. Neymar’s rose from a near-dormant 0.1 a day to 1.8 — a 1,700% jump. Caicedo rose 70%, Ronaldo 69%, James Rodríguez 41%. All five moved in the same direction, at the same moment, tracking a tournament none of them had any control over.
Messi didn’t. His rate fell from 2.8 to 0.95 a day — a 66% drop, the only player in the sample to move against the tournament’s pull. Revelum’s report doesn’t explain the divergence, and neither will this one. It could reflect tighter platform enforcement on his specific account, a criminal decision to deprioritize a more heavily monitored target, or nothing more than a six-player sample being too small to expect uniformity. The honest answer is that the data shows an anomaly and stops there. A tactic that produces five confirming data points and one contradicting one is still worth documenting — but the contradiction belongs in the writeup, not underneath it.
The Products Changed by Country. The Script Didn’t.
What makes this look like infrastructure rather than opportunism is the localization. Ronaldo’s ads sold “Chicken,” a gambling app, and “Sweet Bonanza,” priced in euros, matched to a Spain-based audience. Messi’s sold “Ice Fishing” and “Penalty Game,” priced in Argentine and Colombian pesos. James Rodríguez’s Colombian campaign sold “Joker’s Jewels” and “Casino Colombia” — the latter carrying a fabricated endorsement attributed to the country’s president. Luis Díaz’s campaign sold “Joker Jewels” — a one-letter departure from James Rodríguez’s product, marketed through a different fake celebrity endorsement to a different Colombian audience, which is either a remarkable coincidence or the same asset library serving two campaigns. Caicedo’s Ecuador-only campaign used his actual Chelsea FC jersey and the club’s actual BingX sponsor logo, borrowed wholesale to sell a crypto scheme. Neymar’s Brazilian campaign ran four separate products simultaneously: a casino, a trading bot, a fake streaming app, and a R$9.90 sticker-album subscription — a price point low enough that a victim might not notice the charge, let alone report it.
Six players, six countries, six currencies, and at least nine distinct fake products. Underneath all of it, one detail didn’t localize: the phrase “72-hour” window, describing an expiring offer, appeared — in Revelum’s words — “almost verbatim across ads” regardless of language or target market. A genuine local scammer improvising a pitch doesn’t reliably land on the same countdown length in three languages. A shared script, translated but not rewritten, does.
The Other Tells
The urgency phrase isn’t the only fingerprint. One operation ran 254 Ronaldo ads from a single advertiser page. Another ran 142 Caicedo ads from one page. Luis Díaz’s investment-scheme campaign alone produced 164 unique videos — a volume that implies either a large production team or an automated generation pipeline, not one person improvising fraud between shifts. James Rodríguez’s campaign went a layer further: 57 of its ads impersonated a real Colombian micro-influencer, Yeferson Cossio, from pages built to look like his own — meaning the operation wasn’t only cloning a global superstar’s face, it was cloning a domestic influencer’s smaller, more locally trusted one, in the same campaign, aimed at the same audience.
The narrative construction followed a repeatable formula across all six players: a fabricated testimonial from someone coded as ordinary and non-threatening — a delivery worker, a teacher, a single mother — claiming implausible earnings; a stolen authority frame, built to resemble a real broadcast (Noticias Caracol’s visual style) or a real financial institution (a fake Banco Pichincha notification); and the urgency countdown sitting on top of both. Three separate mechanisms, deployed together, on every player, in every country. That’s not six scammers who happened to converge on the same idea. That’s one playbook with six skins.
Why an Athlete’s Face Works Here
A political deepfake has to do something difficult: change what a viewer believes about a candidate or an institution, against whatever prior opinion that viewer already holds. That’s expensive persuasion work, and it’s why political disinformation campaigns lean so heavily on repetition and volume — belief is hard to move.
A gambling-app deepfake doesn’t need to change a belief. It only needs to borrow one that already exists: the trust a fan already extends to a player they’ve watched for a decade. Ronaldo’s face doesn’t need to convince anyone that Ronaldo is trustworthy — that work is already done, for free, by years of matches and endorsement deals the fan actually witnessed. The ad’s only job is to attach that pre-existing trust to a product the real Ronaldo has never touched. That’s a shorter, cheaper con than persuasion, which is exactly why it scales to 10,000 ads a year without needing a single viewer to change their mind about anything except where to send a deposit.
What This Is Not
This is Revelum’s data, gathered by a firm that sells brand-protection and ad-monitoring services — the same conflict-of-interest caveat that applies to any vendor report naming a threat its own product is built to catch. That doesn’t make the 2,736 sampled ads less real; Revelum’s own screenshots and per-player breakdowns are specific enough to check. But the framing of scale (“at least 10,000”) extrapolates from a smaller confirmed sample, and readers should hold that extrapolation more loosely than the sampled numbers themselves.
This also isn’t an attribution claim. Nothing in the public report identifies a single group, country, or individual behind these campaigns. The centralization argument here rests entirely on circumstantial evidence — reused app names, a shared urgency script, overlapping production volume — the same category of evidence Decipon has flagged in prior breakdowns of state-linked networks, and it carries the same limits. Shared infrastructure is a reasonable inference from these patterns. It is not a subpoenaed fact.
And this isn’t political manipulation, even though it shares the Influence Tactics Protocol’s core mechanisms. Nobody here is being persuaded to vote, distrust an institution, or take a side in a conflict. The ask is a deposit into a gambling account or a crypto wallet. It’s worth naming that distinction precisely because the protocol doesn’t care about it: synthetic identity, fabricated authority, and false urgency score as the same mechanisms whether the target is a ballot or a bank transfer. The goal changes. The tactic that gets there doesn’t.
Key Findings
- At least 10,000 deepfake scam ads impersonated six top footballers over twelve months, per a confirmed sample of 2,736 ads analyzed by Revelum.
- Ad volume surged with the World Cup for five of six players — Neymar +1,700%, Luis Díaz +413%, Caicedo +70%, Ronaldo +69%, James Rodríguez +41% — while Messi’s rate fell 66%, an anomaly the underlying data doesn’t explain.
- Every campaign was localized to currency, language, and platform — from euro-denominated Spanish ads to a peso-denominated Colombian ad carrying a fabricated presidential endorsement — but a “72-hour” urgency window recurred almost verbatim across all of them.
- Production volume implies centralized infrastructure, not lone scammers: 254 ads from one Ronaldo-impersonating page, 142 from one Caicedo page, 164 unique Luis Díaz videos, and a near-identical app name (“Joker’s Jewels” / “Joker Jewels”) reused across two players’ separate campaigns.
- The operation also cloned a real micro-influencer, running 57 ads impersonating Colombian creator Yeferson Cossio from fake pages — the same technique aimed one tier down from global celebrity.
- No platform, player, or takedown-rate data is included in the public report — Meta and other platforms are not quoted responding to the findings.
Implications
The Influence Tactics Protocol scores manipulation by mechanism rather than by domain, and this case is a clean argument for why that matters. Fabricated authority, synthetic identity, and false urgency are usually discussed in the context of elections and state propaganda — the cases this platform covers most often. Here, the identical mechanisms are running a commercial fraud operation against football fans, at a volume (10,000+ ads) that dwarfs most single-actor political influence campaigns documented on this site, and drawing on an audience (a World Cup) with no political valence at all.
That has a practical consequence for anyone building detection systems. A platform that only watches for coordinated political messaging will structurally miss this, because nothing about a gambling ad reads as political. What would catch it is pattern-matching tuned to the mechanism, not the topic: near-duplicate scripts across supposedly unrelated advertiser accounts, reused product names across different celebrity-impersonation campaigns, urgency language that doesn’t localize when everything else does. Ad platforms already have the account-level data to run exactly that kind of cross-campaign matching. The 72-hour phrase surviving translation into three languages, unnoticed, across a sample this size, suggests they aren’t running it — or aren’t running it well enough to matter before the ad has already been seen millions of times.
For an individual fan, the defense is simpler and doesn’t require any of that infrastructure: an athlete endorsing a gambling app or investment platform is news, and real news about a public figure that famous surfaces on verified channels — the athlete’s own account, a credentialed outlet — not exclusively inside the ad itself. An ad is the one channel with the least reason to be trusted precisely because it’s the one channel paying to be seen.
Conclusion
Six men who between them have won World Cups, Champions Leagues, and Ballons d’Or could not stop a deepfake wearing their own face from reaching a fan faster than the truth did. Not because the fans were foolish, and not because the fraud was especially convincing on its own merits — the testimonials were implausible, the countdown was recycled, the app names barely bothered to differ from each other. It worked because it borrowed something none of the six men could revoke in time: a decade of earned trust, rented out for the length of one ad view, on a clock that was always going to read 72 hours no matter which language it counted down in.
This article is part of Decipon’s Manipulation Breakdowns series, examining specific influence operations through the Influence Tactics Protocol.
Sources: