EY Canada published a 44-page report titled “Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems” examining cyber risks in loyalty rewards programs. AI-detection firm GPTZero found that 16 of the report’s 27 cited sources were fabricated, misattributed, or linked to broken web pages, including invented references to Forbes, McKinsey, Gartner, TechCrunch, and WIRED articles that do not exist. The fabricated report had already been syndicated by dozens of news outlets and cited by AI chat tools before EY withdrew it and said it was reviewing the circumstances of its publication.