How a Deepfaked Mahama Endorsement Beat Ghana's Licence Check

A joint notice from the Bank of Ghana and the Securities and Exchange Commission, dated 1 September 2026, warns the public against a crypto investment platform called “Daily Wealth Guide” promoted through a doctored video in which President John Dramani Mahama appears to endorse it. The notice tells Ghanaians to verify a company's licensing status before depositing funds.

That instruction can only work on someone who already suspects the video. Removing exactly that suspicion is what the endorsement does, which puts the country's headline remedy on the wrong side of the loss. Buried in point 3 of the same document is a control that does sit upstream of the money: an instruction to every radio, television and online outlet in Ghana not to run these advertisements, and to verify licensing before they do. A central bank has quietly made the media the checkpoint, without saying what they should check with.

What Ghana's central bank issued

The Bank of Ghana and the Securities and Exchange Commission published a joint notice on 1 September 2026 warning the public against a crypto investment platform called “Daily Wealth Guide”, promoted on social media through a doctored video in which President John Dramani Mahama appears to endorse it. The document is numbered BG/GOV/SEC/2026/27, carries the title “SCAM ALERT-DAILY WEALTH GUIDE”, and is signed by Aimee Vyda Quashie, Secretary of the Bank.

What makes it worth reading in full is not the warning. It is the choice of hook. The notice never treats the video as the offence. It treats the invitation to deposit as the offence, and reaches that invitation through banking law: inviting members of the public to put money into the scheme “amounts to deposit-taking”, and under section 4(i) of the Banks and Specialised Deposit-Taking Institutions Act, 2016, only a licensed body corporate may take deposits. The Bank adds that it “has not licensed any entity or individual to engage in crypto investment”.

That framing carries a cost and a benefit, both of which matter to anyone building controls rather than writing warnings, and it produces a set of remedies that sit in a revealing place on the timeline of a loss.

‍

‍

Inside Notice BG/GOV/SEC/2026/27

Three instructions to the public close the notice. Verify the licensing status of individuals or entities with the Bank of Ghana or other relevant authorities before depositing funds. Place deposits only with licensed institutions. And, addressed not to the public but to every broadcaster and publisher in the country, do not permit the advertisement of these operators without first verifying their licensing status with the Bank.

Penalties run through the Anti-Money Laundering Act, 2020. An operator faces 500 to 100,000 administrative penalty units under section 53(3), is “required to refund all funds received”, and is to be reported to law enforcement for investigation and prosecution under sections 1 to 5. Reports go to the Bank's Financial Stability Department at The Bank Square in Accra.

Read it looking for the media analysis and there is exactly one word of it: doctored. The notice does not say how the video was made, whether it was a face swap or a lip-sync over real footage, whether it carried an AI label, how it was distributed, or whether it ran as paid advertising. It does not ask anyone to assess whether a given video is synthetic. For an instrument whose entire occasion is a synthetic video, the synthetic video is the part it says least about, and that gap is where the rest of this article sits.

‍

Why a licence check fires too late

Both public remedies require the reader to already be in a state of doubt. Checking a register is something a person does when they suspect they are being sold something dubious. The endorsement's whole function is to remove that suspicion, and it does so by answering a different question from the one the register answers.

A licence check tests an institution's paperwork. A presidential endorsement is not a claim about paperwork, it is a claim about who vouches for the scheme. Someone who believes the head of state has publicly backed a platform has not been given a false answer to “is this licensed?”. They have been moved somewhere the question does not occur, because the guarantee appears to come from an authority above the register. This is the same substitution that runs through deepfake-driven romance and investment fraud generally: the artefact does not defeat a control, it removes the moment at which the control would have been invoked.

Plot the notice's three remedies against the sequence it describes and the shape of the problem is visible at a glance.

‍

Two of the three sit on the far side of the deposit. Prosecution and penalties are recovery, not prevention, and they depend on finding an operator the notice itself calls a “foreign investor”. The public licence check needs a doubt the video was built to dissolve. Only the instruction to media houses sits upstream of the money, and it is the one remedy the notice addresses to institutions rather than to individuals.

‍

What happened to the 13 arrests

Ghana has arrested thirteen people over deepfakes of President Mahama this year, in two separate operations. Neither has produced a conviction, an acquittal or a dismissal that appears anywhere in the public record. In both cases the reporting stops at the remand hearing.

This article names none of them. Two of the eleven arrested in May were aged 17 and 18, and nobody in either group has a reported outcome, so the Sentencing Project's guidance applies twice over: news media “should not reveal the names” of young people in the juvenile system, and where an arrest has been covered, coverage should “follow through to the conclusion of the case”. Almost nothing online obeys that second half, including the sources this article is built on.

‍

Measuring the silence changes what the arrests can be used to argue. “Thirteen arrests” reads as resolution. It is the last visible step in two unfinished processes, and the gap since that step is now 162 days in one case and 107 in the other. Every person arrested is entitled to the presumption of innocence, and on the public record every one of them still has it.

The deterrence question is answerable without any disposition data. Arrests in March did not prevent an eleven-person operation in May, and arrests in May did not prevent a third campaign reaching Ghanaian feeds by September. Whatever the courts eventually decide, the sequence says enforcement has been repeating rather than deterring.

‍

Three episodes, one target, one year

On 28 March the Ghana Police Service arrested two people over accounts circulating deepfake content impersonating the President and the First Lady, Lordina Mahama, on Facebook, TikTok and WhatsApp. Deputy Commissioner of Police Grace Ansah-Akrofi warned at the time that creating or sharing deepfake content is a criminal offence in Ghana and that the police would prosecute.

Between 1 and 4 May the Inspector-General of Police's Cyber Vetting and Enforcement Team ran coordinated operations at Sogakope, Dabala, Tongu, Akatsi and Aflao in the Volta Region, arresting eleven people. Police recovered laptops, mobile phones, internet routers, 120 pre-registered SIM cards and a Nigerian-registered Mercedes-Benz ML 350, and described the group as part of a wider network creating fraudulent digital content to impersonate high-profile personalities for financial gain. The suspects were alleged to have used the videos to solicit money and sensitive personal information online.

Sources disagree on one detail and it is worth stating rather than smoothing. MyJoyOnline reported the group as five Ghanaians and six Nigerians; the Ghana News Agency's own roster of those arrested, and Pulse Ghana, indicate six Ghanaians and five Nigerians. Nothing in this article turns on which is right, and no source read for it resolves the discrepancy.

‍

Those 120 pre-registered SIM cards are the most diagnostic item on the seizure list. A studio producing synthetic video does not need them. A distribution and victim-contact operation does, which places the May group at the delivery end of a synthetic fraud supply chain rather than the generation end. That distinction matters for where interception is possible, because the generation end is offshore, cheap and replaceable, and the delivery end touches regulated infrastructure.

‍

Media houses are now the checkpoint

Point 3 of the notice is the most consequential sentence in it, and it has attracted no attention at all. The Bank of Ghana “wishes to notify all media outlets, including radio, television and online channels, NOT to permit the advertisement of these ‘foreign investors’ on their platforms”, and encourages the media to “verify the licensing status of such entities with the Bank of Ghana before advertising their products and services”.

A central bank has just made every broadcaster and publisher in the country a screening layer for deepfake-promoted investment fraud. Framed as compliance, it is a detection duty: someone at a Ghanaian radio station or news site now has to look at inbound advertising creative and decide whether to run it. That is the only remedy in the notice positioned ahead of a victim's money, which makes it the most valuable one and the one with the least support behind it.

The support problem is specific. The notice hands broadcasters a licensing test, and the thing arriving at their ad desk is a video file. A sales team can check a register in a minute; the register will correctly report that “Daily Wealth Guide” is not licensed, and a scheme that expects the check will simply present under a name that is, or under no name at all until the money is moving. What the sales team cannot do is look at footage of the President and judge whether he said those words. That is the question the notice creates and does not answer, and it is answerable only with tooling nobody has told a Ghanaian ad desk to acquire.

Ghana is not the first regulator to arrive at the advertising layer. Poland escalated against Meta over scam advertising rather than against the fraudsters, and the Sapphire Network investigation traced deepfake investment ads through the intermediaries that placed them. The pattern is the same in all three: the fraud is retail, the distribution is wholesale, and the wholesale layer is where one intervention reaches thousands of impressions.

‍

Why a president is the cheapest clone

Across all three episodes the constant is the face, and that is not a coincidence of Ghanaian politics. A head of state generates more usable training and reference material than almost any other person in a country: daily state broadcasts, press conferences, official video channels, foreign-ministry footage, all of it front-facing, evenly lit, professionally framed and carrying clean audio recorded on good microphones. It is, in effect, a curated dataset published continuously at public expense.

Set that against how little modern pipelines need. The volume of reference material required to clone a face or a voice has fallen to the point where the constraint on an impersonation campaign is rarely the source material, and lip-sync methods make it possible to keep genuine presidential footage and replace only what the mouth is doing, which is both cheaper than a full synthesis and harder for a viewer to fault because everything except the speech is real.

The result is a structural inversion that regulators keep meeting and rarely name. The identity carrying the most institutional trust in a market is also among the cheapest to fabricate convincingly. In economies where the regulator or the head of state, rather than any individual bank, is the most trusted financial voice, that trust is the exploitable asset, which is why the same playbook ran against Australia's prime minister and against India's finance minister. A bank can rebuild a compromised brand. A country cannot reissue its president's face.

‍

What the deposit-taking framing costs

Reaching the scheme through Act 930 is genuinely elegant, and the elegance is worth naming before the criticism. Unlicensed deposit-taking is unlawful whether or not a deepfake advertised it, so the regulators need prove nothing about the video to make the operation illegal. No forensic burden, no expert evidence, no argument about detection confidence. For a warning that has to go out in days, that is the right hook.

The limit is who it reaches. The framing bites the operator of the scheme, and the operator is offshore, anonymous and, on the notice's own description, a “foreign investor”. It says nothing about whoever produced the video, nothing about the platforms that carried it, and nothing about the advertising or creator-payment systems that may have monetised it. Compare China's Supreme People's Court, which attaches liability to the act of generating an unconsented likeness and to service providers once they are on notice. Ghana's instrument has no equivalent limb, so the only party it can penalise is the one hardest to find.

How much that omission costs is measurable elsewhere. ABC News reported on 9 September that Reset Tech had tracked more than 200 Facebook pages in Australia deepfaking named politicians, part of 1,864 globally, with roughly 10% monetised through Facebook's creator-payment scheme and only one in three posts carrying an AI label. Where impersonation pays its own way through platform monetisation, an instrument aimed solely at the depositor-facing scheme leaves the revenue model untouched.

‍

The numbers Ghana actually records

Between January and July 2026 the Cyber Security Authority recorded 1,818 online fraud cases out of 3,876 cybersecurity incidents reported to the national Computer Emergency Response Team, about 47%. Director-General Divine Selase Agbeti has linked the trend to the growth of digital financial services, noting fraud cases at financial institutions rose 48% between 2024 and 2025, with the Bank of Ghana's 2025 Fraud Report putting GH¢101 million at risk.

The narrower figure is the more useful one. The Authority recorded 352 online investment scam cases in the first half of 2026, with victims losing GH¢3,429,447 between them, averaging GH¢9,743 per reported case. That is an arithmetic mean of a distribution with a probable long tail, computed over cases reported at all, so it is a scale indicator rather than a loss estimate.

‍

No figure exists for losses attributable to the Mahama videos specifically. Not in the notice, not in the police statements, not in any of the coverage read for this article. That absence is the norm for deepfake endorsement campaigns and it is why the category is chronically under-resourced relative to the harm: the loss is recorded as investment fraud, the deepfake is recorded as the reason a warning was issued, and nothing joins the two.

‍

Where detection has to intercept

Three placements follow from the timing analysis, in descending order of how much they change.

At ad intake, which the notice has already mandated in everything but name. Point 3 asks Ghanaian media to screen inbound creative. The screen that would actually work treats a class of content as high-risk rather than checking a register: any advertisement in which a head of state, a central bank official or a financial regulator appears to endorse an investment product. That is a narrow, enumerable pattern, it recurs across every case in this article, and it is checkable before anything runs. DuckDuckGoose's DeepDetector is built for exactly this position in the flow, on video that has already been re-encoded for delivery rather than on pristine originals.

At merchant onboarding and payment rails. An unlicensed operator still needs somewhere for the deposits to land. A licence-register lookup is a poor consumer duty and an excellent automated control, and it belongs at the point where a merchant is onboarded rather than at the point where a retail victim is deciding whether to trust a video.

At the evidence layer, if prosecution is meant to be the endgame. Thirteen arrests with no recorded outcome is at least partly an evidentiary problem, and the artefact a court eventually sees will be a re-encoded copy scraped from a platform, not the file the operator rendered. Detection that produces explainable, artefact-level output on that copy is the difference between a case that can be argued and one that stalls at remand.

‍

What this notice does not settle

• No loss figure attributable to the Daily Wealth Guide campaign or to any of the Mahama videos has been published.
• No distribution detail. Whether the video ran as paid advertising, organic posts or direct messages is unstated, and the three imply completely different interventions.
• No takedown numbers. Neither regulator says how much material has been removed, by whom, or on what timescale.
• No outcome for any of the thirteen arrests, 162 days after the last recorded step in the March case and 107 after the May listing.
• A live source conflict on the nationality split of the eleven arrested in May, five-six against six-five, unresolved by any source read here.
• No indication whether section 53(3) penalties have ever been applied to a scheme of this type, which is what would tell you if the penalty band is a real deterrent or a notional one.
• Whether “Daily Wealth Guide” is one operation or a reused brand is unknown; nothing in the record connects it to the groups arrested in March or May.

‍

Frequently Asked Questions

What did the Bank of Ghana and the SEC actually warn about?
A crypto investment platform called “Daily Wealth Guide”, promoted through a doctored video in which President John Dramani Mahama appears to endorse it. Their joint notice of 1 September 2026 states that the Bank has licensed no entity to engage in crypto investment, and that inviting the public to invest amounts to unlicensed deposit-taking.

Is the deepfake itself illegal in Ghana?
The notice does not rest on that question. It uses deposit-taking and anti-money-laundering law, making the scheme unlawful regardless of how the advertisement was produced. Police warned separately in March that creating or sharing deepfake content is a criminal offence, though no completed prosecution appears on the public record.

Has anyone been convicted over the Mahama deepfakes?
Not on the public record. Thirteen people were arrested across two operations in March and May 2026. Reporting in both cases stops at the remand stage, and no conviction, acquittal or dismissal has been reported by any source reviewed for this article. All are entitled to the presumption of innocence.

What does the notice require Ghanaian media to do?
Not to permit these operators to advertise, and to verify licensing status with the Bank of Ghana before running their products or services. In practice that makes broadcasters and publishers a screening layer for deepfake-promoted investment fraud, without specifying what they should screen the creative with.

Why are heads of state so often the impersonated figure?
Because the reference material is abundant and high quality. Official broadcasts supply continuous front-facing, well-lit, clean-audio footage, and current methods need very little of it, so the identity with the most institutional trust is among the cheapest to fabricate convincingly.

How much have Ghanaians lost to investment scams?
The Cyber Security Authority recorded 352 online investment scam cases in the first half of 2026 with total reported losses of GH¢3,429,447. No figure has been published for losses attributable to the Mahama videos specifically.

‍

Methodology

The primary source is the Bank of Ghana and SEC notice itself, No. BG/GOV/SEC/2026/27 of 1 September 2026, retrieved from bog.gov.gh and read in full; every quotation of it comes from that document rather than from coverage of it. The March and May enforcement episodes are sourced to Rainbow Radio Online, the Ghana News Agency and MyJoyOnline, each read directly. National figures come from Cyber Security Authority statements as reported by The Ghana Report and Pulse Ghana; the Australian comparison is from ABC News. Day counts in Table 2 are measured to 9 September 2026. No arrested person is named. Where sources conflict, the conflict is stated rather than resolved, and where a figure does not exist the table says so instead of dropping the row.

‍

Sources

• Bank of Ghana and Securities and Exchange Commission, Notice No. BG/GOV/SEC/2026/27, “Scam Alert: Daily Wealth Guide”, 1 September 2026. Link
• Graphic Online, BoG, SEC warn public over fake video using President Mahama's images in promoting crypto scam. Link
• The Ghana Report, BoG warns public against ‘Daily Wealth Guide’ crypto investment scam. Link
• Rainbow Radio Online, Police arrest 2 suspects over deepfake scams targeting President Mahama and wife, 31 March 2026. Link
• Ghana News Agency, Eleven arrested for allegedly impersonating President John Mahama, 8 May 2026. Link
• MyJoyOnline, IGP's Cyber Vetting and Enforcement Team arrests 11 for impersonating President Mahama. Link
• Pulse Ghana, Ghanaians lost GH¢3.4 million to online investment scams in the first 6 months of 2026. Link
• ABC News, Foreign ‘AI slopaganda’ network targets Australian politicians with deepfakes, 9 September 2026. Link
• The Sentencing Project, Media Guide: 10 Crime Coverage Dos and Don'ts. Link

Last update: Q3 2026.