AI profiles of women on Facebook: Identity deception, sexualised engagement, and platform accountability

Speed Read

• 10 Facebook profiles posing as Sri Lankan women were found to be entirely AI-generated, using fabricated identities to attract users and drive them to gambling, adult-chat, crypto and other dubious platforms.
• The investigation identified clear signs of coordinated activity, including identical captions, cross-posting within minutes, and nearly 900,000 engagements across 1,706 posts, indicating an organised network rather than isolated fake accounts.
• The study found that Facebook’s existing features enable these deceptive operations to function largely undetected, while key details such as ownership, automation and revenue remain hidden from public scrutiny.

This report is the first of its kind in Sri Lanka: a systematic account of how AI-generated women are manufactured, coordinated and monetised on Facebook. Not one of the women fronting the 10 accounts studied is real, but the system behind them is, present and operational in Sri Lanka, built for speed, scope and scale, and converting fabricated intimacy across 1,706 posts and 890,632 engagements into attention, private contact and off-platform traffic towards gambling, adult-chat, adult dating, crypto and other dubious financial destinations.

The coordination is measurable rather than inferred, because five of the accounts effectively write with one hand, leaving 113 clusters of identical captions, 676 near-duplicate pairs and high-performing posts relayed from account to account within minutes, inside compressed 10-day posting windows with sub-minute median gaps. Engagement runs hub-and-spoke, with three pages capturing more than half of all attention while the remaining personas are held in reserve as disposable inventory. The bait is heartbreak in Sinhala, staged through personas presenting as lonely, widowed, divorced or financially exposed women seeking private contact, while the imagery is calibrated to a fetish niche (exaggerated busts, simulated sweat, deliberately exposed armpits) engineered to stay on the platform-safe side of moderation.

The money trail hides in plain sight, in profile bios, shortlinks and first comments where operators can change destinations without editing a post and where bulk auditing rarely reaches; the traced routes end in adult-chat surfaces, gambling registration, crypto downloads and advertising-arbitrage pages. The women even change names between the feed and the landing page, resurfacing under new identities at the point of conversion, and nothing inside the feed discloses the switch.

Nor is this a peculiarly Sri Lankan pathology, since accounts working in Spanish, Italian and Malayalam reproduce the same architecture at more than three times the per-post efficiency, framing the local network as the franchise of a transnational operating model in which the synthetic woman is the interchangeable part. The evidence for a political influence operation is low in this data, but the infrastructure is dual-use, since audiences already assembled, personas already trusted and provenance already invisible are precisely what such a campaign would need, and the same features act as a force multiplier for the crypto and financial scams already resident on Meta’s platforms in Sri Lanka. 

Because every mechanism documented runs on Facebook’s own affordances, on public surfaces that give a user no way to distinguish a person from a funnel, the deception required no rule-breaking at all, and the transparency tools that should make the difference visible appear only by exception. What remains unproven (common ownership, operator identity, ad spend and revenue flow) sits beyond anything a public surface allows an observer or a regulator to establish, and that limit is itself a finding about how little accountability the platform’s visible layer affords.

Key highlights

1. In the first systematic study of its kind in Sri Lanka, none of the 10 Facebook accounts examined belongs to a real woman: each trades on the name, face and life of a Sri Lankan woman assembled by AI, a finding the photographic evidence places beyond reasonable doubt.
2. Five of the accounts write with one hand, leaving 113 clusters of identical captions, 676 near-duplicate pairs and posts relayed from account to account within minutes, a pattern of coordination that coincidence of style cannot explain.
3. At 1,706 posts and 890,632 engagements, the scale is industrial rather than artisanal, with three pages capturing 51.9% of all attention, and the remaining personas held in reserve as disposable inventory.
4. The bait is heartbreak in Sinhala: scripted loneliness, widowhood, divorce and financial distress, each engineered to move a sympathetic stranger from a public comment to a private WhatsApp chat.
5. The imagery is calibrated to a niche rather than to glamour, with exaggerated busts, simulated sweat and deliberately exposed armpits recurring across the highest-reach Sri Lankan pages and the foreign set, an erotic vocabulary designed to slip beneath the threshold at which moderation acts.
6. The money trail hides in plain sight: the links that matter sit in bios, shortlinks and first comments, where bulk auditing rarely reaches, and resolve to adult-chat, gambling, crypto and advertising-arbitrage destinations.
7. The women change names between the feed and the landing page (Kavya becomes Kumari, Nethmi becomes Wasana and then Hiruni), and a user inside Facebook has no way of seeing the switch.
8. The evidence for a political influence operation is low in this data, but the infrastructure is dual-use, since audiences already assembled, personas already trusted and provenance already invisible are precisely what such a campaign would need.
9. Accounts working in Spanish, Italian and Malayalam reproduce the same architecture at more than three times the per-post efficiency (median engagement of 459 against 130), which frames the Sri Lankan network as the local franchise of a transnational operating model.
10. None of this required breaking Facebook’s rules so much as using Facebook well, since every mechanism documented runs on the platform’s own affordances, and the platform’s public surfaces give a user no way to detect the deception.
11. The report’s limits are themselves telling, because common ownership, operator identity, backend automation and revenue flows sit beyond anything a public surface allows an observer, or a regulator, to establish.

Download the report in full here.

Banner Image: Composite image of Facebook profile photos analysed as part of an investigation into AI-generated identities and coordinated online engagement. Image created by Dr. Sanjana Hattotuwa.

This report was produced by Dr. Sanjana Hattotuwa and was originally published on sanjanah.wordpress.com. He studies information disorders, influence operations, and information integrity in order to evaluate the impact on public opinion, political discourse and democratic institutions.