Why Big Four Reports Shipped With Fabricated AI Citations

← Back · ACT II · Chapter 13: The AI Amplifier

Deloitte, KPMG and EY each shipped a report with fabricated citations inside eight months, and the failure was arithmetic, not character.

In October 2025, Deloitte Australia’s welfare-compliance report for the Department of Employment and Workplace Relations was found to cite academic papers that did not exist and to carry a fabricated quote from a federal court judgment. The contract was worth about AU$440,000, roughly US$290,000. Deloitte refunded about AU$97,000, roughly US$63,000, a little over a fifth, and the corrected version disclosed that a generative AI system had been used to produce it.

In May 2026, GPTZero published an investigation into Ernst and Young Canada’s report on fraud in loyalty systems. Sixteen of its 27 cited sources were fabricated, misattributed, or led to pages that no longer existed. The fake citations were attributed to Forbes, McKinsey, Gartner, TechCrunch and Wired. One reference to a McKinsey report traced back not to McKinsey but to a low-quality blog post. EY Canada withdrew the report.

In June 2026, GPTZero ran the same exercise on a KPMG report on agentic AI published the previous October. Of its 45 citations, five pointed to the source they named. UBS, the UK’s National Health Service, Swiss Federal Railways and Transport for London all disputed what the report said about their own AI use. KPMG withdrew it.

Three Firms That Sell Judgment

None of these firms lacked a review process. All three sell judgment for a living, and all three have layers built to catch exactly this. The comfortable reading is that someone was careless and better oversight would have caught it. That reading is wrong, because it implies the fix is more conscientious people.

Look at what catching it actually required. EY’s report carried 27 references. Confirming each one means opening the source, checking it exists, and checking it says what the report claims. Do that for 27 citations and the check consumes a meaningful share of the hours that went into writing the report. For KPMG’s 45 citations, the check costs more than the section it supports.

That is the mechanism. When verifying a piece of work costs about what producing it costs, verification stops being a step and becomes a second project. Second projects do not get funded by accident. Nobody at any of the three firms decided to skip the check. The check was never priced, so it never appeared in a plan, and the review that did happen tested whether the document read well. It read well. A fluent citation to a McKinsey report that does not exist looks exactly like a fluent citation to one that does. The surface carries no signal, and the surface is what review inspects.

The Retraction Does Not Recall The Citation

The downstream damage has been widely noticed and the trade press has named it. It is worth restating because of where it lands, not because it is new.

The EY figures reached a Canberra Times article that was syndicated to more than sixty Australian newspapers. The loyalty-economy numbers the report invented now sit inside dozens of published articles, which AI research tools read as ordinary source material. Both EY and KPMG withdrew their reports. Neither withdrawal reaches the sixty newspapers or the systems that already absorbed the numbers as fact. A retraction removes the document. It does not recall the citation.

The origin point matters as much as the spread. The invented McKinsey reference did not start inside EY. It arrived already looking legitimate, was picked up on that appearance, and acquired EY’s authority on the way through.

The Buyer Cannot Wait For The Seller To Price It

This is where the mechanism stops being a professional-services story and becomes a buyer-governance one. If firms whose entire product is verified judgment will not fund the check on their own output, no buyer should expect a vendor to fund it on a business case, a benchmark, or a claim of impact. The market has now run the experiment three times in eight months, at three of the largest firms in the category, and the result was the same each time. Others have drawn lessons from these three cases since June, and nearly all of that writing is addressed to boards worrying about their own use of AI. That is a different seat from the buyer’s, and it leaves the cost of the check, and who pays for it, untouched. An unpriced check does not happen, regardless of the firm’s size or brand.

The Value Standard’s answer is not a request for more careful vendors. It is a condition the buyer writes into the Request for Value before the number enters evidence: name the claim, name the instrument that produced it, and name who is confirming it exists and says what it is cited as saying. When no name is attached to that check, it becomes a stage everyone assumes somebody else is running.

The same unowned check sits under vendor business cases, which is where The Business Case for Your Purchase Was Written Without You picks the thread up.

That condition cannot stop at the seller’s door either. The buyer’s own file absorbs third-party figures the same way EY’s report absorbed a fabricated McKinsey citation, on the strength of a familiar name and a plausible sentence. This site has covered two related failures in that file already: a real figure whose meaning inverts as it is restated, in How One Gartner Figure Changed Meaning in Business Cases, and the absence of any audit regime over purchase-justifying numbers at all, in The Numbers Behind Big Purchases Are the Only Ones Nobody Audits. This is the layer beneath both. Even where an institution exists to run the check, and sells the running of checks, it does not run when nobody paid for it.

What Enters Evidence

A number earns a place in a business case when three questions have answers: what instrument produced it, when was it fielded, and who confirmed it says what it is cited as saying. Without an answer to the third question, all a citation shows is that somebody typed a name next to a number.

Sellers who sell judgment for a living have now shown, three times, that the check does not run itself. The buyer’s standard has to require it, price it, and name who owns it, because nobody upstream is going to volunteer.

References: GPTZero, “Investigation: Hallucinations in Ernst and Young Report on Loyalty Fraud,” May 14, 2026: https://gptzero.me/investigations/ey. Computing, “EY cybersecurity report pulled after probe finds AI hallucinations”: https://www.computing.co.uk/news/2026/ai/ey-cybersecurity-report-withdrawn-ai-hallucinations. TechCrunch, “KPMG pulls report on AI usage due to apparent hallucinations,” June 13, 2026: https://techcrunch.com/2026/06/13/kpmg-pulls-report-on-ai-usage-due-to-apparent-hallucinations/. Fortune, October 7, 2025: https://fortune.com/2025/10/07/deloitte-ai-australia-government-report-hallucinations-technology-290000-refund/. ACS Information Age, “EY retracts cyber report littered with AI errors”: https://ia.acs.org.au/article/2026/ey-retracts-cyber-report-littered-with-ai-errors.html. GPTZero, “Chasing the Hallucinations: KPMG’s AI-Powered Attempt at Redefining Excellence,” for the 45 citations and the five that resolve: https://gptzero.me/news/investigations-kpmg/. Cybernews, “Deloitte refunds Australia over AI report errors,” for the A$440,000 fee: https://cybernews.com/ai-news/deloitte-refund-australia-producing-faulty-ai-report-welfare/. CFO Dive, “Deloitte refunds over $60K for report with AI errors, Australian government says,” for the A$97,000 refund: https://www.cfodive.com/news/deloitte-refunds-60k-report-ai-errors-australian-government-accounting/803321/.

Keep reading: ACT II · Chapter 13: The AI Amplifier