A 44-page EY report on loyalty fraud looked polished and authoritative. Then a three-person team checked the footnotes. Most of the citations were broken, misattributed, or invented by AI. EY pulled the report the same day.
In late 2025, EY Canada published a report called "Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems." It was 44 pages long. It had charts, statistics, and a tidy table of sources at the back. It looked like the kind of document a firm uses to brief clients and win new work.
On May 14, 2026, the AI-detection company GPTZero published an investigation into the report. The team checked the 27 sources EY had cited. The majority did not hold up. URLs were broken. Titles did not match any real article. A McKinsey study that the report leaned on for a key market figure did not exist at all. A Gartner document cited in the report could not be found either. Two separate Wired articles returned 404 errors. EY removed the report from its website the same day and said it was reviewing how the report came to be published.
The report's headline number was a $200 billion figure for the loyalty market. It appeared twice. The first time, it described the total market value. The second time, the same $200 billion was used to describe unredeemed points only, which is a much smaller slice. Two different claims, one number. The second use was credited to McKinsey. GPTZero found that the statistic actually traced back to an obscure fintech blog post from months earlier, not to McKinsey at all.
This is what AI-written research looks like when nobody checks it. The text reads well. The footnotes are formatted correctly. The sources are named brands you trust: McKinsey, Gartner, Forbes, Wired. Everything signals "this is reliable." But the links go nowhere, the studies are not real, and the numbers contradict each other. An engineer at GPTZero called this pattern "vibe citing," which is when a language model produces references that feel right but were never real.
EY told the Financial Times that it takes the accuracy of its published content seriously and has a firm-wide commitment to the responsible use of AI. The report, EY said, was not connected to client work. Still, the damage to a research document is the credibility of the numbers inside it, and those numbers were already in circulation. The report had even been referenced in news coverage in Australia before anyone caught the problem.
A language model does not know the difference between a real source and a plausible-sounding fake one. When you ask it to back up a claim, it generates a citation that fits the shape of a real reference: a brand name, a believable title, a URL pattern. The model is not looking up a document. It is predicting what a citation for this kind of claim would look like. Sometimes the document is real. Often it is not. The output looks the same either way.
The same problem shows up in AI analytics tools. Ask an AI assistant "what was our best-performing channel last quarter?" and it will give you a confident answer with a specific number. The answer might come from your real data. Or it might be the model filling in what a number like that usually looks like for a company like yours. You cannot tell by reading it. A made-up figure and a real one are written in the same calm, certain voice.
That is the heart of the EY story. The report did not fail because the AI sounded unsure. It failed because the AI sounded completely sure, and was wrong, and there was no step in the process that checked each claim against a real source before it shipped.
Askalytics grounds each figure in your own warehouse, so there are no invented sources, and any figure that does not match the data is flagged.
The fix is not to hope the model invents fewer fake sources. The fix is to make every claim traceable to the exact query that produced it, so any figure you cannot trace stands out, and to have a second model re-check the conclusion.
Askalytics is built around that rule. The AI queries your own data warehouse directly and runs the queries it needs, but every number it reports traces back to the exact query that produced it. You can open the receipt for any figure, the Advanced Breakdown, and see the query, the rows, and the source it came from. Run the same query against the same data and you get the same number, every time. If a number has nothing behind it, there is nothing to open, and it stands out at once.
On top of that, a Confidence Check reads the same evidence with a second, different AI model. If the two models disagree about whether the data supports the conclusion, the insight is flagged and the conflict is shown to you. A single model is good at agreeing with itself. Two models built differently fail in different places, so when both confirm an answer, you have real signal that it holds up.
Run the EY report through that kind of process and the $200 billion figure does not survive. There is no query in your data that produces a McKinsey study that does not exist. There is nothing to open behind a broken Forbes link. The claims with no source stand out immediately, not weeks later when a reader happens to check.
The EY report is a clean example because the failure is so easy to see once someone looks. A polished document, real brand names in the footnotes, and underneath it, sources that were never real. The lesson for anyone buying an AI analytics tool in 2026 is not "is the writing good." The writing is always good. The question is whether the tool can prove where each number came from, and what it does when it cannot.
To see how Askalytics ties every number to the query that produced it, read about our traceable AI Insights and the Confidence Check that backs up every insight. You can also see how we compare to other AI analytics tools.