That helpful answer at the top of your search results can hand you a phone number that belongs to a criminal. New research shows criminals are now planting those numbers on purpose, at scale.
What is actually going on
When you ask Google, ChatGPT or Gemini for a company’s customer service number, you usually do not get a list of links. You get one confident answer, written by reading pages from all over the internet — forums, review sites, PDFs, small blogs — and repeating what they say.
On 23 September, researchers at the security company Vigilance published details of a campaign they call “Dark Sourcery”. It plants tens of thousands of pages full of fake support numbers, fake email addresses and copycat login pages, then dresses them up so that AI tools pick them up. The AI repeats the fake number as if it were helpful advice.
The researchers counted at least 374 companies being impersonated, among them Lufthansa, Delta, Chase, Bank of America, Airbnb and TripAdvisor. They also phoned some of the fake numbers themselves. The people who answered offered to “move our flight” or “unlock our bank account” — and asked for credit card details.
“Here, the malicious information becomes part of the AI’s answer itself,” said Ariel Simon, vice president of research at Vigilance. “A fraudulent support number is presented as helpful guidance, potentially without the user ever looking at the page that supplied it.”
Why it matters to you
You already know to be careful when a stranger phones you. This is the other way round: you make the call. A number that sits inside a tidy AI answer feels as if somebody checked it, and that feeling is doing the work for the scammer. Nothing was checked. The AI does not ring the number, and it cannot know which numbers are real.
The Washington Post reported the case of a man who searched for his cruise company’s customer service number, called the one in Google’s AI answer — and was billed 768 dollars for something the company does for free.
What follows is the same routine every time. The person on the line is calm and unhurried. Then they ask you to install a program that lets them see and control your screen — TeamViewer and AnyDesk are real products, which is why the request does not feel wrong. Or they want the code your bank texts to your phone. Or they need your card number “to send the refund”. Money that leaves your account that way is very hard to get back.
A study quoted by the researchers found that 91 in every 100 people who use AI chatbots never check the answer. That gap is what is being sold.
What you can actually do
- Never call a number that an AI answer or chat assistant gives you. Treat it like a number a stranger shouted at you in the street.
- Get the number from something you already have: the back of your bank card, a bill or a statement, the sticker on your router, or the app you are already signed in to. A scammer cannot buy a place on any of those.
- Open the company’s own website yourself — type the address into the address bar instead of the search box — and use the contact page there. Bookmark it, so you never need to search again.
- On the phone, hang up if you are asked to install a screen-sharing program, to read out a code that was sent to your phone, or to give your card number so a refund can be sent. Real support needs none of those three things.
- If you already gave your card details, call the number printed on the back of your card straight away. If you let somebody onto your computer, disconnect from the internet and change your email password from another device.
- Report it — in Germany, to the police and to the Verbraucherzentrale, the consumer advice centre — and tell the company whose name was used.
Common misunderstandings
Myth: somebody must have checked the number before the AI showed it to me
AI answers are stitched together from pages other people wrote. There is no help desk behind them and no list of verified numbers. Google says it removes fake numbers it finds, but nothing is checked before the answer reaches you.
Myth: I would notice that I was talking to a criminal
The researchers were not sure either, so they rang and found out. They spoke to polite, unhurried people who knew real details about the service they were pretending to sell. Nothing sounds wrong until the payment request arrives.
Myth: it was at the top of the page, so it must be the official number
Being first is the whole point of the trick. The number appears in many ordinary-looking places online so that the AI repeats it, and repetition is what makes it look official. Position shows how the answer was built, not that it is true.
What to watch for next
The campaign is still running, and the researchers expect more companies, more languages and new places for the numbers to hide: chat windows, replies to reviews and paid advertisements, as well as AI answers. The warning signs travel together — a problem you did not know you had, a number to call right now, and a payment that cannot be reversed. Lufthansa is already on the list.
The one thing to remember
A number you can trust is one the company gave you — on your bank card, your bill, your router, or inside the app you are signed in to. Everything else, including a confident answer at the top of the screen, is something a stranger wrote on the internet.
Image credits: photograph by Sarah Blocksidge, published on Pexels under the Pexels License (free to use; attribution not required). Source page: pexels.com/photo/a-worried-man-talking-into-a-smartphone-8358995/