Expert: Ariel Simon, Vigilance (security research), author of the fraud-campaign investigation "Dark Sourcery: How Hackers Manipulate AI to Scam You" (Medium, 2026-09-22) The fake numbers, URLs and email addresses are not anything the brands publish - they are attacker-planted pages that the AI systems retrieved and repeated as fact. Vigilance built a detection pipeline that queries ChatGPT, Gemini and Google's AI Overview, scores their sources for signs of Generative Engine Optimization (GEO) manipulation, and flags cases where a fabricated contact detail was returned as the brand's official one. The scan documented 374 affected companies and tens of thousands of malicious pages, and unlike classic phishing it runs on trusted, high-traffic surfaces: social media, forums, YouTube and Vimeo descriptions, Medium, GitHub Pages, WordPress sites, PDF uploads to .edu and government domains, and job boards and fundraising platforms. The payloads are built for citation, not for humans. Vigilance catalogued five recurring techniques: GEO-optimized contact details wrapped in FAQ formatting with urgency language ("call now", "updated 2026"); semantic obfuscation, where one number is rendered dozens of ways so it still tokenizes identically while evading filter matching; cross-platform saturation, replicating identical content across unrelated domains to simulate independent corroboration; authenticity camouflage, interleaving fabricated data with real information, AI-generated images and fabricated engagement metrics; and manufactured urgency around high-stress scenarios such as cancelled flights, locked accounts and refund requests, chosen to short-circuit verification. Takedowns do not close the hole. The campaigns are automated, with hundreds of new posts per platform per targeted company per day, and pages archived by the Wayback Machine stay crawlable by search engines and AI systems after the original is removed. In one documented case, fraudulent content targeting American Airlines, posted on LeetCode, produced more than ten pages of Google results within 24 hours, and an associated fraudulent PDF stayed live on a web archive after the source post came down. Disclosure went nowhere. Google classified the report as out of scope for its vulnerability rewards programme, stating that AI-generated misinformation and social-engineering scenarios are not covered; OpenAI closed it as unreproducible, citing no demonstrated user impact. Both responses follow from the same structural fact: the attack manipulates the content the model retrieves and repeats, not the vendor's own systems, so it falls outside how either company defines a reportable vulnerability at present. Vigilance's conclusion is that this is not a bug waiting for a model patch but a consequence of how generative AI sources information - it cites whatever looks most authoritative, and authority can currently be manufactured at scale, for free. The gap is ownership: security teams monitor infrastructure, marketing teams monitor rankings and sentiment, fraud teams monitor transactions, and nobody systematically checks whether the assistant hands a customer a fraudulent phone number when the customer asks how to contact a brand. Source: https://www.expresscomputer.in/news/ai-chatbots-are-serving-up-fake-support-numbers-to-millions-of-users/139234/