An AI assistant might give you a scammer's number, claiming it's the "official support" number for your bank or software provider—a campaign is tampering with the sources the AI reads.
More and more people are quickly looking up a phone number or contact address by asking an AI assistant directly—such as ChatGPT, Gemini, or the Google AI Overview box. Researchers at Vigilance Security have documented a campaign called “Dark Sourcery” that exploits this very habit.
The idea behind the attack is simple. Attackers flood the internet with fake support pages, PDFs, and reviews—written and optimized specifically so that AI models will consider them “authoritative” and index them. When someone asks an AI assistant for a company’s support number, the model retrieves this false data and presents it as the official answer, without the user ever seeing the source page. This isn’t a case of prompt injection: the source the AI reads is the one that’s been tampered with.
The consequence is immediate. In the cases studied by researchers, anyone who called the “support” number recommended by the AI ended up speaking with scammers who asked for their card information under a false pretext. The campaign affected at least 374 companies, including banks and large firms, and a study found that 91% of AI assistant users do not verify the responses they receive.
For a small business, the risk doesn’t come from a compromised program, but from a habit: an employee in a hurry copies a number or a link from an AI chat and calls or logs in without checking it first. The rule that stops the attack costs nothing.
What you need to do:
- The support number, email address, and login link for banks, service providers, and programs should only be obtained from the official website—by typing the URL manually into your browser or using a saved bookmark—never from an AI response.
- Treat any number or link received from an AI assistant as unverified until you confirm it on the company’s official website.
- Make it clear to your team: no one should call a “support number” or log in via a link from a chat or an AI search.
- Save the actual support numbers for your bank and key service providers ahead of time, so no one has to scramble to find them in a hurry.
Sources:
This article was generated with AI assistance.