Fake Customer-Service Chatbots

Fake customer-service chatbot scams deploy AI-powered chat interfaces that impersonate the official support system of a real, recognisable brand — a bank, retailer, streaming service, telecoms company, or government agency. The chatbot is hosted on a fraudulent page, served through a paid search advertisement, or promoted via social media, and is designed to look and behave indistinguishably from a legitimate brand assistant.

Unlike earlier phishing pages that simply collected typed credentials through a static form, modern fake chatbots conduct a dynamic conversation. They respond naturally to questions, follow support scripts that mirror the real brand's language and tone, and adapt their requests to the user's stated problem. This conversational fluency reduces suspicion — it feels like a real support interaction rather than a data-harvesting page.

The scam's goal is to collect account credentials, card numbers, security codes, or one-time passwords, or to persuade the user to install remote-access software under the guise of a technical fix. The stolen data is then used to empty accounts, make fraudulent card transactions, or sell credentials on to other fraudsters.

Scammers register a domain close to the real brand's domain — a character swapped, a different extension, or a phrase like 'support' or 'help' added — and build a page that mirrors the brand's visual identity. The page hosts a chatbot (often built with commercially available AI) pre-programmed with the brand's support flows and common customer queries.

Traffic arrives through several routes. A paid search advertisement appears above the genuine brand result when users search for '[brand] customer support' or '[brand] help'. A social media post from a fake brand account links directly to the fraudulent page. A phishing email or text directs users to click through for 'urgent account verification'.

The chatbot opens with a natural greeting and asks the user to describe their problem. It then follows a script that mirrors genuine support: it asks for an account email 'to look up the record', requests a verification code 'sent to your phone', asks for a card number 'to process the refund', or directs the user to download a 'diagnostic tool' that is actually a remote-access application. Each step is presented as a standard, necessary support procedure. Once the scammer has what they need, the chat ends or the user is told the issue has been escalated — the fraudulent activity begins behind the scenes.

People contacting customer support are already in a problem-solving mindset. They are focused on resolving their issue and are primed to cooperate with whoever is helping them. This cooperative state makes it easier for a fraudulent support agent — human or AI — to request sensitive information that a person in a neutral state would refuse.

The AI chatbot removes the human inconsistencies that previously made fake support pages feel wrong. A real support conversation has a natural flow, remembered context, and an appropriate level of formality. Modern chatbots replicate all of these well enough to clear the threshold of 'this seems genuine'.

The search-ad placement is particularly effective. Users who search for official support contact information trust search results and often cannot distinguish between a paid advertisement and an organic result. Appearing at the top of results confers a strong implied credibility even when the site is fraudulent.

A person searches for the contact details of their bank's fraud team after noticing an unusual transaction. The top search result is a paid advertisement for a site with a slight variation of the bank's domain. They click through and a professional-looking chatbot greets them. After explaining the situation, they are asked to confirm their account details and the one-time passcode sent to their phone 'to locate the account record'. They provide both. Within minutes, a real transfer is authorised from their account using the stolen credentials and passcode.

Hi! I'm [brand]'s AI assistant. To process your refund, please confirm your login and card details.

To locate your account and investigate the transaction, please enter the one-time code we just sent to your phone.

Our system has detected an issue with your device. Please download [tool] so our technician can perform a remote diagnostic.

Your account has been temporarily restricted. Verify your identity by providing your full card number and CVV now.

Refund approved! To transfer [amount] to your account, please confirm your sort code, account number, and card PIN.

I've escalated your case. In the meantime, our security team needs your current password to secure the account.

Always navigate to a brand's support page by typing the official web address directly, using a saved bookmark, or clicking through from the official app — never from a search advertisement or a link in an email or text message.

Before engaging with any chatbot, verify you are on the correct domain by examining the full address bar. Check for minor misspellings, unexpected extensions (.net instead of .co.uk), or appended words like '-support', '-help', or '-service'. Legitimate brands do not run their primary support through third-party domains.

No genuine customer-service system will ask for your full password, your full card number plus CVV, or a one-time verification code sent to your phone. Verification codes are sent so that you can authenticate yourself to the brand, not so that you can read them to a chatbot. If asked for any of these, stop the interaction immediately.

If a chatbot suggests downloading any software to resolve your issue, treat this as a critical red flag. Contact the brand through a separately verified channel to confirm before installing anything.