Fake support: when AI hands you the scammer's phone number

The flight is delayed, the card is blocked, the package vanished. You do what everyone does: type "[company] customer service phone" into a search engine — or, increasingly, ask an AI directly. A number shows up looking official, you call, and on the other end a polite agent fixes everything: they just need you to confirm a few details, the card number, that code that arrived by SMS. Weeks later the statement arrives. The agent was the scammer — and you were the one who dialed.

This is the fake support scam in its current form, and it has one trait that makes it especially treacherous: it reverses the direction of suspicion. Everyone has learned to distrust whoever calls offering help; almost nobody distrusts the number they found themselves.

How the fake number reaches you

The fake support scam plants phone numbers and bogus service pages exactly where people go looking for the real ones: search results, sponsored ads, maps, social media and, more recently, answers from AI assistants that repeat that poisoned data. The victim calls believing they verified it — after all, "it was on Google".

The planting channels, oldest to newest:

• Sponsored ads: the scammer buys the ad for "[bank] customer service" and shows up above the official site. It looks like the top of the search; it's a rented billboard.
• SEO poisoning: pages optimized for "[company] toll-free number" climb the organic results — hosted on hacked sites or on lookalike domains, cousins of the typosquatting we've already covered.
• Hijacked business listings: profiles on maps and directories accept "suggested corrections" — and scammers suggest correcting the phone number. The address is real, the reviews are real, the number is theirs.
• AI as an unwitting amplifier: assistants and automatic search summaries assemble answers from those contaminated sources. There are already documented cases of scam numbers delivered with the usual confident fluency — with no warning that the "source" was a page planted the day before. The model can't verify a helpline; it can repeat what the web says, and the web, on this particular corner, lies.
• The helpful comment: under any company's social post full of complaints, replies from an "agent" appear offering to sort it out over WhatsApp. The profile is fake; the queue of victims forms by itself.

What happens on the call

Once you're through, the script is classic vishing with first-class service: professional script, a "case number", hold music, sometimes a synthetic voice to sound like a real phone menu. The goal varies — card details, the SMS verification code (which is the key to your account, never "signup confirmation"), installing a remote-access app "for diagnostics", or a transfer to cover some "fee". The scam's competitive edge is patience: whoever calls already needs help, and gratitude disarms vigilance better than any rush.

How do you find a company's real support number?

From the source the scammer doesn't control: the back of your card, the official app already installed, your statement, or the company's site typed out in full in the address bar — never the first search result, never an ad, never a number received in a message or a comment. For banks, the app handles almost everything without a call at all; for everything else, the footer of the official site is the trustworthy directory. Thirty extra seconds of detour, and the entire scam stops existing.

The rules that armor any support call

• Never read out an SMS code. Ever. No legitimate call center asks for the code that arrived on your phone — that code is the lock. If they ask, it's a scam, goodbye.
• Support doesn't ask for your password, doesn't ask for a transfer, doesn't ask for TeamViewer. Any of the three ends the conversation on the spot.
• You are the one who calls — using the number from the official source. If the company "called" warning you about a problem, hang up and go back through the app. The same reflex applies to email: the signs of phishing and fake support are the same animal in different habitats.
• Beware of someone else's hurry: "your case expires today", "I'll have to transfer you and you'll lose the case number" — manufactured urgency is the signature of all social engineering, and a real agent doesn't rush you.
• Double-check whatever the AI hands you: an assistant's answer quoting a phone number, a payment key or a support link deserves the same scrutiny as a search result — because, in practice, that's what it is, wearing a veneer of certainty.

Fake support closes a loop this blog has been mapping in the guide to AI scams: modern fraud doesn't break into your machine, it intercepts your trust on the way between you and whoever you were looking for. The defense fits in a single habit — the official channel is found at the official source, not in a search. Teach it to the people you love before the next delayed flight, because the moment of stress is exactly when nobody checks the number that shows up first.