When the site an AI suggests is fake: four checks before you buy

Short answer

A site that a generative AI points to in its answer is not necessarily genuine. Fukuoka Prefectural Police in Japan warn that people who trust an AI answer and visit a fake site may have their personal information or money stolen. When you ask an AI where to shop or where to complete a procedure, do not continue from the link in the answer. Open the site again through a route you have checked yourself, such as the official app or a bookmark. Until you have confirmed the site is genuine, do not enter an ID, password or card details.

What is happening

On 19 October 2026, the Cybercrime Control Division of Fukuoka Prefectural Police posted a warning that cases have been confirmed of people being led to fake sites from generative AI answers.

In the example the police give, someone asked a generative AI for a site where popular sneakers could be bought cheaply. The URL of a fake shopping site appeared in the answer, the person ordered there, and the item never arrived. The police add that cases of people being led to phishing sites have also been confirmed.

According to the September 2026 monthly report of the Council of Anti-Phishing Japan, about 47.9% of the phishing reports it received impersonated e-commerce (online shopping) services. Shopping appears to be a common target already.

Why AI answers can include fake sites

Generative AI builds its answers from what it has learned and from information such as web pages. We will not go into the details of how this works here, but when an AI names a site in its answer, that does not necessarily mean it has checked that the site is legitimate. Pages that look like, or are named like, an official site may end up in the answer.

Prompt injection is about text an AI reads affecting how the AI behaves. This topic is different: it is about people taking an AI answer at face value. A useful split is to treat the AI answer as a starting point for research and to do the final check yourself.

Reaching the official site yourself

As countermeasures, Fukuoka Prefectural Police advise not taking generative AI answers at face value, checking against trustworthy information such as official apps and public bodies, and checking more than one source rather than relying on a single piece of information. In practice, use routes like these.

• Open the site from the official app of the shop or company you usually use
• Open it from a bookmark you saved after checking it yourself
• Search for the company name yourself and go to the site from the operating company's own pages
• Choose from the list of retailers that the product's manufacturer publishes

For example, suppose an AI says that "xx-shop.com is cheap". Do not tap that link. Instead, check whether the shop's name and address appear in the retailer information on the manufacturer's official site.

What to check before entering anything

Fukuoka Prefectural Police also advise checking the URL and the company's address and contact details using official sites, map apps and similar tools, and not entering an ID, password, credit card details or similar information until you can confirm whether the site is genuine.

As a general point, for an online shop in Japan, also check whether the legally required seller notice lists the business name, address and so on; some legitimate businesses disclose part of it only on request, so its absence alone does not prove a site is fake. As a general precaution, it also matters not to rush into buying just because the price is far below the usual price. The padlock (HTTPS) shows that the connection is encrypted; it does not prove that the site is genuine.

If the problem is not solved

If you have entered card details, contact your card company straight away. If you have entered an ID or password, change the password from the genuine site or official app, and also change it on any other services where you use the same password. If you paid but the item has not arrived, contact your local consumer affairs centre or the police cybercrime consultation service. If you entered information on a company device or with a company account, do not decide on your own; tell your IT staff right away.