The Fake Answer Key AI Memorized: A Support Number That Reached a Scammer

The night before an exam, there is always that one friend. The one who has gathered up a huge stack of old exam papers passed down from upperclassmen.

That friend’s study method is simple. If ten of those papers have the same answer written on them, that becomes the answer to memorize. If the paper was posted on the bulletin board outside the teachers’ office, it is trusted even more. It was a piece of paper sitting near a teacher, after all.

We ask that friend, “What’s the answer to number 3?” The friend answers confidently. We never look at the papers ourselves. We just write down the answer.

But what if someone spent all night copying tens of thousands of fake exam papers with wrong answers and slipping them in everywhere? The friend is still kind and still confident. Only the answers are wrong.

The technique a security researcher disclosed last week looks exactly like this. In the seat of the friend who collects old papers and answers questions sits an AI chatbot. The wrong answer is a customer support phone number.

Where this plays out

Say your flight schedule changed. Your booking is tangled up and you need to call the airline.

These days, instead of searching for the number, we tend to ask ChatGPT or Gemini. Search on Google and an AI Overview may appear at the very top of the results first. AI Overviews is a feature where Google reads several web pages and presents an answer condensed into a single paragraph. And there it is — the “○○ Airlines customer support” number in bold.

You call that number. An agent picks up. They say they need to verify your booking, so please read out your card number and expiration date.

You did not click a link in a text message. You did not install a suspicious app. You placed the call yourself. That is why there is little room for suspicion to set in.

FACT Among the organizations the researcher listed as having their names impersonated are airlines such as Delta, Lufthansa, United, Emirates, and Qatar Airways. There are also banks such as Bank of America, Wells Fargo, Chase, and Citi. Travel platforms such as Airbnb and Tripadvisor are included too. These are names that Koreans also use heavily when traveling abroad.

FACT Phone numbers are not the only target. Fake email addresses and fake login pages were spread the same way.

INFERRED So anyone who asks an AI for a contact number over a flight change or refund, a card problem, or a lodging booking issue could end up in this scene. It is also right after the Chuseok holiday, a time when travel inquiries run high.

The moment you might sense something is off

The signals come from two places.

One, the number is different. The number the AI gave you does not match the one in the company’s official app, on its official website, or on the back of your card.

Two, the agent asks first. The moment they pick up, they ask you to read out your full card number. They ask for the verification code that arrived by text. They tell you to pay a fee separately.

Put in terms of the exam-paper analogy: it is the moment the answer your friend gave differs from the answer in the textbook.

Why does the AI get fooled?

Let’s go back to the friend with the old exam papers. To make that friend memorize a wrong answer, you need three things. There have to be many fake papers, they have to be posted somewhere trustworthy, and they have to pass the teacher’s inspection. This technique has all three.

FACT They spread them widely. The attackers posted huge volumes of posts, PDF documents, reviews, and fake customer support pages containing fake contact details on the internet. The malicious pages the researcher found alone number in the tens of thousands.

INFERRED When an AI sees the same number in many places, it is easy for it to judge that the information is correct. Same as the friend who believes an answer when ten papers agree. The brief reads the scale of tens of thousands this way as well.

FACT They posted them somewhere trustworthy. The fake posts went up on social media such as Instagram, Tumblr, and YouTube. They also went up on blogging and website services such as Medium, WordPress, Google Sites, and GitHub Pages. They were on review and map services such as Yelp and Apple Maps. They even used educational and government agency sites that allow file uploads. The researcher explains that they targeted the fact that an AI trusts something more when it is hosted somewhere trustworthy. It amounts to posting the exam papers on the bulletin board outside the teachers’ office.

FACT They evaded inspection. They inserted spaces inside the fake numbers. They slipped in emoji (pictographs), or mixed in special characters that look like digits to the eye but read as different characters to a computer. Do this, and a spam filter — the mechanism that automatically screens out suspicious posts — cannot recognize it as a phone number. Yet the AI still reads it out as a phone number. It is an exam paper scrawled so the teacher cannot make it out, but written so your friend can read it.

FACT In the industry, tuning writing so your own information appears prominently in AI answers is called generative engine optimization (GEO). It is originally a marketing technique used by companies. This technique turns that around and uses it for fraud.

FACT There are three AIs in which the researcher confirmed contamination: ChatGPT, Google Gemini, and Google Search’s AI Overviews.

FACT And there is one decisive point. GIGAZINE reported that because users only see the AI’s answer, they never have occasion to see the original malicious page the information came from. It is the same as us never looking at the exam papers ourselves and just writing down our friend’s answer. There is no opportunity whatsoever to lay eyes on the fake paper.

The scale in numbers

FACT The 374 companies and the tens of thousands are figures from the researcher’s own post. It means this is how much a single researcher found on their own. It is not a count of the total scale.

FACT The 91% comes from a survey Exploding Topics conducted in August 2026. GIGAZINE cited this survey in its reporting. It is not the number of victims of this incident. It is a figure showing the habits of people who use AI.

FACT Dark Reading reported that there were a few complaints from people who contacted a fake number given by an AI and handed over payment or card information. How many, and how much was lost, is not stated.

FACT The researcher notified Google and OpenAI of the problem. Google replied that it was not eligible for its vulnerability reward program. A vulnerability reward program is a scheme where a company pays a reward to someone who finds and reports a security problem. OpenAI closed the report, saying it could not be reproduced.

INFERRED So rather than waiting for the AI companies to fix it on their own, it is faster to verify it yourself. This is a situation where someone reported that the exam papers were wrong and got back “not our responsibility.”

What to do now

Open the textbook instead of the exam papers. This time, the textbook is the number the company gave you directly.

1. Do not take a customer support number from an AI answer or a search summary. Find it in the company’s official app. Or check the official website you reached by typing the address into the address bar yourself, or the back of your card.
2. If you already called a number an AI gave you and read out your card information, call your card issuer right away. Freeze the card and request a reissue. Here too, find the card issuer’s number on the back of the card.

Asking an AI is not itself the problem. It is just that for contact details and login addresses, check against the textbook rather than your friend’s answer.

What We Don’t Know

There are still many blanks in this case. We have gathered them separately so as not to write as though we know.

• Whether Korean companies are among the 374 has not been disclosed. There is no basis for saying that the numbers of domestic airlines, banks, or card issuers were contaminated as well.
• Whether asking in Korean yields the same fake numbers has not been confirmed.
• The actual number of victims and the amount lost have not been stated. What was reported is only “a few complaints.” The researcher’s post also describes cases leading to financial loss, but without counts or amounts.
• Who is behind the attack, and whether it is one organization or several, has not been established. We do not infer nationality or affiliation.
• Whether, at this very moment, each AI still answers with fake numbers is unknown. Whether OpenAI and Google took action afterward is also unknown.
• The articles introduce the researcher as “VP of Research at Vigilance Security.” We could not confirm this affiliation or title through the company’s own public materials. The researcher’s own post says only “security researcher and founder.”
• The researcher’s Medium post was blocked when opened directly, so we confirmed the text via the author’s RSS feed (a subscription address that collects and sends new posts).
• We could not open the body of the Dark Reading article. We saw the passage on victim complaints only through a search summary.

This post was compiled from the researcher’s own writing and press reports. Whether Korean companies are included, whether it reproduces when asked in Korean, the actual scale of damage, and who is behind the attack have not been confirmed.

Sources

• Ariel Simon (Medium, researcher’s own post · primary source), “Dark Sourcery: How Hackers Manipulate AI to Scam You”, 2026-09-22 — https://medium.com/@arielsimon/dark-sourcery-how-hackers-manipulate-ai-to-scam-you-88df434d2073
• The Hacker News, “ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories”, 2026-09-24 — https://thehackernews.com/2026/09/threatsday-ai-search-poisoning-ai.html
• GIGAZINE, “‘Dark Sourcery’ is a cyberattack that uses AI such as ChatGPT to generate fake contact information for companies, leading users into fraud.”, 2026-09-25 — https://gigazine.net/gsc_news/en/20260925-dark-sourcery-hackers-manipulate-ai-scam/
• Dark Reading, “Attackers Manipulate AI Chatbots in Mass Disinformation, Phishing Campaign” — https://www.darkreading.com/threat-intelligence/attackers-manipulate-ai-chatbots-mass-disinformation-phishing-campaign

Compiled as of 2026-09-29. Because this post relays published research and reporting rather than our own honeypot observations, it carries no IPs, credentials, or attack commands. We also do not write out the fake numbers or malicious page addresses, so that they cannot be copied. FACT badges are attached to content confirmed in the primary source or reported by the press. Content that was only reported is marked separately in the text with “reported.” INFERRED badges are interpretation we have added.