When Your Voice Assistant Calls a Scammer: How AI, Search Engines, and Fake Customer-Service Numbers Can Put Your Financial Information at Risk
CAVEAT - This weekend, we helped an adult who was the victim of a “Voice Assistant Call” after using Siri to call a credit card company’s fraud department. Here at The White Hatter, we believe that voice assistants and artificial intelligence (AI) can provide meaningful benefits when used appropriately. Whether helping someone with a disability access information, allowing a driver to make a hands-free call, or helping families complete everyday tasks, these technologies can make life easier and more accessible. However, convenience should never be confused with security. As more people rely on voice assistants and AI powered search tools to locate businesses, retrieve telephone numbers, and initiate calls, we believe it is important to understand how these systems obtain information, what happens when that information is inaccurate or manipulated, and why independently verifying financial contact information remains an important digital literacy skill.
When Convenience Creates an Unexpected Financial Risk
Imagine you are sitting in your vehicle when you remember that you need to contact your credit card company about an unfamiliar transaction. Rather than pulling over, finding your credit card, and manually entering the telephone number printed on the back, you activate your phone’s voice assistant and say, “Hey Siri, call my credit card company.”
Within seconds, your phone begins making a call. You hear what sounds like a professional customer service greeting, followed by an automated menu asking you to select the reason for your call. Eventually, someone answers, identifies themselves as a representative of your financial institution, and offers to help resolve your concern. Everything appears legitimate. The voice assistant completed your request, the telephone number appeared to belong to the company you wanted, and the person answering sounded professional.
However, what if the telephone number your voice assistant found did not actually belong to your bank or credit card provider? What if the person answering was a fraudster operating a fake customer service centre designed to collect banking credentials, credit card information, passwords, or one-time authentication codes? Although this scenario may sound like something from a cybersecurity thriller, the underlying technique is not hypothetical.
In August 2019, the Better Business Bureau (BBB) issued a consumer warning about fraudulent customer-service telephone numbers being retrieved through voice assistants, including Siri, Alexa, and Google Assistant (1). The BBB described cases where consumers believed they were contacting legitimate businesses but were instead connected to individuals impersonating customer service representatives. In one reported incident, a consumer used Siri to locate an airline’s customer-service number and was connected to someone who falsely claimed to represent the airline and requested payment for assistance.
What makes this type of fraud particularly concerning is that the consumer initiated the telephone call. Unlike traditional telephone scams, where an unknown person contacts the potential victim, this approach exploits the trust people place in information retrieved by technology. The consumer believes they are calling a legitimate company because their trusted digital assistant located the number. However, the assistant may have retrieved information that was deliberately placed online by a criminal.
How Criminals Manipulate the Information Voice Assistants Retrieve
To understand how this happens, we first need to recognize that voice assistants do not necessarily maintain independently verified directories of every bank, credit card company, airline, retailer, or government agency. Depending on the device, application, and wording of the request, these systems may use saved contacts, installed applications, search engine results, business listings, or other information sources to determine which telephone number to call. For example, there is an important difference between telling your phone to “Call Mom,” when Mom’s verified telephone number is saved in your contacts, and asking it to “Call customer service for my bank,” when the assistant must determine which telephone number matches your request. In the second example, the assistant may need to locate information from an external source. This creates an opportunity for inaccurate or fraudulent information to influence the result.
The Canadian Centre for Cyber Security has explained that voice-activated digital assistants can process spoken requests, search the internet for suitable responses, and carry out requested actions. It also identifies several security considerations associated with these systems, particularly when they interact with external information or perform actions on behalf of users (2).
Cybercriminals have long understood that people frequently search online for customer service telephone numbers. Consequently, some fraud operations attempt to position fraudulent numbers where consumers are likely to find them. One method involves creating websites that closely resemble those belonging to legitimate financial institutions or businesses. These websites may use familiar logos, colours, company names, and professional-looking customer-service information. Another involves purchasing search engine advertisements that place fraudulent contact information above legitimate search results. A third involves manipulating how websites appear in search engines, a technique commonly associated with search engine optimization poisoning, or SEO poisoning.
In April 2025, the U.S. Federal Trade Commission (FTC) warned consumers that criminals were using paid search results to impersonate legitimate businesses and government services. The FTC specifically cautioned that telephone numbers appearing in search results should not automatically be considered trustworthy, even when displayed alongside the name of a familiar organization (3).
This becomes particularly relevant when a voice assistant selects a result without giving the user an opportunity to examine the underlying website. The important distinction is that the voice assistant itself does not need to be compromised, it may simply be retrieving information from a source that has been manipulated.
From Search Engine Poisoning to AI Answer Poisoning
What makes this issue even more relevant in 2026 is the growing integration of generative artificial intelligence into online search and digital assistants. Traditional search engines generally provide users with a list of websites or advertisements that they can examine before deciding which source to trust. AI powered search tools increasingly summarize information and provide direct answers. Although this can improve convenience, it also introduces a different challenge. Rather than evaluating multiple sources, the user may receive a single answer that appears authoritative.
In December 2025, cybersecurity researchers at Aurascape published findings describing a campaign in which attackers manipulated publicly accessible web content to influence the customer support telephone numbers recommended by AI powered search systems (4). According to the researchers, attackers placed fraudulent customer support information on compromised websites, including sites associated with government and educational institutions, to increase the apparent credibility of the information. The researchers reported that these techniques could cause AI powered search systems to recommend fraudulent telephone numbers as though they belonged to legitimate organizations. This is an important development because it demonstrates how criminals can attempt to influence not only which websites appear in search results, but also the answers generated by AI systems.
In cybersecurity, this broader technique is sometimes described as AI search poisoning or answer poisoning. The goal is to influence the information an AI system retrieves and presents to users. It is important to distinguish this technique from prompt injection. Prompt injection generally involves malicious instructions embedded in material an AI system encounters, whereas answer poisoning may involve manipulating the factual content available to the system without issuing instructions to the AI itself. Both techniques demonstrate why AI-generated answers should not automatically be treated as independently verified information.
For consumers, the practical concern is straightforward, if an AI system retrieves fraudulent contact information and presents it confidently, a user may mistakenly interpret that confidence as evidence of legitimacy. If the AI system can also initiate a telephone call, the opportunity for independent verification may become even smaller.
The Aurascape findings do not establish that every major voice assistant is vulnerable in the same way. However, they provide evidence that attackers are actively attempting to manipulate the information AI systems use to answer customer-support questions.
Why We Tend to Trust Information Provided by Our Devices
One of the more interesting aspects of this type of fraud involves human psychology rather than technology. When someone manually searches for a customer service telephone number, they may see several results, compare websites, examine addresses, or notice warning signs suggesting that a listing is suspicious. However, when someone asks a voice assistant to complete the same task, much of that evaluation process may disappear. Instead of examining several possible sources, the person may receive a single result or simply hear their phone begin making a call. The technology has effectively made the selection on their behalf. This can contribute to what researchers describe as automation bias, a tendency to place excessive confidence in recommendations or decisions produced by automated systems.
At The White Hatter, we have discussed similar concerns in our educational programs surrounding artificial intelligence. When technology provides an answer confidently and conveniently, users may be less inclined to question where the information originated or whether it has been independently verified.
The concern becomes more significant when the technology moves beyond providing information and begins taking actions on our behalf. There is an important difference between an AI assistant suggesting a telephone number and an AI assistant automatically calling that number. In the first situation, the user may have an opportunity to verify the information. In the second, the technology may have already acted before the user considers whether the information is trustworthy. This is why we believe verification should remain an important part of digital literacy education, particularly as AI assistants become increasingly capable of completing tasks independently.
When the Person Answering Sounds Like a Legitimate Bank Employee
Fraudulent customer service operations are often designed to appear credible. A person who unknowingly calls one of these numbers may hear recorded greetings, professional sounding automated menus, hold music, or messages that resemble those used by legitimate financial institutions.
The individual answering the telephone may already know the name of the bank or credit card company the caller believes they have contacted. The fraudster may then attempt to convince the caller that certain information is required to verify their identity or investigate a suspicious transaction. This could include requesting a full credit card number, online banking username, password, personal identification number, or one-time verification code sent by text message. In some cases, the caller may be instructed to visit a website, download an application, or install remote-access software under the pretence of resolving a security issue.
The FBI’s Internet Crime Complaint Center has warned about fraudulent technical support and impersonation schemes involving misleading search results, fake support numbers, and requests for remote access to victims’ devices (5). The FBI specifically advises consumers to exercise caution when using customer-support numbers obtained through general online searches, including sponsored results.
These scams often exploit the victim’s desire to resolve a problem quickly. For example, someone who believes their credit card has been compromised may be understandably anxious to speak with a representative. A fraudster can exploit that concern by claiming that immediate action is necessary to prevent further unauthorized transactions. The victim may then be instructed to provide authentication information or transfer money to a supposedly secure account. In reality, the fraudster may be attempting to gain access to the account or steal the victim’s money. The critical issue is that a professional sounding conversation does not establish that the person answering represents the organization the caller intended to contact.
Artificial Intelligence Is Making Voice-Based Fraud More Convincing
There is another development worth considering. Artificial intelligence is not only changing how consumers locate customer service information. It is also changing how criminals can impersonate legitimate organizations and individuals.
The Canadian Centre for Cyber Security identifies voice phishing, commonly known as vishing, as a form of social engineering that uses telephone communication to obtain sensitive information (6). Its guidance explains that criminals may use fraudulent telephone numbers, caller-ID spoofing, voice manipulation, and AI-generated voices to make fraudulent interactions appear legitimate.This means a criminal does not necessarily need to rely on a poorly delivered script or an obviously suspicious telephone conversation. AI tools can potentially help create more convincing scripts, realistic automated greetings, and synthetic voices that imitate human speech.
It is important to recognize that AI-generated voices are not inherently fraudulent, legitimate businesses also use automated and AI-assisted customer-service technologies. The concern is that criminals can exploit similar capabilities to make impersonation more convincing.
For someone who has already been directed to a fraudulent telephone number, a professional sounding automated system may reinforce the mistaken belief that they have reached the correct organization. This creates a combination of risks involving manipulated search information, misplaced trust in automated systems, and persuasive social engineering. The technology may help establish the initial connection, but the fraudster still relies on human trust to complete the deception.
Why This Is Also an Important Lesson for Youth and Teens
Some parents may wonder why we are discussing financial fraud involving banks and credit cards when our primary focus at The White Hatter is youth and teen digital literacy, internet safety, and online security. The answer is that young people are growing up in an environment where asking technology to perform tasks is becoming increasingly normal. Many youth and teens already use voice assistants to answer questions, locate businesses, send messages, obtain directions, and access information. As AI powered assistants become more capable, this reliance may expand.
A teenager might ask a voice assistant to contact a gaming company’s customer support department about a locked account, locate an airline’s customer service number, find technical support for a device, or call a retailer regarding an online purchase. Each of these situations can potentially expose the user to fraudulent customer service information if the assistant retrieves an inaccurate or manipulated result.
Young people may also be unfamiliar with how legitimate businesses verify customer identities. For example, a teenager contacting customer support about a compromised gaming account might believe it is normal for a representative to request their password or a one time verification code. A young person trying to resolve a problem with an online purchase might be persuaded to provide payment information to someone they believe represents the retailer.
Consider a hypothetical situation involving a 16-year-old who notices an unfamiliar charge associated with a gaming subscription. Wanting to resolve the problem quickly, they ask their phone’s voice assistant to call the company’s customer support department. The assistant locates a telephone number and initiates the call. A person answers and explains that the charge can be reversed, but first the teenager must confirm their account information. The representative asks for the email address associated with the account, followed by a password and a verification code sent to the teenager’s phone. Because the teenager initiated the call, they assume the person answering must be legitimate. However, the number was actually associated with a fraudulent support operation. The teenager has now provided information that could allow someone else to access their account.
The lesson here is not that the teenager made a foolish decision or that voice assistants should never be used. The lesson is that initiating a telephone call does not automatically establish that the person answering is who they claim to be. This is an important distinction for both young people and adults to understand.
The Canadian Connection: What Our Cybersecurity Agencies Are Warning About
Although some of the documented voice assistant incidents originated in the United States, the underlying fraud techniques are not limited by international borders. Canadian consumers use many of the same smartphones, voice assistants, search engines, and AI powered technologies. The Canadian Anti-Fraud Centre has also warned that fraudulent technical support information can appear in online search results for legitimate service providers.
In a March 2023 bulletin addressing service scams, the agency explained that fraudsters may place telephone numbers in search results to attract people looking for reputable technical support providers. Once contacted, criminals may request remote access to the victim’s computer, personal information, or payment for fraudulent services (7). This demonstrates that the underlying method of directing consumers toward fraudulent support numbers is recognized by Canadian authorities. It does not, however, establish how frequently Canadian consumers are being connected to fraudulent numbers specifically through voice assistants, and that distinction is important. We should not confuse evidence that a fraud technique exists with evidence about how commonly it occurs. At The White Hatter, we believe that responsible digital safety education requires us to make that distinction clear.
Practical Steps Families Can Take to Reduce the Risk
Fortunately, reducing the risk does not require abandoning voice assistants or artificial intelligence. Instead, it involves understanding when additional verification is appropriate.
1/ Use the telephone number printed on your bank or credit card.
When contacting a financial institution, one of the most reliable approaches is to use the customer-service telephone number printed on the back of your physical bank or credit card. This reduces reliance on search results or potentially misleading online listings.
2/ Save verified customer-service numbers in your contacts.
If you frequently contact a particular financial institution, consider saving its verified telephone number in your phone’s contact list. Once saved, you can use your voice assistant to call that specific contact rather than asking it to search for a telephone number.
3/ Use your financial institution’s official application.
Many Canadian banks and credit card providers offer secure mobile applications that include customer-support information or authenticated messaging options. Accessing support through an official application can reduce the likelihood of encountering a fraudulent third-party listing.
4/ Verify telephone numbers before calling.
If a voice assistant provides a telephone number, compare it with the number listed on the institution’s official website or another independently verified source. Be particularly cautious when the assistant automatically initiates a call without displaying the number first.
5/ Never disclose passwords, PINs, or one-time authentication codes to someone claiming to be customer support.
Although legitimate institutions may ask questions to verify identity, customers should not disclose their online banking passwords, card PINs, or authentication codes to someone on the telephone. If someone requests this information, end the conversation and contact the institution through a verified channel.
6/ Be cautious of requests to install software or transfer money.
Fraudsters sometimes claim that resolving a banking issue requires downloading remote-access software, transferring money to a supposedly secure account, or purchasing gift cards. These are significant warning signs of financial fraud.
7/ Teach children to verify before trusting.
Rather than simply telling youth and teens not to use voice assistants, explain how the technology works and why the information it provides may sometimes be inaccurate. Encourage them to ask where a telephone number came from and whether it can be independently confirmed.
These strategies are not complicated, but they reinforce an important digital literacy habit, “Verifying information before acting on it.”
What If You Have Already Called a Suspicious Number?
If someone believes they may have contacted a fraudulent customer service number, the appropriate response depends on what information was disclosed. If no personal or financial information was shared, ending the call and contacting the legitimate institution through a verified telephone number may be sufficient.
However, if banking credentials, credit card details, passwords, or authentication codes were disclosed, the situation should be treated more seriously. Contact the financial institution immediately using a verified telephone number and explain what happened. Ask whether accounts should be secured, credentials changed, cards replaced, or suspicious transactions investigated. If a password was disclosed, change it using the institution’s official website or application. If that password was reused elsewhere, those accounts should also be secured. If remote-access software was installed at the direction of a suspicious caller, disconnect the affected device from the internet and seek qualified technical assistance before using it for sensitive activities.
In Canada, suspected fraud can also be reported to the Canadian Anti-Fraud Centre. Victims should also consider reporting the incident to their local police service, particularly when financial losses or identity theft are involved.
Reporting suspected fraud can help identify patterns and potentially protect other people from experiencing similar incidents.
As voice assistants and AI powered technologies become more integrated into everyday life, we believe one of the most important digital literacy skills we can teach is knowing when to trust technology and when to independently verify what it tells us.
The Better Business Bureau’s warning in 2019 demonstrated that fraudulent customer service numbers could be retrieved through voice assistants. More recent cybersecurity research has shown that criminals are also attempting to manipulate the information presented by AI-powered search systems.
These developments are connected by a common vulnerability, people may place greater confidence in information when it is delivered through technology they already trust. Asking Siri, Alexa, Google, or another digital assistant to locate a business telephone number may seem like a simple, harmless task. In many situations, it works exactly as intended. However, when the request involves a bank, credit card provider, or another organization that handles sensitive personal information, the consequences of receiving an incorrect telephone number can be significant.
This does not mean families should abandon voice assistants or stop using artificial intelligence. It means we should recognize that convenience and verification serve different purposes. Technology can help us find information quickly, but speed should not replace judgment.
For parents and caregivers, this also creates a valuable opportunity to have a conversation with children and teens about how automated systems obtain information, why seemingly legitimate customer-service interactions can sometimes be fraudulent, and what steps they can take to protect themselves.
At The White Hatter, we have always believed that the most effective approach to online safety is not to frighten people away from technology, but to help them develop the knowledge and skills to use it more safely, securely, and confidently. Sometimes, that means taking a few extra seconds to verify a telephone number before making a call.
When it comes to protecting your financial information, the most important question may not be whether your voice assistant can make the call, but whether it is calling the right person.
Digital Food For Thought
The White Hatter
Facts Not Fear, Facts Not Emotions, Enlighten Not Frighten, Know Tech Not No Tech
References:
