Insights · Artificial Intelligence & Communication
A link recommended by artificial intelligence also needs to be verified. For a brand, this raises a practical question: how easy is it for customers to recognize where they should go for information, contact the company, or complete a transaction?
The Phishing attempts to deceive people into revealing sensitive information, such as passwords or account details. The U.S. Federal Trade Commission (FTC) explains that these scams often impersonate well-known organizations. When trust in a digital recommendation is combined with trust in a brand, both deserve careful scrutiny.
What Is Phantom Squatting and How Is It Related to AI?
Phantom squatting involves registering domains invented by a language model in order to take advantage of traffic that its recommendations might direct to them. A domain that appears to be associated with a brand may ultimately end up under the control of a third party. This is how Unit 42, Palo Alto Networks’ research team, describes the practice.
The issue gained attention in technology news through an Omicrono article published on August 31, 2026To understand its scope, it is important to examine the original research and distinguish the study’s findings from their potential implications.
What Did the Research Find, and What Are Its Limitations?
Unit 42 worked with 685,339 targeted queries, 913 brands, and two models identified as LLM1 and LLM2. It obtained approximately 2.1 million unique URLs, of which its systems classified 13,229 as malicious. The report also documents domains detected by researchers before they were subsequently registered and used maliciously.
These figures describe that specific experiment; they are not a universal measure of the risk of using AIMalicious URLs are not equivalent to victims, nor are they exclusively associated with phishing. The study cannot determine how many of a brand’s customers will reach a scam through an AI assistant. Source: Unit 42 methodology and findings.
Why Does This Matter for Brand Communication?
From a strategic communication perspective, I suggest looking at this problem as a test of clarity. If someone is unsure where to ask for help, confirm a promotion, or inquire about a service, the brand needs to provide an easy-to-find and recognizable point of reference.
Consider a hypothetical scenario: a customer wants to contact a company after watching one of its videos. They visit its social media profiles, find several older campaigns, and cannot determine which customer service channel is currently active. The role of communication is to resolve that uncertainty before asking the customer to move forward.
This requires consistency across the website, audiovisual content, social media profiles, and responses from the sales team. Every touchpoint should help users answer three questions: who is speaking to me, where are they directing me, and what action are they asking me to take?
How to Verify a Link Before Sharing Information
If an address raises doubts, access the service through the official app you already use or through an address you know belongs to the company. The FTC recommends contacting the organization through a known phone number or website obtained independently of the suspicious message. Keep your devices up to date and enable multi-factor authentication when available. See the FTC’s recommendations for avoiding phishing.
HTTPS does not prove that a website belongs to the brand it claims to represent. It protects the connection, but a fraudulent website can use it as well. The Chromium team explains this distinction in its analysis of the lock iconA professional design or an address containing a company’s name is also no substitute for verifying its identity.
For sensitive transactions, my editorial recommendation is simple: don’t let urgency make the decision for you. If you cannot verify the destination, stop the process and find the official channel through an independent source.
Five Communication Actions to Better Guide Your Customers
The following recommendations translate the issue into content and user-experience decisions. Their purpose is to make verification easier; technical protection should be coordinated with the team responsible for security.
1. Bring Your Official Channels Together on One Clear Page
Publish your current contact channels and explain what each one is used for. Include links to external platforms your business actually uses. Assign someone responsibility for keeping this information up to date and reviewing it whenever a provider, campaign, or customer service process changes.
2. Explain the Process Before Asking Users to Take Action
Explain how to request a quote, where to receive support, and what happens after submitting a form. If an external provider is involved, identify it before redirecting the user. This information should reflect the company’s actual operations and be validated by the people responsible for customer service.
3. Use Video to Demonstrate a Specific Task
A short video can show users where to find the official contact information or how to check a request through the brand’s website. The script should focus on a single task, include subtitles, and be accompanied by an accessible written version. Avoid displaying real personal information, and update the content if the interface changes.
In a Video Marketing strategy, this is an opportunity to create service-oriented content: a useful explanation that supports the customer after the initial commercial interaction.
4. Review Links in AI-Assisted Content
I recommend adding an editorial verification step before publishing articles, scripts, emails, or responses prepared with AI. The person responsible should confirm that every link leads to the intended resource, belongs to the cited entity, and supports the claim being made. The same standard should also be applied to content written without automated assistance.
5. Prepare a Response for Potential Impersonation
Establish who receives reports, who verifies what happened, and who authorizes public communication. A useful notice should state what has been confirmed, where people can get help, and when the information will be updated. Avoid claiming that everything has been resolved or that no one has been affected without sufficient evidence.
What Should You Do If You Have Already Shared Information on a Suspicious Website?
If you shared a password, access the service from a trusted device and through its official channel to change it. Also change any reused passwords, review devices and account activity, and follow the provider’s recovery process. Google’s guide to securing a compromised account details these steps for Google accounts. In a workplace environment, notify the person responsible for IT or security.
If you suspect that malicious software was downloaded, update your security software and run a scan, as recommended by the FTC. Simply opening a link does not prove that your credentials were stolen: the response should take into account what information you shared and what actions were performed.
Frequently Asked Questions About AI Phishing
Is an Address Invented by AI Always a Scam?
No. It may simply be an error with no attacker behind it. The risk increases if the destination is under malicious control.
Can a Website With HTTPS Be Fraudulent?
Yes. Connection encryption does not verify the commercial identity of the website. Chromium explains why HTTPS should not be confused with trust.
What Should a Company Communicate First?
My recommendation is to start with its official channels and its actual customer service process. This information provides a concrete answer when someone asks where they should go for help.
Make Your Communication Help People Verify
A useful review can start today: open your website as if you were a new customer and check whether you can find the right contact information, understand the next step, and recognize who you will be sharing your data with. If any of those answers are unclear, you have identified a content priority.
If you want to turn these questions into a communication, content, and video strategy for your business, learn more about my work and contact me at marcochile.com.