‘Poisoned’ AI: the ChatGPT shopping scams that lead to fake websites

Fraudsters are manipulating ChatGPT to direct shoppers to convincing fake websites for Russell & Bromley and Dunelm, resulting in financial losses and harvested bank details, according to a scam-checking service. Ask Silver, a scam-checking service, reports that cloned retail sites have been appearing in ChatGPT search results [1]. The fraudulent sites mimic the former shoe retailer Russell & Bromley and the home furnishings chain Dunelm, tricking users into handing over payment information for goods that never arrive [1]. Anna Jones of Ask Silver said the large language model powering ChatGPT may have been “poisoned” by malicious content inserted into its training data, such as cloned webpages [1]. “In this instance it looks like scammers are taking advantage of the fact that Russell & Bromley went into administration in January 2026 and was absorbed by Next – so there is no longer an official Russell & Bromley website, but potential customers will likely still be searching for it,” Jones said [1]. The legitimate Russell & Bromley store now operates solely within the Next website [1]. When Ask Silver queried ChatGPT about popular Russell & Bromley bags, the results included two fraudulent sites offering discounts of up to 80% [1]. The fake domains used names such as therussellbromleyofficial, russellandbromleylondon, and russellbromleyonlineuk [1]. Louise Baxter, head of the scams team at National Trading Standards, warned that consumers should not assume a website is genuine simply because an AI tool recommends it [1]. “Consumers are increasingly turning to AI tools for advice and recommendations, but criminals are adapting just as quickly,” Baxter said [1]. National Trading Standards advises shoppers to verify web addresses directly, noting that legitimate UK retailers typically use .co.uk or .com domains, while extra words such as “official” or “deals” in a URL are warning signs [1]. Fraudulent sites often only accept payment by bank transfer, which is an immediate red flag [1]. A Dunelm spokesperson urged customers to use only its official website or app and said the company works to have fraudulent sites removed as soon as they are detected [1]. Next, which absorbed Russell & Bromley in January 2026, said it was aware of the situation and had been working to close the fake sites [1]. A spokesperson for ChatGPT confirmed the fraudulent websites had been removed from its search index and noted that users can report policy-violating sites through an official form [1].