Can you trust a website recommended by ChatGPT or another AI?

An AI assistant can help you find products and sellers. That does not mean it has independently verified the business behind every link. The same caution applies to AI-generated search summaries, conversational shopping tools, sponsored search results and recommendations shared in social chats. No particular AI provider is uniquely immune or uniquely responsible.

What was actually reported about AI-recommended stores?

On June 9, 2026, UK National Trading Standards reported findings shared by the Ask Silver scam-checking service: copycat retail websites imitating established businesses had appeared in AI-generated recommendations. The warning included lookalike web addresses and reports of payment taken without promised goods arriving.

Important evidence limit: the observed recommendations do not, by themselves, establish which technical cause produced each result. The public statement discusses model poisoning, but it does not demonstrate that every problematic recommendation came from altered training data. Treat the broader risk—an unreliable or manipulated recommendation—as established by the report, while keeping claims about individual mechanisms separate.

How a poor recommendation can happen

Different processes can lead to a bad link:

• Misleading web content: a cloned retailer advertises a familiar brand or presents fabricated business details online.
• Search or ad manipulation: attackers place lookalike sites in results, advertisements, directories or pages an assistant may encounter.
• Unreliable summarization or retrieval: an assistant misattributes a seller, presents a citation that supports a different claim, or repeats unverified source information.
• Prompt injection or manipulated source text: a document or retrieved page includes instructions designed to influence a model's output. Whether a specific system obeys these instructions depends on the system and safeguards.
• Training-data poisoning: attackers try to alter information incorporated during model training. This is a distinct and more specific technical claim that needs evidence for the particular case.

An AI response alone cannot distinguish these causes. Likewise, a link citation, familiar merchant logo or confident prose does not establish who owns the domain or whether an offer will be fulfilled.

The five-minute independent verification workflow

Use this process before entering payment details or creating an account. A few minutes cannot prove a seller will perform, but they can reveal unresolved claims.

Minute 1 — Copy and read the exact hostname

Do not use the branded link text as your evidence. Read the hostname, checking spelling, extra words, domain endings and redirects. If the answer claims the site belongs to an established brand, compare it with that brand's authentic site found through an independently known address, its verified store locator or official customer-support channel.

Minute 2 — Check the technical context

Enter the public URL into the ScamMark website checker. It can show registration, DNS, redirects and page-identity information where available. It does not certify the operator or perform a guarantee of reputation. An old domain and HTTPS are not endorsements; a missing result does not mean a problem was found.

Minute 3 — Independently confirm the business

Find the business's legal name and contact details, then verify them through a registry or independently established channel appropriate to its jurisdiction. Confirm that the business itself connects to this specific web address. A registry record may exist even when a copycat site falsely claims to belong to that business.

Minute 4 — Cross-check the transaction

Compare the product, price and retailer with other established sources. Read the actual shipping and returns terms, and check independent complaints and review histories. Do not treat an AI-provided source list as sufficient: open the primary references yourself and verify that they say what the assistant claimed.

Minute 5 — Decide whether to pay

Check the exact merchant and recipient shown in the payment flow. Prefer a payment method with meaningful dispute rights, and avoid demands to move money to unrelated individuals or outside a marketplace's protected checkout. If identity, delivery, refund terms or payment destination remain uncertain, do not rush the purchase.

For a guided record of those checks, use the interactive pre-purchase checklist. Your selections reflect your own investigation and are not transmitted as a reputation score.

What if the AI cited an official-looking source?

Inspect what the source actually says. A retailer's home page may prove that someone published a page, not that an AI-proposed third-party discount store is authorized. An official brand page, regulator or merchant's own verified store list is stronger evidence for specific factual claims than a copied logo or a shopping article with an affiliate link.

Avoid visiting obviously suspicious links just to inspect them. If you must compare addresses, use the displayed URL string and the ScamMark checker rather than following a questionable link into a login or checkout flow.

If the purchase already happened

Preserve the original AI recommendation and its date, the exact URL, receipts, payment transaction, delivery promise and relevant messages. Contact your financial provider promptly for the dispute options applicable to your country and payment method. If account credentials were entered, change them through the independently verified real site. See what to do after sending money and how to preserve evidence.

The takeaway

AI suggestions are discoveries, not due diligence. The useful question is not “Did an AI recommend it?” but “Can I independently connect this exact domain, business, offer and payment path to evidence I trust?” The online-store verification guide provides the fuller pre-purchase method.