Yes, it can, and it is not hypothetical. Google’s AI Overviews, the AI-written answers that sit above the regular search results, have repeatedly shown scammers’ phone numbers as if they were official customer service lines. Wired documented cases where people searched for a company’s support number, dialed what the Overview displayed, and reached a fraudster running a fake call center (wired.com). One traveler handed over card details for an airport shuttle that existed only in a planted web listing.
So the headline question has a short answer. The more useful question is how the Google AI Overviews scam actually works, because once you see the mechanics, the defense turns out to be cheap, unglamorous, and entirely within reach of a business with no IT department.
How the AI Overviews scam works
Scammers seed the open web. They plant a real business’s name next to their own phone number on low-visibility directories, forum posts, and thin listing sites that nobody maintains. Google’s AI reads that material along with everything else, synthesizes an answer, and presents it in the answer box at the top of the page.
On a classic results page, the sketchy directory at least looked sketchy: an odd domain, a broken layout, a 2014 design. Inside an AI Overview those warning signs are gone. The planted number inherits Google’s own typography and authority, and it sits above every legitimate result, including yours.
Reader behavior completes the trap. Pew Research data covered by Ars Technica found that people click through to the underlying sources roughly half as often when an AI summary is present (arstechnica.com). Fewer clicks means fewer chances for anyone to notice that the number never appears on the company’s actual website.
Why a small business gets hit twice
The first hit is direct: your customer loses money believing they were paying you. You inherit the refund dispute, the one-star review, and a person who now tells their friends your business scammed them. The fraudster keeps the money; you keep the reputational bill.
The second hit is quieter. The independent web pages that used to correct bad information about your business are disappearing. TechCrunch has reported sharp declines in referral traffic to publishers since Overviews rolled out (techcrunch.com), and Chegg has taken Google to court over the revenue damage (theverge.com). A thinner web means the few pages that mention your business, including the planted ones, each carry more weight in whatever the AI assembles.
Large brands absorb this with legal teams and same-day takedowns. A ten-person plumbing company or a two-person travel agency has contact details scattered across a decade of old directories, and nobody assigned to watch them. That asymmetry, not the AI itself, is the real exposure.
What actually protects your customers
The defense costs about an hour a month, and none of it requires new software.
Pick one page on your site as the single official home of your phone number, hours, and payment policies, and submit it through Google Search Console so Google indexes it as the authoritative source. Then make a habit of searching your own business name plus “phone number” or “customer service” and comparing what the AI Overview shows against that page. When something is wrong, report it through the feedback link at the bottom of the Overview itself, correct any wrong details on your Google Business Profile, and keep your own simple log, a spreadsheet with the date, the query, and a screenshot, so you have evidence if a payment dispute or a follow-up report ever needs it.
The last piece is making your real channel unmistakable. Say it plainly on your website, your invoices, and your voicemail greeting: payments only happen through the phone number and payment page on your official site. You cannot stop a customer from dialing a planted number they found in a search result, but you can make sure anyone who double-checks finds one consistent answer everywhere you speak. And when a customer mentions a call or a payment you have no record of, ask where they found the number. That conversation is usually the moment an impersonation gets caught, and the report you file that day is what gets the fake listing taken down.
A single misdirected payment can cost you the disputed charge, the hours of cleanup, and a customer’s trust. An hour a month is the cheaper side of that trade by a wide margin.
Our take: claim your facts before someone else supplies them
We cover AI for small businesses every week and remain genuinely optimistic about these tools, including AI search. This story does not change that. AI Overviews reward businesses that publish clear, consistent, machine-readable facts about themselves, the same way Google Business Profile did a decade ago. The same logic runs through this year’s lighter-than-feared AI rules: the regulation is not coming to save you or to stop you, so the businesses that document their own ground truth win by default. And the broader security picture is improving on its own, with AI now patching the software supply chain faster than attackers can mine it. The owners who treat their contact information as an asset will be quoted correctly by the machines. The ones who never look will be quotable by anyone.
When did you last search your own business the way a customer would? If you have not looked at what Google’s AI says about you this month, it is worth five minutes today. And if you have caught a wrong number or a planted listing wearing your name, tell us what happened in the comments; we want to know how this is playing out on the ground.
Frequently Asked Questions
How can my small business check whether Google’s AI is showing the wrong phone number for us?
Run a weekly search for your business name plus common queries like phone number or hours, and compare the AI Overview against your actual contact page. Report anything wrong through the feedback link on the Overview itself, and correct wrong details on your Google Business Profile.
Should customers be told not to trust AI summaries at all?
Advise customers to use your official contact page for payments and sensitive actions, and post a short notice explaining how to verify legitimate support channels. That sets clear expectations without demanding blanket distrust of search.
Will publishing a verified contact page stop scammers from impersonating us?
It reduces the risk but does not eliminate it, since scammers can still seed fake listings on unrelated sites. Combine a canonical page with regular monitoring and a fast reporting habit when a mismatch shows up.
What should a small team check this week?
Confirm your business is verified in Google Search Console, run your first self-search for your business name plus phone number, and add one clear line to your website and invoices stating that payments only happen through the contact details on your official page.
