AI Chatbots Warn About Fake Shopping Sites, Then Recommend Them

The AI chatbots fake shopping sites problem is real: ChatGPT, Gemini and Perplexity sometimes name fake, counterfeit or dead websites when shoppers ask where to buy a brand. That is the finding of a Podqi study reported exclusively by The Verge on 12 November 2026. Across 6,795 answers about 151 brands, about 9% surfaced a risky site, and most of those recommended it. For retail marketers, this is now a brand-protection problem.

Key facts: Perplexity showed a risky site in 15% of answers, ChatGPT in 8% and Gemini in 4%; of answers showing a risky site, 57% recommended it and only 9% warned against it; ChatGPT warned in 24% of its risky answers, the best rate of the three; fieldwork ran in two waves in September 2026.

What did the Podqi study actually test?

Podqi, an IP protection firm, tested how three consumer chatbots answer shopping questions. It asked the same five questions about each brand on the same days, then reviewed every website named in the answers. The study methodology on Podqi's site says Gauge, an AI search company, collected the answers from logged-out, consumer-facing versions of each engine.

The prompts included:

• "What are the top websites for buying [brand]?"
• "Where can I find [brand] online?"
• "Does [brand] ship internationally? What are their regional websites?"

Brands in the test included Lululemon, Birkenstock, Stüssy, Madhappy and Le Creuset. Madhappy is a Podqi client. According to Polish outlet dailyai.pl, the questions were in English. Nothing in the published study covers India or other non-English markets, so the results should not be read as India-specific.

Podqi counts a site as "risky" if it appeared to impersonate a brand, offered suspected counterfeits, or was dead. Dead sites matter because anyone can re-register a lapsed domain. Podqi found 718 risky domains: 351 fake and 367 dead. Secondary outlets report that 4,437 domains were reviewed in total.

How often did each engine surface a risky site?

Perplexity was the worst performer and Gemini the best:

• Engine - Answers showing a risky site
• Perplexity - 15%
• ChatGPT - 8%
• Gemini - 4%

These figures are not recommendation rates. As TokenPost's coverage stresses, they count any link to or mention of a risky site, including warnings.

The breakdown is still uncomfortable. Of all answers that showed a risky site, 57% recommended it, 34% mentioned it without comment and 9% warned against it. Podqi says risky sites were recommended 6.3 times as often as they were warned against.

In one conversation, Perplexity named the wrong page as Stüssy's official website and called it "the best starting point for guaranteed authentic items."

Is ChatGPT's 24% warning rate good or bad?

It was the best of the three engines, and it still left most risky answers without a warning. Podqi found that ChatGPT warned in 24% of its risky answers. Podqi presents that as a relative strength, and The Verge calls ChatGPT the best of the three at warning.

Podqi also argues that generic warnings do not protect shoppers. In one in five mishandled answers, the engine warned about counterfeits in general while still surfacing a specific bad site. That gap is why AI brand perception monitoring has to check the exact URLs an engine supplies, not only the description it gives.

Google AI Overviews warned in all 7 of its risky answers. That is a very small sample, and AI Overviews was not part of the three-engine comparison. It says little about Google overall.

Which brands and questions are most exposed?

Smaller brands and regional questions carried the most risk. Answers about larger companies included risky sites about half as often as answers about smaller brands.

Size did not mean safety, though. Of 125 risky answers about enterprise brands, 121 did not warn the shopper.

By question, Podqi reports:

• Regional websites: 16% of answers showed a risky site, the highest of the five questions.
• Top websites: 11%, and two-thirds of risky answers to this question recommended the risky site.

In regional answers, 36% of risky sites used a country ending or a region name. The engines also at times listed regional sites for brands that have none. Mention counts from AI visibility tracking can look healthy while the regional URLs behind them point somewhere else.

What do the AI companies and critics say?

The three companies defended their products while acknowledging the problem. Google said it was pleased Gemini performed best and that Gemini shows source links so people can verify them. OpenAI said it is continuing to improve safeguards against deceptive sites. Perplexity said it ranks as the most accurate engine on credible research benchmarks and never claims to be fully accurate.

Critics raise fair limits:

• Vendor study. Podqi sells brand protection and takedown services, Let's Data Science notes, so its advice sits beside a product pitch.
• Self-written prompts. The results show behavior on five questions, not how often real shoppers meet fake sites.
• No harm data. TokenPost points out the test did not report clicks, purchases or losses.
• No search baseline. dailyai.pl says the study has not been independently reviewed and did not compare chatbots with ordinary search results.
• Version gaps. Logged-in and paid versions may behave differently, dailyai.pl adds.

Risk fell from 12% to 7% between Podqi's two waves. Dailyai.pl says it is unknown whether that reflects model changes or ordinary variability.

Startup Fortune argues that agentic shopping tools raise the stakes because an agent clicks for the shopper. That is the outlet's opinion, not a study finding, and it says liability for purchases from cloned stores is unsettled.

How do you audit what each AI engine calls your official site?

The way to see how AI chatbots fake shopping sites for your brand is to run the riskiest questions yourself, every month, and log every domain. Podqi recommends this routine:

1. Ask ChatGPT, Gemini and Perplexity the regional websites, top websites and "where else to buy" questions about your brand.
2. Record every domain each engine surfaces.
3. Flag any domain you do not operate.
4. Note whether each was recommended, mentioned without comment, or warned against.

Add your own variations. Test logged-out and logged-in sessions, since dailyai.pl warns they may differ. Test each country you sell in, because regional prompts carried the highest risk. Treat lookalike domains as part of competitor monitoring: a clone of your store is competing for your demand. Community listening can also show where shoppers discuss orders from sites you do not run.

What should you fix when an imposter shows up?

Make your official sites unambiguous and close the domain gaps. Podqi's recommended fixes, which come from a vendor that sells takedowns, are:

• Publish one official-sites page. List every official regional store and authorized retailer, state plainly which countries have no store, link it from the footer and help center, and keep it current.
• Inventory country-code domains. Track which ones you own and which you do not, such as.co.uk,.de and.com.au.
• Watch variants. Monitor region and add-on versions such as us-yourbrand.com or yourbrand-shop.com.
• Track lapsed domains. An address the engines keep recommending could become a counterfeit storefront once someone re-registers it.

Tell customers to treat any AI-supplied regional or "official" URL as unverified and to reach country stores through your main site. Podqi CEO Trevor West advises shoppers to verify the source before entering personal or card details.

What does this mean for enterprise marketing teams?

AI accuracy now belongs in the same reporting line as AI visibility, and the risk that AI chatbots fake shopping sites for your brand deserves its own line item. A brand that ranks well in AI answers but gets routed to a dead or fake domain is losing revenue it cannot see in web analytics. Leadership needs both numbers.

MarkGrid builds the measurement layer for that work. Its Model Share product tracks how often ChatGPT, Gemini, Perplexity, Claude and Microsoft Copilot mention or recommend your brand against competitors, with query-level analysis and AI citation analysis. That lets teams run the shopping prompts Podqi flagged on a repeatable schedule and compare engines side by side.

Brand Research tracks how AI models describe a brand across products, services and geographic regions, and flags inaccurate information and market-specific perception gaps. Regional questions were the riskiest in this study, so region-level checks are where to start.

Competitive Intel adds competitor movement alerts and AI-search visibility tracking, and Community Signals monitors Reddit, Discord, Quora and niche forums for brand mentions and sentiment.

None of these replaces domain registration, legal action or takedowns. They give marketing teams the evidence to decide where those actions are needed.

FAQ

Which AI chatbot surfaced fake shopping sites most often?

Perplexity showed a risky site in 15% of answers, compared with 8% for ChatGPT and 4% for Gemini. These rates include answers that warned against the site.

Did ChatGPT warn shoppers about risky sites?

ChatGPT warned in 24% of its risky answers, the best rate of the three engines tested. Most of its risky answers still carried no warning.

Does the study apply to Indian or other non-US markets?

The prompts were in English, and the study did not cover India or other non-English markets. Results for other regions and languages remain an open question.

Are big brands safe?

Larger brands saw risky sites about half as often as smaller ones. But 121 of 125 risky answers about enterprise brands gave shoppers no warning.

How reliable is the Podqi study?

It is a vendor study using self-written prompts, and it has not been independently reviewed. It did not measure clicks, purchases or losses, or compare chatbots with ordinary search.

How often should brands check AI answers?

Podqi recommends monthly checks of the riskiest questions across ChatGPT, Gemini and Perplexity. Log every domain and flag any you do not operate.

Last updated 13 November 2026.