AI assistants are becoming part of holiday shopping, but their recommendations can lead shoppers to fraudulent stores as well as legitimate retailers. Serena Sullivan, director of the Center for Cybersecurity at National University, says people should apply the same caution to AI-generated suggestions as they would to any other online service.
Sullivan’s advice comes as more shoppers consider using AI platforms to find gifts. Bain & Company reported that nearly a quarter of US online shoppers planned to start their holiday shopping on a platform such as ChatGPT or Gemini, up from 17% the previous year. Fake online stores are also appearing at a rate of one every three minutes, according to the article, and some have begun appearing in AI product recommendations.
Her first precaution is to disclose as little personal information as possible. A shopping prompt can reveal details about a gift recipient’s age, gender, interests or circumstances, while requests for expensive or budget-friendly gifts may suggest information about a shopper’s disposable income. Combined with publicly available information, such details could help attackers build profiles for phishing and other social engineering attempts.
Sullivan recommends avoiding identifiable details such as full names, addresses, phone numbers and birth dates when using an AI assistant. She also says not to enter sensitive information such as Social Security numbers, passport or driver’s license details, school schedules, extracurricular activities or anything that could reveal someone’s location. Her rule of thumb: if the information should remain within family and close friends, it should not be entered into the technology.
The second precaution is to treat an AI link as unverified. A recommendation does not mean the site has been checked for safety, and the link may be outdated. Shoppers should check for certificate warnings, confirm that the web address matches the expected retailer and be wary of prices that seem implausibly low. Rather than clicking an AI-provided link, they can search for the retailer independently.
A third step is to research the business before buying. Sullivan suggests checking customer reviews, the company’s customer-service options and its policies, as well as looking at its Better Business Bureau rating and complaint history. A polished-looking website or convincing reviews are not, by themselves, proof that a business is genuine. A missing or poorly written privacy policy can also be a warning sign.
Fourth, shoppers should examine the payment methods offered. Requests for money orders, wire transfers, gift cards or cryptocurrency are red flags, Sullivan says. Established businesses typically accept credit cards or services such as PayPal and Apple Pay.
Her fifth precaution is to consider privacy and security before buying connected technology, particularly as a gift for a child. Devices with microphones, cameras, location tracking or AI features may collect sensitive information. Interactive toys could record children’s voices and conversations, while smartwatches and fitness trackers may gather location, activity and contact data. Parents should check what a device collects, where information is stored, who can access it, whether features can be disabled and whether the manufacturer provides security updates and deletion options.
Sullivan also advises parents to use available controls to limit children’s interactions with other people online. For example, some video games allow users to communicate by voice or text, and parental controls can block those features. Parents should assess products for privacy, security, age suitability and a child’s maturity.
The article also notes that AI can make scams harder to spot by helping fraudsters produce convincing websites, messages and voices. Sullivan advises families to learn common scam tactics, shop through established retailers rather than unfamiliar links, and help less tech-savvy relatives use automatic updates and multifactor authentication. When a familiar voice makes an unusual or urgent request, she recommends verifying it through another channel before acting.
Sources: Tom's Guide.