The DeMicco Digest
For each post, I use Google NotebookLM to create a podcast-style conversation between two AI hosts. I don’t script or edit their discussion, so it’s their interpretation of the article and a glimpse into what AI can do. The written post reflects my own views. How I use AI on this site
Our own analysis tools (Amplify Analyze) picked up something odd in the phone number patterns. We built those tools internally because we care about lead generation we can quantify, and we’ve been enhancing them with AI. Three of the four numbers shared an area code, and the prefixes were very similar, which the states entered on the forms made close to impossible. When we looked at the websites, the web addresses didn’t line up with the company names the senders referenced. We concluded these were not genuine leads.
Why would anyone bother?
To be honest, I don’t know yet what these four were after.
There is a scheme the FBI calls purchase order fraud. Someone poses as a real company or university, asks a vendor for a quote, and places an order on 30-day credit. The goods ship to an address that has nothing to do with the real organization, and the vendor finds out when it bills the real one. The FBI identified it in 2014, including the look-alike web addresses [1]. In August 2024, the Commerce Department’s inspector general warned vendors about fake RFQs sent in the name of government agencies [2], and the GSA’s inspector general lists industrial equipment, alongside computers and medical equipment, among the items requested [3]. The cases in those alerts arrived by email and phone. Ours came through website forms, and I can’t tell you they are the same thing.
Another plausible scenario is that people who send bulk email need their sending addresses to build a good reputation, and replies from real people help. A realistic, detailed RFQ sent to a manufacturer is very likely to get a reply. I can’t prove that is what happened here either. That would explain why someone might do this without any plan to steal anything, though.
Either way, there is a cost. If a submission like this comes from a ppc campaign, you paid for the click. Google’s own help documentation says its invalid traffic filters don’t prevent invalid leads on their own, and that lead quality is a shared responsibility [4]. Then somebody on your team researches the request and builds a quote, and with technical work that is often an engineer’s time (and costs money).
What the writing no longer tells you
Poorly written messages are on the FBI’s 2014 list of red flags, and on the GSA inspector general’s [1][3]. In December 2024 the FBI warned that generative AI can help criminals correct the errors that might otherwise serve as warning signs [5].
The method I suspected is already documented. In April 2025 researchers at SentinelLabs described a bot that scraped each target website, used an AI language model to write a message tailored to that site, got past reCAPTCHA, and reached at least 80,000 websites through their contact forms and chat widgets [6]. That bot was pitching SEO services. The ones we found were posing as buyers.
I can’t prove an AI agent wrote these four. The wording taken from the website is what points me there. It was the phone numbers and the web addresses that gave them away.
I expect phone calls to follow the same path. The FBI’s 2025 internet crime report counted more than 22,000 complaints with an AI connection and more than $893 million in losses, and it notes that voice cloning can be used to request wire payments [7]. In May 2025 the FBI warned about a campaign using AI-generated voice messages to impersonate senior U.S. officials [8]. An FBI supervisory special agent said in a September interview that scammers can use AI to sound like an ordinary American neighbor, which puts the target’s defenses down [9].
For a manufacturer, I think the likely version is a follow-up call from someone who sounds like an ordinary buyer, asking for 30-day terms and a rush shipment to a different address. That would be hard to tell from the real thing.
Regulators have started to respond. The FCC ruled in February 2024 that AI-generated voices count as artificial voices under the law that governs robocalls [10], and an FTC rule finalized that same month prohibits impersonating businesses, including with look-alike email and web addresses [11]. Those rules matter, but they work after the fact.
What I'd check now
Here is what I’d have a sales team look at on a new inquiry, before putting real time into it.
- Does the web address match the company named? Look the company up yourself and don’t rely on the link you were given.
- Does the phone number fit the location they gave? One mismatch means very little, since people keep their cell numbers when they move. A pattern across several unrelated leads means a lot.
- Does the request read like your own website? Real buyers copy product names and specs too, so this means little alone. Alongside the other checks, it is worth a second look.
- Call the company at a number you found on your own. Two federal inspectors general give that advice for fake government RFQs, and they add that you should be suspicious of a purported official who won’t talk by phone [2][3]. I’d add that a phone call will prove less as AI voices get better, so how you found the number matters more than the fact that someone answered.
Before an order ships, verify the shipping address independently. An FBI agent quoted in that 2014 piece called it the most important thing to do [1]. Be careful with a residence, a self-storage unit, or a freight forwarder [1][3].
For whoever runs your ads, Google recommends validating email domains and phone number formats on the server before a submission reaches your CRM, and using lead-specific conversion goals such as qualified lead [4]. A format check alone would probably not have caught these four. The pattern across them was the signal.
I’m a big believer in AI, and this doesn’t change that. Our own tooling is what caught the pattern.
If you think you’ve been targeted, the FBI asks businesses to report it to local law enforcement and the FBI, including at ic3.gov [1].
Sources & Further Reading
The following resources informed this article. All claims have been verified against multiple sources where possible.
- Federal Bureau of Investigation, “Purchase Order Scam Leaves a Trail of Victims,” October 27, 2014. – https://www.fbi.gov/news/stories/purchase-order-scam-leaves-a-trail-of-victims
- U.S. Department of Commerce, Office of Inspector General, “Fraud Alert: Fake Government Procurement Schemes,” August 2024. – https://www.oig.doc.gov/wp-content/OIGPublications/Fraud-Alert_Procurement-Schemes-SECURED.pdf
- U.S. General Services Administration, Office of Inspector General, “Fraud Alert: Fake Government Requests for Quotes.” – https://gsaig.gov/news/fraud-alert-fake-government-requests-quotes
- Google Ads Help, “Prevent invalid leads.” – https://support.google.com/google-ads/answer/18179211
- FBI Internet Crime Complaint Center, “Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud,” Alert I-120324-PSA, December 3, 2024. – https://www.ic3.gov/PSA/2024/PSA241203
- SentinelLabs (SentinelOne), “AkiraBot: AI-Powered Bot Bypasses CAPTCHAs, Spams Websites At Scale,” April 9, 2025. – https://www.sentinelone.com/labs/akirabot-ai-powered-bot-bypasses-captchas-spams-websites-at-scale/
- FBI Internet Crime Complaint Center, “2025 IC3 Annual Report.” – https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- FBI Internet Crime Complaint Center, “Senior US Officials Impersonated in Malicious Messaging Campaign,” Alert I-051525-PSA, May 15, 2025. – https://www.ic3.gov/PSA/2025/PSA250515
- InvestigateTV (Gray Media), “Inside the scam: How criminals impersonate the FBI’s complaint center,” interview with FBI Supervisory Special Agent Tim Lynch, September 25, 2026. – https://www.fox19.com/2026/09/25/inside-scam-how-criminals-impersonate-fbis-complaint-center/
- Federal Communications Commission, “FCC Makes AI-Generated Voices in Robocalls Illegal,” February 8, 2024. – https://www.fcc.gov/document/fcc-makes-ai-generated-voices-robocalls-illegal
- Federal Trade Commission, “FTC Proposes New Protections to Combat AI Impersonation of Individuals” (announces the final Government and Business Impersonation Rule), February 15, 2024. – https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-proposes-new-protections-combat-ai-impersonation-individuals
