Is it legit? How to tell if that website or social media account is a scam
AI is making it easier to build fake sources and harder to fact-check information. Here's how to spot the real stuff.
There is a 30 percent chance this article is fake.
It's not, of course. I am a real reporter. These are real sources. You can trust me.
Or can you?
According to a recent study from Pew Research, around one-third of recent web content is AI-generated. Around 10 percent of ".com" sites now have AI's fingerprints on them. Fake news sources peddling misinformation or propaganda (commonly referred to as "pink slime") have long outnumbered real news publishers — and are continuing to multiply with the help of AI.
Even legit websites and social platforms can steer you toward misinformation, scams, and other online dangers. A platform built to keep you hooked to an endless feed, fed by engagement and seeking to capture your attention, is a recipe for bots, phishing, and disinformation campaigns. Social media "experts" — sometimes entirely AI-generated people, other times real humans with ulterior motives — are building followings in the millions. In this increasingly confusing environment, here's how to get to the truth.
Why fake sources are proliferating
"High quality misinformation and deception were largely the domain of nation-states and well resourced groups," explained Donnie Hasseltine, chief information security officer at Arkstone Defense. Now, anyone can fake a site, build a bot, or amplify a misleading claim in an instant.
In addition to a decline in platform moderation, access to increasingly sophisticated AI models, mainly through open source markets, has completely changed how information is published, explained Zohaib Ahmed, CEO of deepfake detector Resemble.AI.
Likened to the "Wild West" by Ahmed, bad actors now have access to a host of AI models and tools without built-in safeguards to prove or disprove authenticity. They can avoid automatic detection built into mainstream models like Claude or ChatGPT, uploading troves of user and site data to build sophisticated spoofs without alerting developers.
Source: Pew Research Center
Credit: Cole Kan/Mashable/ Getty
The technology has generated a ballooning market for affordable "scam kits." Such kits cover "everything from advertising to writing blog posts and content on social media, to how features are being built in the product, how video calls are being done and how images are being uploaded onto social media platforms," Ahmed said. With a few hundred dollars, scammers can spoof entire sites, make convincing log-in portals, and build natural-looking engagement that makes it feel more real.
It's not just relegated to pink slime, either. You may encounter "url hijackers" or "typosquatting" for instance. These webpages closely mimic URLs for reputable sites — including news sites like "abcnews.com.co" or known organizations like FIFA — banking on users not looking too close. Others may spoof sites where it's common to exchange money or place bets. These domains may siphon off your personal information or try to steal your money outright.
The same happens on social media sites and chatrooms: X accounts meant to look like real people, dodgy TikTok Shop links that take users off site, suspicious links dropped in gaming chats by players you thought were your friends.
Why old advice may not work, and what else you can do
"The traditional signals of authenticity are fading," explained Eyal Elazar, head of market intelligence for e-commerce security business Riskified. "Only a few years ago, verifying something online relied on recognizable visual or contextual cues: a weirdly spelled URL, pixelated image artifacts, a robotic cadence in a video, or the sheer logistical effort required to pull off a coordinated hoax. Today, AI can effortlessly clean up misspelled URLs, blurry images, and stiff video voices."
Because users are up against a modern world of AI-powered websites and bot accounts, they also need new advice for scouring through the muck.
Check URLs and profile names to prove a website or account's veracity
The OG way to ensure you're on a legit site still works and is very simple: Check the URL.
First, look for the padlock icon or other indicator the browser has verified your connection. For Google Chrome users, select the menu icon to the left of the URL. You should see "Connection is secure."
Second, look for "https://" not "http://". The "s" designation means a site has been authenticated.
These security components are still essential components of the internet, explained Ron Kerbs, CEO of AI fraud prevention company Kidas.
Third, double-check the URL's spelling, says Ahmed. Keep an eye out for symbols in the place of letters and non-English characters masquerading as the English alphabet. Hover over a URL to see the full text.
If you're still unsure, search the URL on Google. You can also cross-reference URLs on Google's site status page or use an online URL scanning tool, Ahmed recommends.
Many mainstream browsers now include built-in safety checks that flag when a website doesn't meet these security parameters. Pay attention to them, and only follow through on visiting a site if you know its origins.
But bear in mind that social media accounts do not play by these rules, experts warn.
To verify an account is legit, start with the platform's own verification tools, like the classic check mark. Be sure to click through to the profile itself, not just how it appears on your feed. Many platforms allow custom characters in display names, which help users fake verified check marks on first glance. Other platforms, like X, let users buy verification, so use additional means to confirm those accounts.
Be on alert for AI-generated influencer content, too. Look for AI content labels in captions, comments, and on profiles. Use the tips below to see if they've skirted detection (many do).
Credit: Cole Kan/Mashable/Getty
Use the SIFT Method to check for legitimacy
A site or account may seem legit on the surface, but its content could be far from it. Basic security measures aren't prevention for misinformation or manipulative content posted to verified platforms, experts say.
"You close the door, someone gets in through the window," Kerbs said. Users should use multiple layers additional methods beyond URL scanning to verify that what they're looking at is real.
Traditional recommendations for vetting news sources, for example, include the SIFT method. It's an oft-referred to media literacy skill designed by misinformation researcher Mike Caufield and stands for:
Stop your scroll
Investigate the source
Find other coverage
Trace back the origins
Zoning Method
Other news literacy groups, like the News Literacy Project, suggest a strategy of "zoning," or categorizing content, including websites and social media accounts, by their purpose.
"Identify the type of information you are looking at and determine its purpose. Is it news that’s meant to inform you? Or an opinion that’s trying to persuade you? Or is it a paid ad that’s encouraging you to buy something?" said Chuck Salter, president and CEO of the News Literacy Project. Salter recommends online users zone first before making judgements about trust. "You need to understand the main intent."
Salter also recommends a fact-checking concept called "lateral reading," in which you verify a source by searching what others are saying about it.
This can be used to fact check social media accounts, too. Before resharing, check the algorithm. How do others feel about this page?
Methods like SIFT and zoning are fairly simple and very effective ways to spot misinformation. But we're up against platforms actively working to steal our attention span and keep us glued to their platforms. We are urged to use integrated generative AI tools intended to reduce friction, but which can reduce users' critical thinking, experts say. Young people are at particular risk, Salter explained, and often fail to properly "zone" content without help.
We may need to simplify our toolkit even further.
Easy tips to use every day when scanning online
For one, never trust a screenshot, said Roei Sherman, senior director of research at cloud security firm Mitiga. A common way to spread misinformation, faked screenshots feed off of the attention economy: Get enough people to share the eye-grabbing headline or quote, and you'll convince a good amount of people it's true, especially if a generally reliable source is slapped on top.
Second rule of thumb: If a post feels like rage bait, it's probably rage bait. Scammers and propagandists stoke emotional responses to get your clicks, Rubinson explains. Try not to engage.
And lastly, if an account is asking you to leave the platform you're on, exercise caution. Fake accounts often steer users off of moderated platforms toward other websites with looser content guidelines or toward completely unregulated areas of the internet. It's why many social media giants, like TikTok, have specific rules against the promotion of off-platform sites.
Use established fact-checkers
If it's best to check a claim with multiple sources, it's even better to check the claim with an authority that makes fact-checking its job. Long before AI, these sites existed as nonpartisan sources for political claims. Now, they've expanded to cover just about anything going viral.
NewsGuard AI False Claims Monitor and Reality Check newsletter
Browser extensions can help you fact-check quickly
Some cybersecurity experts recommend browser extensions that can automatically scan a page for AI-generated content and give an assessment of its trustworthiness. These are a good starting point, but like most detector tech, are not infallible, experts like Marijus Briedis, chief technology officer at NordVPN, warn.
Resemble.AI Deepfake Detector: Scans all images, video, and audio and returns a verdict on whether or not AI was used. A free account includes four website scans per day.
NewsGuard: Provides a trust and reliability rating for news sites, based on nonpartisan criteria.
McAfee Web Advisor: The free version of the cybersecurity's fraud tool, Web Advisor scans for malicious sites, including hidden adware, spyware, and phishing scams.
DuckDuckGo Scam Blocker: The privacy-forward browser has built in scam blockers that also flag known scam sites, including shopping sites and fake cryptocurrency exchanges.
Want more tech and digital culture news delivered to your inbox daily or sent straight to your device? Sign up for Mashable's Top Stories newsletter or get Mashable push alerts today.