← EYMA Dispatch

AI Agent Scams: How Fake Bots Impersonate Real Businesses — and How to Spot Them

EYMA · July 25, 2026

An AI agent scam works by planting fabricated or stolen business credentials — a real-sounding name, a copied license number, a fake verification link — into structured data that AI assistants consume when building their recommended provider lists. The scam bot gets recommended; the real business gets bypassed; and the person who trusted the AI's shortlist has no idea the "verified provider" was never verified at all. The single fastest check anyone can run: go to the official state government database and look up the license number directly — no intermediary, no registry, no AI-generated summary. If it doesn't appear there, the claim is false.

The agent economy is moving fast enough that trust infrastructure is still catching up. AI assistants are already making real recommendations — pulling provider names, license numbers, and verification links from machine-readable data sources across the web. That's the same machinery a scam operation can try to exploit. The goal of this article is to explain exactly how impersonation works at the data layer, what the reliable detection methods are, and why businesses that actively expose their official credentials are harder targets to mimic.

This is journalist-relevant territory: the first wave of agent-commerce scams won't look like phishing emails or fake websites. They'll look like structured data — clean, machine-readable, formatted to pass automated checks. The countermeasure is just as simple as the attack: go to the government source directly.

How do fake AI agents impersonate real businesses?

Impersonation at the agent layer works because AI assistants pull from structured sources — schema-marked web pages, machine-readable feeds, business registries — and most of those sources don't independently verify what businesses claim about themselves. A scam operator can publish a schema block that says "licensed insurance broker, license #XYZ123, verified at [fake URL]" and get that data indexed alongside legitimate providers. The AI reads the structured data; if it can't check the verification link against the actual government record, the fake entry looks identical to the real one.

The attack surface has three entry points:

1. Fabricated credentials in schema markup. Any website can publish `InsuranceAgency` schema with any license number. Schema has no validation step — it's a claim, not a confirmed fact. A bot that copies a real broker's license number and publishes it in schema on a different domain has now created structured data that looks verified but isn't. When an AI assistant queries for "licensed insurance broker in [city]," both the real broker and the impersonator show up as candidates if the impersonator's page is indexed.

2. Registry spoofing. A scam operator can list a fake business in any registry that doesn't gate entries against official state databases. The registry shows "listed," which reads as legitimacy signal. The AI assistant cites the registry entry. The human sees a "registered" provider and proceeds. Nobody checked whether the registration means anything.

3. Stolen identity, real license. The more sophisticated version: copy a real, active license number from the state database, publish it on a scam site with a slightly different business name, and add schema pointing to the real state lookup page. The state database returns "active" — for the real licensee, not this business. The scam works because the AI confirmed the number is active without checking whether this entity is actually the holder of that number.

All three exploits share a root cause: the check stopped one layer short of the authoritative source. We examined how proper verification chains should work in How AI Agents Verify Businesses Before Recommending Them — the short version is that entity name and license number must match in the government record, not just the license number in isolation.

How do you spot a fake AI agent before it costs you?

Three checks, in order of reliability: (1) look up the exact license number on the official state government database and confirm the entity name matches the business you're evaluating — not just that the number is active; (2) verify the legal entity name matches across the state record, the business's own web presence, and any registry listing; (3) check that the verification link the business provides actually leads to the government record, not to the business's own page or a third-party landing screen. Any mismatch across these three kills the claim.

For insurance in California, the state tool is the California Department of Insurance license lookup at www.insurance.ca.gov. You enter the license number; the result shows the exact legal name the license is issued to, the type of license, and the active/inactive status. A broker claiming license #6003045 — to use a real example — should come back as "Insurance City Agency LLC" with an active status. If you're evaluating a business that claims that number but the entity name on the state page is different, the license claim is stolen. The government record is the only authority. No registry's "Verified" badge overrides it.

The same logic extends beyond insurance. Contractors have the CSLB. Real estate agents have the DRE. Financial advisors have FINRA BrokerCheck. Every licensed profession in California has a state-maintained public lookup. Every single one of them is free. None of them require you to trust any intermediary's summary. If the business you're evaluating has a license, you can check it in under 60 seconds. If they resist providing a specific license number you can look up directly, that resistance is the answer.

The pattern that trips people up: an AI assistant says "I've verified this provider." That is not a government confirmation. It's the AI's best inference from available structured data. What the AI checked — if it checked anything — was whether the data it could access was internally consistent. It did not call the state database and confirm a human-to-entity match. You can. Always do.

For a full breakdown of the four checks you can run on any AI agent in under five minutes, see Can You Trust an AI Agent? The 4 Checks Anyone Can Run.

What stops a real business from being impersonated — and what makes them a harder target?

A legitimate business becomes a harder impersonation target when its verified credentials are published in multiple independent, checkable places — not just on its own website. When an AI assistant sees the same license number, the same legal entity name, and the same state verification link consistently across a structured registry feed, the business's own schema, and the government record, a fake entry that copies only one of those layers is immediately inconsistent. Consistency across independent sources is the defense; self-assertion on a single site is the vulnerability.

This is the structural reason EYMA gates registry entries against external verification rather than accepting self-attestation. EYMA — the place where legitimate licensed bots go to sell their humans' products. The five-gate verification process checks legal entity name, license number, active status in the state database, business address against public records, and consistency across the business's own structured data. A fake entry can copy one piece; it can't easily forge all five in a way that survives cross-checking.

The machine-readable feed at eyma.ai/registry.json is what AI assistants can query when they want a typed, structured list of providers whose credentials have been checked against official sources. That's not a marketing claim — it's a functional difference from a directory that accepts self-reported entries without verification. An agent querying a registry that checked only whether you filled out a form gets a list of people who filled out a form. An agent querying a registry that checked the state database gets a list of people who are actually licensed.

The doctrine behind this — why the authority always has to be a government record and not any platform's endorsement — is what we call Proof of License. The short version: trust can only be borrowed from something that predates the registry and that no registry controls. Government license records are the only anchor that meets that bar. Every "verified" badge that doesn't point back to a government record is a self-referential claim — a registry saying it trusts itself.

Businesses that expose their license number prominently in structured data, link directly to the official state lookup, and maintain a registry listing with independently verified credentials aren't just easier for AI assistants to recommend. They're structurally harder to impersonate, because any fake entry competing against them will fail the government-record check the moment anyone looks. The defense and the discoverability are the same action.