AI Companion Scam Red Flags and How to Check Them

Updated 2026-09-28 · Safety

The AI companion category grew fast, and fast-growing categories attract operators who are better at marketing than at running a product. Most apps are legitimate businesses with clear pricing and a real support desk. A minority are not, and the difference is usually visible before you pay if you know where to look. This entry lists the behavioural red flags and gives you a checklist you can run in about ten minutes.

This is about patterns, not accusations. No platform is named here as a scam, because a single red flag proves nothing and a bad link profile is not the same as fraud. Judge the behaviour, not the brand. For how the charging models work, see AI companion pricing explained; for the traps that hide inside them, see subscription traps. For data handling, see the privacy guide.

Why this category attracts bad actors

Four features make the space attractive to bad operators. The product is bought privately, so users are less likely to complain publicly. Billing is recurring, so one successful signup keeps paying. Some customers use crypto or prepaid cards, which are hard to reverse. And the underlying content is easy to fake at scale — a generic chat interface with a stock avatar looks like a finished product.

None of that makes the category unsafe. It just means the standard checks are worth running.

Billing and payment red flags

• Prices are hidden until after you create an account, so you commit before you can compare.
• Renewal terms are not stated on the checkout page, only buried in a long policy document.
• The refund policy is missing, or the link to it returns a 404.
• Payment is crypto-only, with no invoice, receipt, or company name.
• The pitch is "free unlimited", and the paywall arrives within minutes of signing up.
• The only listed contact is a Telegram handle.

Identity and domain red flags

• The domain was registered weeks ago, not years.
• There is no company name, address, or jurisdiction anywhere on the site.
• The privacy policy is a template with the company name left blank or pointing to an unrelated site.
• The about page describes nobody, or describes a team with no verifiable history.
• Contact channels are social accounts only, with no email on the domain.

A redacted registration record is normal; privacy services are standard and many legitimate sites use them. Look for consistency instead. A company that names itself in its terms, its invoices, and its WHOIS-adjacent records is easier to trust than one that appears nowhere.

Marketing and review red flags

Fake demand is cheaper to manufacture than a good product. Watch for press logos that link nowhere, testimonials with no author, and review sections where every entry was posted in the same week with the same tone.

Backlink profiles can show how a product is marketed, even if they prove nothing about its honesty. A Semrush snapshot from August 2026 (page updated 2026-09-17) recorded candy.ai at 193.86M backlinks from 8.65K referring domains, with an Authority Score of 52. That combination — very large volume against a modest authority score — is consistent with large-scale, low-quality link acquisition. The same snapshot showed 45.59M monthly visits, but only about 1.5% arrived through natural search (roughly 675K), and its top five organic keywords were all brand names or misspellings, which points to a brand-led audience rather than editorial endorsement.

Those are facts about marketing, not evidence of wrongdoing, and candy.ai is not being accused of anything here. But the lesson generalises: a link count tells you how hard a site is promoting itself, not whether it deserves the traffic. A separate check we ran on 2026-09-28, sampling 96 links across 36 pages that point to candy.ai, found 86% were nofollow or sponsored. When most commentary is affiliate-driven, "everyone recommends it" is not a signal.

Distinguishing affiliate content from a real review

• Look for a disclosure. A genuine review says it earns commission. Fine print at the bottom counts; a hidden one does not.
• Check the link attributes. nofollow and sponsored tell you the link is monetised.
• Count how many platforms the site covers. A site that recommends one product and links out to no competitors is a sales page.
• Read for weaknesses. A review with no criticism is a promotion, whatever it calls itself.
• Check the date. Affiliate lists are often republished with a fresh date and no new testing.

Support and data red flags

• The signup form asks for more than it needs — full address, photo ID, or payment details before any trial.
• There is no way to delete your account, only to cancel a subscription.
• Support never answers a pre-sale question, which tells you what post-sale support will be like.

A ten-minute verification checklist

1. Look up the domain's registration date through a WHOIS or ICANN lookup. A very new domain is not automatically bad, but it means there is no track record.
2. Find the privacy policy and the terms of service. If either is missing, stop.
3. Read the refund and cancellation terms before paying. If they are not reachable, that is the answer.
4. Search the app name alongside "refund", "cancel", and "charged after". Read the results.
5. Confirm there is a company name and a working, on-domain support email.
6. Send one pre-sale question and see if a human replies.
7. Check that the checkout page states the renewal price and period.

If two or more of these fail, treat the app as unproven and look elsewhere.

If you have already been charged

• Take screenshots of the charge, the checkout page, and any terms you were shown.
• Cancel the subscription and, separately, request account deletion.
• If the app is unresponsive, dispute the charge with your card issuer within the allowed window.
• If you paid through an app store, file the refund request through the store's process.
• If you paid in crypto, assume the funds are unrecoverable and focus on preventing recurrence.

Key takeaways

• Judge behaviour, not brands; one red flag is a question, not a verdict.
• Hidden pricing, missing refund terms, and crypto-only payment are the strongest single warnings.
• A very new domain with no company name behind it deserves extra caution.
• Most "best app" coverage is affiliate content; check disclosures and link attributes.
• Verify refund terms before paying, and remember cancelling is not the same as deleting.