I interviewed a breast-cancer survivor who wanted me to tell her story. She was actually an AI.

• A woman asked me to do a story about the mastectomy tattoo she got after having cancer.
• After a few introductory emails, I realized the text and photo she'd sent were AI-generated.

"Seeing my scarred chest in the mirror was a constant reminder of what I had lost," Kimberly Shaw, 30, told me in an emotional email.

She had contacted me through Help a Reporter Out, a service used by journalists to find sources. I cover skincare and had been using the site to find people for a story about concealing acne scars with tattoos.

Then I read Shaw's response about her breast-cancer diagnosis: how she knew a mastectomy was the only viable route to recovery, how emotionally painful it was, how she worked carefully with a tattoo artist to find the right design, how it helped her heal.

"I felt like I was reclaiming my body, taking back control of something that cancer had taken from me," she told me.

Shaw's experience may not have been relevant to my acne story, but it tapped into the same feelings of empowerment and control I wanted to explore. Thinking she could inspire a powerful new piece, I emailed her back.

But after days of back-and-forth conversations, something in Shaw's emails began to feel a little off. After idly wondering to my boyfriend whether she could be a fake, he suggested that I run the emails through a text checker for artificial intelligence.

The result was unequivocal: Shaw's emails had been machine-generated. I'd been interviewing an AI the entire time.

Just human enough

In approaching "Kimberly Shaw," I'd followed standard journalistic protocol. Generally, I start with basic email questions to see if a subject's backstory is a fit for what I'm working on, then ask them to move to a phone interview.

My questions were simple: How old was she? When did she have cancer? What was the tattoo of? What was collaborating with the artist like? Would she be comfortable sharing photos?

Shaw replied, answering my questions clearly and concisely. She told me she had cancer two years ago and that she got the tattoo six months after going into remission. It incorporated both a breast-reconstruction design and an intricate lotus. The artist had been patient and collaborative.

The only things she omitted were the images I'd asked for and her age. But she did make a request: In exchange for participating, she hoped I would mention her role as the founder of a few websites — a couple of Dictionary.com knockoffs and an online-gaming page. Ideally, I could link to them, too.

Emotionally open yet untraceable

The request wasn't that unusual. A lot of HARO sources are entrepreneurs hoping for a business plug in exchange for an interview — often with a link to their personal website, LinkedIn profile, or social handles. I typically decline to include links that aren't relevant to the story, but her asking wasn't odd to me.

What was odd was that I couldn't find her elsewhere online. Her company, which she'd said was named SC, was too vague for me to find. Her email didn't come up in Google search results and was a Proton account (meaning encrypted). Her phone number had an 898 area code, which didn't exist, as far as I could tell.

She wasn't on LinkedIn, and her websites seemed, well, embarrassing — poorly designed spam pages. Still, I didn't want to judge how someone made money, least of all a breast-cancer survivor.

Then, she sent her photo.

Something was wrong — but I couldn't exactly say what. Her hair? Her teeth?

I messaged my editor to say I was pausing the story.

Connecting the pixels

Despite these red flags, I felt guilty for feeling suspicious of a cancer survivor, especially one who was being so vulnerable with me.

But one night, my boyfriend and I got into his favorite conversation topic of late — AI and how it might change all our jobs. I joked about him being overly consumed by ChatGPT-related think pieces, then paused: Actually, there was someone I was talking to who sounded a little robotic.

"Why don't you just scan the text?" he said while putting the dishes away.

I raced to our bedroom and Googled "AI text checker," which led me to Writer, a free service that shows how human-generated a section of text is — with the intention of helping AI users revise generated content to sound more human. A score of 100% indicates a real person likely wrote it; a lower score, say, 40%, shows AI did the bulk of the work.

Then I input some of the answers to my questions.

"No way," my partner said as he paced around the room.

To cross-check the app, I tested some of my writing at Insider.

Increasingly confident I'd been fooled, I reopened the headshot and zoomed in. When I knew what I was looking for. I saw glitches everywhere: the off-center ear piercing, the phantom second eyebrow.

Based on this Medium post on deepfake images, I presume it was made in StyleGAN, which splices together different photos to create a nonexistent person.

I don't know how many people were combined to make one "Kimberly Shaw." But I'm almost certain none of them know a fraction of their likeness is being used to peddle junk websites and cancer hoaxes.

Why was someone trying to fool me?

It was clear that whoever was behind "Kimberly Shaw" had been trying to use Insider's platform — and our strong rankings on Google — to boost the profile of their spam websites.

Google has strict policies against spam linking, which make it tough for scammers to reach wide audiences on their own. But having the links included on Insider, which averages about 85 million visits a month, could be worth the trouble — even if it meant trying to dupe someone who would likely ask a lot of questions.

"For them to go and target a journalist that has these skill sets, the win for them must have been so good," said Jeff Hancock, a professor of communication at Stanford University who's studied how people use deception with technology.

Hancock said spam gaming sites like the one I'd been asked to link often collected and sold user data. To play a "free" online game, a user has to first enter their name, email, and phone number, which are then distributed to scammers.

As shocking as using cancer to get past my defenses was, Hancock said he believed it was an intentional choice.

"Faking cancer is this horrific thing that you would assume most people wouldn't do — and that's one of the things they rely on," he said, adding that it's an indicator that "the person on the other side is genuinely criminal."

A low-cost learning curve for criminals

Scammers have useful tools on their side. Current AI technology "makes it extremely, extremely easy for anyone to create credible AI-generated text, image, video, or even audio," Merve Hickok, the founder of AIethicist.org and a data-science-ethics lecturer at the University of Michigan, said.

That could be dangerous for journalists. Trust in media is already near a record low: In a 2022 Gallup poll of Americans, only 7% of respondents said they "have a great deal of trust" in the news.

My usual protocol of verifying sources and insisting on a phone interview would have helped me catch the scammer even without my boyfriend's suggestion. But technology is evolving, Hickok said, and scammers may be able to use voice automation and video-generation tools in the very near future.

As new technology emerges, scammers will likely adapt, Hancock said. "For the victims, it's a one-off; for the criminal, it's a learning process."

That could make it harder for reporters to catch a lie, which could lead to legal liability, reputational damage, and the unintentional spreading of fake news.

"It erodes your trust towards your sources, towards what you see, what you hear," Hickok said. "It erodes trust towards journalism, towards institutions — ultimately, towards democracy."

I'll be more careful from now on — but the threat is only growing

Once I'd confirmed my source was a fake, I immediately reached out to HARO, which told me it had already banned the account two days prior. A spokesperson said the issue was "top of mind" and that the service was using both technology and human reviewers to identify fake and harmful content.

I put together a document about my experience for the entire Insider newsroom. We're sharpening our protocols and becoming more vigilant than ever about researching sources in advance, insisting on phone interviews, and running email communications through a text checker.

Even though I caught on before typing a single word of my story, I was disappointed in myself. I knew deep down that the first email was rife with clichés, and I was upset I'd gotten as far as responding.

All I can do now, according to Hickok, is stay on top of AI advancements and hope that tools to identify AI dupes are developed as quickly as AI is.

Hickok and I also agreed that governments and AI companies should realize how dangerous it is to rush these technologies into the market before considering the consequences — a subject on which many tech leaders are already speaking out.

Next time, "Kimberly Shaw" might wave to me over video or sound convincingly passionate over the phone. I'm preparing for the day she does.