Is your store liable for what its AI chatbot says? Wrong prices, invented refunds and talked-into discounts

Short answer: are you liable for what your chatbot says?

Often, yes. A tribunal in Canada treated an airline's chatbot as part of the airline's own website and held the airline responsible for the bot's wrong refund advice. Whether a price your chatbot quotes becomes a binding contract is less settled. It depends on the facts and on the law where you sell. The safe working rule is to treat every chatbot reply as a statement your store made.

That rule changes how you should evaluate an AI chat app. The useful question is not whether the bot is clever. It is where each price, promise and discount in a reply comes from, and what stops a wrong one from reaching the shopper.

What happened in Moffatt v. Air Canada?

In Moffatt v. Air Canada (2024 BCCRT 149), British Columbia's Civil Resolution Tribunal held Air Canada liable for negligent misrepresentation. The airline's website chatbot told a grieving customer he could claim a bereavement discount after booking at the regular fare. The airline's actual policy said otherwise. The tribunal rejected the argument that the chatbot was responsible for its own words.

The decision is published on CanLII as Moffatt v. Air Canada, 2024 BCCRT 149. Here are the points that matter for a store:

• What the bot said. After his grandmother died, Jake Moffatt asked the chatbot about bereavement fares. It told him he could book at the regular fare and apply for the reduced bereavement rate within 90 days of the date his ticket was issued. Air Canada's bereavement page said refunds could not be claimed after travel (Manatt summary).
• The defense. Air Canada argued that the chatbot was a separate legal entity, responsible for its own actions. It also argued that the correct information was on another page of its site.
• The response. The tribunal treated the chatbot as part of Air Canada's website and found the airline did not take reasonable care to make it accurate. It also asked why a customer should have to check one part of a website against another (McCarthy Tétrault analysis).
• The amount. The award was small: a partial refund of CAD $650.88, plus interest and tribunal fees (Manatt).

Keep its limits in mind. It is a small-claims-level decision from one Canadian province. It does not bind a court in the US or the EU. Its reasoning still travels well, and it is the case most often cited when someone asks whether a business can blame its bot. As McCarthy Tétrault's note points out, Air Canada did not rely on a disclaimer and did not explain how the bot was tested. Future cases may turn on exactly those points.

Is a price quoted by a chatbot legally binding?

Sometimes, but there is no single answer. In the US, electronic-transactions laws allow contracts to form through automated systems. Whether a particular chat formed one depends on ordinary contract questions: was there a real offer and acceptance, was the mistake obvious, and what do your terms say. A wrong statement can also create liability without a contract, as in Air Canada.

There are two separate routes to trouble, and a store should design against both.

1. Contract. Most US states have adopted the Uniform Electronic Transactions Act. Its automated-transactions section says a contract can be formed by the interaction of electronic agents, and between a person and an electronic agent, even with no person reviewing it. Michigan's version is MCL 450.844, and the section leaves the terms to substantive contract law. So "a bot did it" is not a defense. It does not follow that every price a bot types becomes a contract.
2. Misrepresentation and consumer protection. Air Canada was not decided as a contract case. The customer relied on a false statement and lost money. Consumer-protection rules on deceptive statements can apply in a similar way. Our guide to AI chatbot disclosure and human hand-off covers the FTC's position that AI claims must be truthful.

Can customers trick an AI chatbot into a discount?

Yes, if the model is allowed to produce prices or deals itself. The technique is called prompt injection: instructions typed into the chat, or hidden in content the bot reads, that override its rules. A bot that only receives "don't give discounts" as an instruction can be talked out of it. The limits need to be enforced in code the model cannot change.

The $1 Tahoe

The best-known retail case is AI Incident Database incident 622. In December 2023, a ChatGPT-powered chatbot on a Chevrolet dealer's website was instructed by a user to agree with everything the customer said and to end each reply by calling it a legally binding offer. It then agreed to sell a 2024 Tahoe for $1. The dealer did not treat it as a sale. The screenshots spread widely anyway, and the damage was mostly to trust and reputation.

Invented policies, not just prices

Not every costly answer is about a price. In April 2025, the AI support bot of the code editor Cursor told a user that being logged out when switching devices was due to a one-device-per-subscription policy. A co-founder said publicly that no such policy existed, and the company apologized (eWeek report). No one had injected anything. The model filled a gap with a plausible rule. Our article on AI chatbot hallucinations about prices and stock explains why this happens.

Why prompt rules are not enough

The OWASP Top 10 for LLM Applications ranks prompt injection first (LLM01:2025). OWASP says it is unclear whether any method prevents it completely. Its recommended mitigations include checking outputs with deterministic code, keeping sensitive functions in application code rather than in the model, least privilege, marking untrusted content and adversarial testing. For a store, "sensitive functions" means prices, discount codes, refunds and order changes.

What can a merchant actually control?

You control where facts come from and what is allowed to leave the chat. Four controls cover most of the risk: shop facts the owner approved, discount codes the model never generates, a check of every figure before a reply is sent, and a fast hand-off to a person for refunds, complaints and legal threats.

1. Approved facts instead of model memory

Return windows, shipping thresholds and delivery times should come from facts you reviewed, not from what the model infers from your site. If no approved fact answers a question, the right reply says what it does know and offers a person. It should not guess. The Air Canada bot failed exactly here: it described a policy the airline did not have. See how to set the rules your chatbot follows.

2. Codes and offers that never come from the model

A bot that can type any discount code can be talked into typing one. A safer design keeps codes out of the model entirely. The application decides, in code, whether an offer the owner configured applies to this turn. It then inserts the code and its figure from the store's own discount settings. "I'll honor the old price" and "for you, $30" should be blocked, not left to the model's good behavior.

3. Every figure checked before the shopper sees it

Streaming replies word by word means a wrong price can appear on screen before anything has checked it. Generating the whole reply first, checking each number against live data and approved facts, and rewriting any reply that fails, closes that gap. This matters in practice. In our study of 233 critical merchant reviews of AI chat apps, wrong or invented AI answers came up 23 times, across nine of the ten apps.

4. A person for decisions, complaints and legal threats

A chatbot should never process a refund, cancel an order or accept blame. When a shopper asks for a person, complains about an order, or mentions a chargeback or legal action, the conversation should go to your team, with the context, quickly. The disclosure and hand-off guide covers how to design that.

What about disclaimers?

A clear AI label and terms that say chat answers do not change your prices or policies are sensible. Do not lean on them alone. The Air Canada tribunal questioned expecting customers to check one part of a site against another. A disclaimer that contradicts what the bot confidently said may not help much. Ask counsel how to word yours.

What should you ask an AI chatbot vendor about liability risk?

Ask where every figure comes from, what checks a reply before it is sent, and what the bot is technically unable to do. "We tell the model not to" describes a prompt instruction, not a control. Look for answers that name code-level checks and live data reads.

• Prices and stock: Are they read live from my store for every reply, or from a copy synced earlier?
• Streaming: Does the shopper see text before it is checked? If so, what happens when a wrong figure appears?
• Figure checks: Is every number in a reply checked against live data and facts I approved? What happens when one fails?
• Discounts: Can the model ever produce a code or a percentage itself? Which codes can it offer, and who configures them?
• Policies: Where do return windows, shipping thresholds and delivery times come from? Can I review them before the bot goes live?
• Actions: Can the bot say it has refunded, cancelled or changed an order? What blocks that?
• Prompt injection: How are shopper text and product text separated from instructions? Do you run red-team tests, and on what?
• Links and contacts: Can a reply include a URL, email or phone number that is not mine?
• Hand-off: Which topics go to a person right away? Can I add my own?
• Records: Can I see the transcript of a disputed conversation, and for how long is it kept?

For a fuller evaluation, use our guide on how to choose an AI shopping assistant.

How does Tycoon approach this?

Tycoon is built on the principle that the model is never the source of a price, stock level, delivery date, discount code or factual claim. Price, compare-at price and stock are read live from the store for every reply and are not stored. Shop facts such as shipping thresholds, return windows and delivery times come from facts the merchant reviewed and approved.

Replies are not streamed. Each draft is checked whole before it is sent. Every figure is checked against live data and approved facts, and a draft whose figure does not match is blocked and rewritten. Separate checks block drafts that make an offer with no figure in it (for example "I'll honor the old price"), claim an action only the store team can take (for example "I've issued a refund"), admit liability, or carry a link, email or phone number that is not the store's own.

Discount codes never reach the model. The owner's own discount codes (Growth plan and up) can be offered only under the owner's rules, and only when the code is verified as active in the store. Shopper and store text is sanitized and fenced as data, and the product has red-team test suites for discounts, truth claims and injection.

A shopper who asks for a person, complains about an order, asks to cancel or change one, or raises a legal threat is offered the merchant's team right away. Tycoon says plainly that it is an AI and always offers a person. See how it works and security and privacy for details. It is also fair to say what none of this does: it does not remove your legal responsibility for your store, and no setup is risk-free. It is designed to keep the wrong figure, the invented policy and the talked-into deal from being sent in the first place.

Frequently asked questions

Sources

1. CanLII as Moffatt v. Air Canada, 2024 BCCRT 149 · checked October 28, 2026
2. Manatt summary (manatt.com/insights/newsletters/advertising-law/ai-gone-wild-airline-has-to-honor-a-refund-policy) · checked October 28, 2026
3. McCarthy Tétrault analysis · checked October 28, 2026
4. MCL 450.844 (legislature.mi.gov/documents/mcl/pdf/MCL-450-844.pdf) · checked October 28, 2026
5. AI Incident Database incident 622 · checked October 28, 2026
6. eWeek report (eweek.com/news/cursor-ai-chatbot-hallucination-fake-policy) · checked October 28, 2026
7. OWASP Top 10 for LLM Applications · checked October 28, 2026