If you're going to deploy an AI chatbot as the public face of your customer service operation, there are certain words you might reasonably want to filter out. Profanity. Slurs. Threats. The name of your own company is generally not on that list.

The conversation

David Birch, a well-known fintech commentator and author, was trying to do something routine with his Virgin Money accounts in January 2025. He wanted to merge two ISAs (Individual Savings Accounts, a UK tax-advantaged savings product) he held with the bank. Rather than phone in, he used Virgin Money's online chat support, which directed him to the bank's AI chatbot.

The interaction went sideways almost immediately. When Birch typed a message that included the words "Virgin Money" - because that is, after all, the name of the bank he was trying to interact with - the chatbot responded with a content moderation warning: "Please don't use words like that. I won't be able to continue our chat if you use this language."

The chatbot's profanity filter had flagged "virgin" as inappropriate language. The word is, of course, the literal name of the financial institution that deployed the chatbot. Every customer interaction involving account names, product references, or basic identification of which bank they were talking to would potentially trigger the same filter.

Birch, understandably, did not let this slide quietly. He shared screenshots of the exchange on social media, where the comedy of a bank's chatbot censoring its own brand name did exactly what you'd expect.

How a word filter defeats itself

The technical failure here is almost insultingly simple. The chatbot used a content moderation filter - likely a basic keyword blocklist - to screen incoming messages for inappropriate language. Someone included the word "virgin" on the blocklist, presumably to filter messages with sexual content. Nobody thought to whitelist the company's own name, or to apply the filter with any context awareness whatsoever.

This is the kind of bug that would take about five minutes to fix once identified, but it's also the kind of bug that reveals how little thought went into deploying the filter in the first place. A content moderation system for Virgin Money that doesn't account for the word "virgin" appearing in every normal customer interaction is a system that was either never tested with realistic inputs or was tested by people who somehow avoided ever mentioning the company's name.

Content moderation in AI chatbots is generally handled at one of several layers: a pre-processing filter that screens the user's input before it reaches the language model, a system prompt that instructs the model on what topics to avoid, or a post-processing filter that screens the model's responses before they reach the user. Virgin Money's filter was apparently at the input layer, blocking messages from customers before they could even reach the part of the system that might understand them.

Input-layer blocklists are blunt instruments. They match keywords without understanding context. The word "kill" might appear in "I need to kill this standing order." The word "virgin" appears in the name of the company. A blocklist doesn't know the difference. More sophisticated content moderation uses the language model itself to assess whether a message is actually problematic in context, but that requires more engineering effort and computational cost than a keyword list.

Virgin Money's response

Virgin Money confirmed the issue and said it was "working on it." The company told press outlets that the chatbot involved was "an older model" that was "already slated for improvements." The bank had previously promoted a newer chatbot called "Redi," which launched in March 2023 and was designed to be more conversational, understand local dialects, and generally behave like a functional piece of customer service technology. The chatbot that scolded Birch for saying the company's name was apparently not Redi but an older system still in operation.

This is a common pattern in large organizations: new, improved systems get deployed alongside older ones rather than replacing them, and the older systems accumulate quirks that nobody addresses because the replacement is "coming soon." In the meantime, customers get routed to whichever system handles their particular query, and some of those customers end up talking to the neglected legacy chatbot that thinks the company's name is a swear word.

The DPD parallel

The incident inevitably drew comparisons to DPD's chatbot meltdown almost exactly a year earlier, in January 2024, when the delivery company's AI chatbot was jailbroken into swearing, writing disparaging poetry about DPD, and recommending competitors. Both incidents involved UK companies with AI-powered customer service chatbots that embarrassed the brand on social media.

The difference is in the failure mode. DPD's chatbot was manipulated by a user who was deliberately testing its boundaries - an adversarial prompting exercise. Virgin Money's chatbot broke down during a completely normal customer interaction. Birch wasn't trying to trick the system. He was trying to use it for its intended purpose. The chatbot's inability to handle the company's own name was not a response to creative exploitation; it was a response to the most basic possible use case.

That makes the Virgin Money incident arguably more concerning from a product quality standpoint, even if it's less entertaining than a chatbot composing anti-corporate poetry. DPD's chatbot failed under adversarial conditions that could theoretically be defended against. Virgin Money's chatbot failed under the most ordinary conditions imaginable. If you can't type the company's name into the company's chatbot without getting flagged for inappropriate language, the chatbot wasn't ready for customers.

The content moderation trade-off

Content moderation in customer-facing AI systems is genuinely difficult. Companies face real risks from unfiltered chatbot interactions - as DPD, Chevrolet dealerships, and others have demonstrated, chatbots without adequate guardrails can be manipulated into saying things that are embarrassing, legally risky, or both. The instinct to add keyword filters is understandable.

But a keyword filter that blocks the company's own name is not content moderation. It's a self-inflicted denial of service. The filter didn't protect the company from inappropriate interactions; it prevented normal interactions from happening at all. A customer who can't even reference the name of the bank they're trying to reach is a customer who is going to call the phone line, write a complaint, or - if they happen to be a fintech commentator with a social media following - share the absurdity publicly.

The fix is straightforward: whitelist the company name and its common variations, apply contextual analysis rather than raw keyword matching, and test the filter against actual customer queries before deploying it. These are not advanced engineering challenges. They are basic product readiness steps that were apparently skipped.

Birch, for his part, told press outlets he found the whole thing "amusing" but noted that the bank should probably ensure its AI systems "can handle the basics." That seems like a reasonable minimum bar. A chatbot that can't process a message containing the name printed on your debit card is a chatbot that has not met the basics.