You Google ‘ChatGPT’ or ‘Claude’ or whatever AI tool you need. You click the first result that looks right. You log in. And just like that, someone else has your credentials.
This is a real, growing scam — and it’s way more polished than the sketchy phishing emails you’ve been warned about your whole life.
According to the Federal Trade Commission, scammers can use AI to generate fake websites, fake posts, and fake profiles — and even help create malware and ransomware. Meaning: the same AI tools you’re trying to use are also being used to build convincing traps for you.
The FBI has flagged that criminals are embedding AI-powered chatbots directly into fraudulent websites to get victims to click on malicious links. So you might land on a fake site, interact with what feels like a real chatbot, and still have no idea anything is wrong.
Two things can happen once you’re on one of these sites. You enter your login info — and now they have it. Or the site quietly installs malware on your device that can steal your passwords, credit card numbers, and other personal data without you ever knowing. Sometimes both.
Here’s the part that makes this tricky: the pages look real. Not ‘close enough’ real. Actually real — because AI can now be used to build entire convincing company websites quickly and cheaply. The logo looks right, the layout looks right, everything looks right.
So what do you actually do?
First, stop clicking search results to get to AI tools you use regularly. Bookmark the real URLs directly. ChatGPT is openai.com. Claude is claude.ai. Get there through your bookmark, not through Google.
Second, look at the URL bar before you do anything else. Fake sites often have small typos or weird domain endings — like ‘chatgpt-free.io’ instead of ‘openai.com’. If it looks off at all, close it.
Third, never enter your password on a site you landed on through a search result unless you’ve verified the URL matches exactly. Like, exactly exactly.
This stuff isn’t going away. If anything, it’s getting harder to spot as the fakes get more convincing. The only real defense is building the habit of going directly to the source — every single time.