How to Spot a ChatGPT Phishing Site

A fake ChatGPT login page can steal your password or trick you into sharing a sign-in code. Use the checks below before entering credentials, and if you already submitted them, secure your account right away. You’ll need only the web address and, if something seems wrong, a trusted way to open the service directly.

What You’ll Need

The full web address shown in your browser’s address bar.
A trusted bookmark or a URL you type yourself to reach the service, rather than a link in a suspicious message.
Optional: another device or browser session where you can safely access your email and account security settings.

Step-by-Step

Pause before clicking or signing in. If a message, advertisement, search result, social post, or QR code says you must act urgently, treat that as a reason to check—not as proof it is genuine. Don’t enter a password, payment details, or a one-time code while you investigate. Avoid downloading files or browser extensions offered by the page.
Inspect the complete domain. Read the address from right to left, focusing on the actual hostname immediately before the first single slash after https://. A hostname such as chatgpt.example.com belongs to example.com, not to the service named in the subdomain. Look out for misspellings, extra words, swapped letters, hyphens, and lookalike characters. A familiar name elsewhere in the URL does not make the site genuine.
Compare it with a trusted route. Close the suspicious tab and type the service’s known official address yourself, or use an existing bookmark you created earlier. Check the address shown there and compare it with the link that raised concern. Don’t use a phone number, support link, or alternate login URL supplied by the questionable page. If you are unsure of the official address, reach it through a trusted app or a reliable source you already use.
Check how the link reached you. Unexpected messages claiming your account will be deleted, your subscription has a problem, or you have won a reward are common pressure tactics. Inspect the sender carefully, but remember that displayed names and addresses can be misleading or spoofed. Hover over a link on a computer to preview its destination; on a phone, press and hold only if you can do so without opening it. Don’t follow a link just because the message includes your name or other personal details.
Look for page and sign-in inconsistencies. Notice spelling errors, broken layouts, unusual pop-ups, unexpected requests to install software, or a page that asks for more information than a normal sign-in needs. These are warning signs, not a complete test: polished fake pages exist, and a familiar logo proves nothing. When signing in through a third-party identity provider, check that the browser address belongs to that provider before entering its password.
Understand what browser indicators can and cannot tell you. HTTPS and a padlock mean the connection to that site is encrypted; they do not confirm the site is the real service. A browser warning about a deceptive or unsafe page is a strong reason to leave. Don’t bypass the warning to continue. If your browser or security software flags a page, close it and reach the service through your trusted route instead.
Report and leave suspicious pages. Don’t reply, pay, or provide information to test the site. Report the message using the mail, messaging, or social platform’s phishing controls, and report the page through your browser or security software’s reporting option where available. Then close the tab. If you need help with an account, use support reached independently from the official site or app.
Act quickly if you entered information. From a trusted device and route, change the affected password immediately. If you reused it elsewhere, change it on those accounts too, using a different password for each. Review account sessions and security settings, sign out unfamiliar sessions if the option is available, and enable multifactor authentication. If you shared a one-time code, contact the account provider through its official support route promptly. If you submitted payment details, contact your card issuer or payment provider using the number or app you normally trust.

Common Mistakes

Trusting the logo or page design: Images and layouts can be copied. The domain and the route you used matter more.
Assuming HTTPS means “official”: Scam sites can use encrypted connections too.
Reading only the first part of a URL: A brand name in a subdomain or path can distract from a different registered domain.
Trusting a search ad or top result automatically: Search placement is not a guarantee of authenticity. Use a known bookmark or type the address yourself.
Sharing a verification code with someone who asks: Treat sign-in codes as private. Don’t send them to a person or enter them on a page reached through a suspicious link.

Tips

Save a bookmark only after independently confirming the address. Reuse that bookmark instead of following login links in messages.
Use a password manager where practical. It may not offer saved credentials on a different domain, which can be a useful warning, though it is not a definitive phishing detector.
Keep your browser and device security features up to date, and leave phishing and deceptive-site warnings enabled.
When a message creates urgency, stop and verify through a separate channel. A genuine account concern should still be visible when you reach the account directly.

Troubleshooting

The address looks unfamiliar, but the page seems normal: Don’t sign in. Close it and open the service using your trusted route. If the address still seems questionable, report it rather than trying to prove its legitimacy by submitting information.

You can’t tell which part of the URL is the domain: Copy the address without opening it and ask a trusted technical support person to inspect it, or navigate independently from a saved bookmark or trusted app. Avoid pasting a suspicious URL into random “link checker” sites, especially if it contains private tokens or account information.

Your browser says the site is unsafe: Leave the page and don’t choose an option to proceed. Update the browser and use the official route. If the warning appears on a known bookmark too, check that the bookmark is correct and consult the browser’s or service’s official help.

You already signed in or shared a code: Use a separate trusted device if possible. Change the password, secure any other account that reused it, review sessions, and enable multifactor authentication. Contact the provider through its independently verified support channel if you can’t sign in or notice changes you didn’t make.

You entered payment information or installed a download: Contact the payment provider promptly if financial details were shared. If you installed a file or extension, disconnect from the suspicious page, remove the unwanted item if you can do so safely, and run your device’s reputable security scan. Get help from trusted technical support if you’re unsure whether the device is safe.

Frequently Asked Questions

Can a ChatGPT phishing site have a padlock?
Yes. HTTPS encrypts the connection but does not establish that the site is genuine. Check the domain and use a trusted route.

Is a page safe if it appears at the top of search results?
Not necessarily. Search ranking or advertising placement is not proof of authenticity. Type a known address or use a confirmed bookmark instead.

What if I only opened the suspicious link?
Close it without entering details, downloading anything, or approving prompts. Opening a page alone does not mean your password was stolen, but avoid returning to it.

What should I do if I entered my password?
Change it immediately through the trusted official route. Change it anywhere else you reused it, review account sessions, and enable multifactor authentication.

Should I share a login code with support?
No. Don’t send one-time sign-in codes to someone who contacts you or asks through a suspicious page. Contact support independently if you need help.

How can I report a fake page?
Use the phishing-report option in the email, messaging, or social platform that delivered it, and the reporting tools in your browser or security software. Don’t revisit the page to gather more evidence.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →