Fake ChatGPT ads on Google: how to spot them

The golden rule No real website asks you to press Windows key + R, paste something or open “PowerShell” to prove you're human. If you see that, close it right away.

Trick 1: the fake ‘I’m not a robot’ check

Researchers at the security company Island found Google ads posing as ChatGPT. Clicking one led to a chatbot the scammers had built inside ChatGPT (a so-called custom GPT, a chatbot anyone can create). It looked official, but kept giving the same reply: it's too busy, go to a “backup address”.

That address showed a fake security check that looked real (one of those “confirm you're human” screens). It told Windows users to press the Windows key + R, paste something and press Enter. If you do, you install a hidden program yourself. It lets criminals control your computer remotely, as if they were sitting at your screen.

In three months (up to August 2026), the researchers counted about 850 paid ads in this campaign. They found 26 lookalike ChatGPT pages and 71 ad campaigns. How many people fell for it is not known.

Trick 2: the fake login window

The same researchers also found fake invitations to “advertise in ChatGPT”. They show a copied Google login window that steals your password. Behind them are fake AI ad tools for ChatGPT, Gemini, Claude and others, promising to optimise your campaigns, audit your ad spend or connect your accounts. They capture not only Google logins but also Meta, TikTok and Okta ones. Run ads for your own business? Be extra careful.

Is ChatGPT itself unsafe?

No, there is nothing wrong with ChatGPT itself. The scammers abuse ads and trusted brand names. A few habits keep you safe.

How to protect yourself

Remember the golden rule above: never paste anything into Windows to prove you're human.
Type the address yourself and bookmark it: chatgpt.com, gemini.google.com or claude.ai. Skip results marked “Sponsored”. Note: that first chatbot sits on the real ChatGPT site, so the right address alone is no guarantee. The real danger is being sent on to another site. If a chatbot sends you to a different address, don't follow it.
Only use the official app from the App Store or Play Store, and check the developer name.
Be wary of email invitations to “connect” your account. Go to the official site yourself instead of clicking the link.
Check your account. In ChatGPT on the web, Settings → Security and login → Security history shows recent sign-ins. See something odd? Change your password.

Already clicked or typed something?

Close the page and don't enter anything else.
Typed a password? Change it right away, ideally from another device.
Ran a command? Disconnect the computer from the internet and have it checked by someone you trust.
Shared bank details? Call your bank (in Belgium also Card Stop, 078 170 170) and report it to the police.
Got a suspicious email? In Belgium, forward it to suspicious@safeonweb.be. In the Netherlands, report it to the Fraudehelpdesk. Then delete it.

Keep going

Starting safely? Our sign-up guides show step by step how to create a real account with ChatGPT, Gemini, Copilot, Claude and Canva.

Free: the 2-day AI starter, with safe copy-and-paste prompts.

Sources

Checked on 17 October 2026. Features and prices change often: always check the official page. AI Wegwijs is independent and not affiliated with the companies mentioned.