Online Safety
How to Spot a Suspicious AI Email
As more of us sign up for AI services, scammers have noticed. Emails claiming to be from ChatGPT, Microsoft, Apple or your bank are increasingly common — and increasingly convincing.
None of this is cause for alarm. A handful of simple habits will keep you extremely safe.
The pattern they all follow
Most scam emails use the same basic trick: create urgency, then ask you to click something. Typically it's one of these:
- "Your account will be suspended unless you verify your details."
- "Unusual sign-in detected. Confirm it was you."
- "You've been charged £[some amount]. Click here to dispute it."
- "Your subscription has expired. Renew now to keep access."
- "You've been selected for a free upgrade."
Check the sender address, not the name
An email can say "ChatGPT Support" in the name field while the actual address is something entirely unrelated.
On most phones and email programs you can tap or hover the sender name to see the real address. Look at the part after the @ symbol.
Even a familiar-looking address isn't proof. Addresses can be imitated closely — a letter added, a hyphen moved, a different ending. Treat the address as one clue among several, not a guarantee.
Rule of thumb: a legitimate tech company will never email you a link asking you to log in "urgently". They'll tell you to open their app or visit their website yourself.
Don't click — go there yourself
If an email claims your ChatGPT account needs attention, don't use its link. Open chatgpt.com in a fresh browser tab, or open the official app, and log in there.
If everything's fine when you do that, the email was nonsense and can be deleted.
- 1Close the email without clicking anything.
- 2Open a new tab in your browser.
- 3Type the official address yourself — or use a bookmark you made earlier.
- 4Log in and look at your account.
- 5If there's a real problem, it'll be there too. If it isn't, the email was fake.
Never send passwords or codes by email
No legitimate company will email asking for your password or for a verification code that's just been texted to your phone.
That code exists precisely so nobody else can log in as you. If someone gets it, they can. Don't share it with anyone, even on the phone, even if they sound official.
Something new: AI-written scams
Scam emails have become noticeably better written — fewer spelling mistakes, better grammar. That's because AI is being used to write them.
It means "it reads well, so it must be genuine" is no longer a safe rule. Judge an email by what it's asking you to do, not how nicely it's written.
If you've clicked something
Try not to panic. Clicking a link doesn't automatically do any harm.
- Don't enter anything on the website it took you to.
- Close the tab.
- If you did enter details or a password, change that password straight away.
- If it was a banking matter, call your bank using the number on your card or statement — not the number in the email.
- Delete the email. You can report it using your email provider's spam or phishing button.
A quick summary
- Urgency is the main warning sign.
- Check the real sender address.
- Never log in via a link in an email — open the official site yourself.
- Never share passwords or codes.
- When in doubt, delete and check the official website.
In short
Calm, unhurried checking beats fast clicking. If an email is rushing you, that's the reason to slow down.
Ready for the next one?
Have a browse through the Learning Library — there's no exam at the end, promise.
Back to the Learning Library