# AI scams: how criminals use AI and how to protect yourself

> AI scams use the same old hooks, a stranger who wants a login, payment details or your trust, with better writing, fake personas and cloned voices. Good writing no longer separates a scam from a real message. Check the route instead: who started the contact, what it asks for, and whether the same request appears when you open the service yourself.

Mindket editors · Published 2026-11-06 · Updated 2026-11-06 · https://mindket.com/learn/spot-ai-fakes/ai-scams

## In short

- Judge a message by who started it and what it asks for, never by how well it is written.
- Go to the service yourself, by typing its address, and read your notices there.
- Treat cheap access to an AI service as bait: one reseller Anthropic found collected the logins of everyone who signed up.
- Bring in a second person before you pay, and ask for the family code word on any urgent call.

## Before you start

You need your phone and your email inbox. The exercise at the end has you review three accounts you already use. It takes about fifteen minutes.

## Five checks before you reply, pay or sign in

1. Ask who started it. A message you did not ask for, from a recruiter, a match, a bank or an AI service, earns the most doubt. A reply to something you began, on a site you opened yourself, earns the least.
2. Name what it wants. In the cases below it was a login, payment details or a long chat with a bot. Anything that ends in one of those needs the next check.
3. Leave the message and check at the source. Type the service's address or open its app, then look for the notice or the charge there. In the forum case below, a button in the email asked for payment details, and the sender was not an OpenAI address.
4. Slow down and add a second person. Urgency is what keeps you from checking, so a message that says "now" earns a pause. For a call, use the code word from [lesson 2](https://mindket.com/learn/spot-ai-fakes/spot-deepfakes).
5. Get apps and access from the vendor itself. SpiderLabs describes malicious iOS apps that were downloaded from the App Store, so a listing is a claim and not proof. The reseller in the table shows what a cheap offer can hide.

## Five scams that use AI or borrow its name

Each row below comes from a page that a security team, an AI company or a forum member published. We read those pages on 6 November 2026 and ran none of the cases ourselves.

The hooks are old: a job, a match, a bargain, a bill. In the first two cases below, AI does the work behind the hook: a model polishes a recruiter message and personas chat with thousands of people at once. In the last three, the scam trades on the name of an AI service you already trust, and the sources do not say AI wrote the scam itself.

| Kind | What the source reports | What helps |
| --- | --- | --- |
| A polished job offer | Anthropic's March 2025 report, published on 23 April 2025, says operators sent Claude poorly written non-native English and asked it to adjust the text, "effectively laundering their communications to appear more polished". The targets were job seekers primarily in Eastern European countries. Anthropic had not confirmed successful scams from the operation. | A flawless message says nothing about who sent it, so look the company up on its own site. |
| A dating match that is a bot | An app studio ran AI personas across a network of dating apps. The apps faked likes, visitors and pre-recorded video. Real people were paid to take the live video calls and follow-backs that the bots could not. | Do not count a video call as proof, because the network paid people to take them. Keep money and logins away from anyone you have only met in an app. |
| A cheap reseller of an AI model | Anthropic describes a fraudulent reseller offering cheap Claude access. It was neither cheap nor Claude. Traffic went silently to a different model, and the reseller's tooling harvested the Anthropic credentials of anyone who signed up. | A price far under the vendor's own is the first sign. |
| A fake AI app pushed by email | SpiderLabs reports phishing emails that impersonate ChatGPT and Gemini and push people to download malicious iOS apps from the App Store. Its headline says the aim is to steal Facebook credentials, and the apps are disguised as business or ads management tools. | Ask why an app named after a chatbot would need your Facebook login. |
| A billing notice | On 20 May 2025 a member of OpenAI's community forum posted an email saying their ChatGPT payment method was no longer working. It urged them to update payment details through a button, and the sender address did not match OpenAI's domains. | Compare the sender address with the domains the service uses. |

## One dating network, in numbers

The numbers come from the dating-app case in Anthropic's September 2026 threat report, which covers misuse from December 2025 to August 2026. Over two weeks in April 2026, a network the report labels GTG-15001 ran more than 4,700 AI personas, which engaged at least 25,000 people and exchanged about 2.36 million messages. In the match feed, roughly three personas appeared for each real person.

Behind it, Anthropic says, was a China-based app studio that used Claude to build over 20 dating apps and to power the personas. The studio also recruited real people, paid per message, video call and social media follow-back, to take the live video calls and follow-backs that the bots could not. Anthropic says they were there to convince users the app was authentic.

Anthropic banned the accounts, shared its findings with other AI labs, gave platform-specific indicators to Apple and Google, and listed indicators of compromise in the report. A warm, fluent reply, or even a video call, tells you nothing about whether you are talking to the person on the profile.

**One dating-app network, April 2026**

- **4,700** distinct AI personas on the network in a two-week window (Source: [Anthropic: Detecting and countering misuse of AI, September 2026](https://www.anthropic.com/threat-intelligence-report-september-2026), read 2026-11-06)
- **25,000** unique people the personas engaged, at least (Source: [Anthropic: Detecting and countering misuse of AI, September 2026](https://www.anthropic.com/threat-intelligence-report-september-2026), read 2026-11-06)
- **2.36M** messages exchanged in that window, about (Source: [Anthropic: Detecting and countering misuse of AI, September 2026](https://www.anthropic.com/threat-intelligence-report-september-2026), read 2026-11-06)

> The studio also recruited real people and mixed them into the same match feed as the bots.
>
> Anthropic, Threat report, [Anthropic: Detecting and countering misuse of AI, September 2026](https://www.anthropic.com/threat-intelligence-report-september-2026) (read 2026-11-06)

## A phishing campaign, as its finders described it

SpiderLabs [posted on X on 5 March 2026](https://x.com/SpiderLabs/status/2029557536488038488) about phishing emails that impersonate ChatGPT and Gemini. Its headline names Facebook credentials as the target, so the AI brand is only the bait.

The post is the only record we have of this campaign. X shows the first lines and folds the rest behind "Show more", which is where the screenshot stops.

> Phishing Emails Push Fake ChatGPT and Gemini iOS Apps To Steal Facebook Credentials
>
> SpiderLabs, [X](https://x.com/SpiderLabs/status/2029557536488038488) (read 2026-11-06)

[![SpiderLabs (@SpiderLabs) on X, 5 March 2026: Phishing Emails Push Fake ChatGPT and Gemini iOS Apps To Steal Facebook Credentials. Phishing emails impersonating ChatGPT and Gemini are pushing users to download malicious Apple iOS apps from the App Store. Disguised as business or ads management tools, these apps prompt, and the post continues behind Show more.](https://mindket.com/blog/shots/x-spiderlabs-fake-ai-apps.webp?v=bc7a47d45fde)](https://x.com/SpiderLabs/status/2029557536488038488)

SpiderLabs on X, 5 March 2026

> A screenshot of X's own embed of the post, taken on 6 November 2026, with the time in UTC. Select it to open the post on X.

## If you already clicked or paid

These steps are our advice and do not come from one source.

- Change the password on the real service, reached by typing its address, and on any other site that shared it.
- If you entered card details, call your card issuer on the number printed on the card.
- If you installed an app, delete it, then review which apps and devices can sign in to the account it asked for.
- Keep the message with its sender address, and report it to the service it pretended to be.

## Common mistakes

- Reading good English as proof of a real company. The recruitment case used a model to smooth out poor English.
- Pressing the button in a billing email to see whether the page looks real. Look at your own account instead.
- Trusting a profile because many people liked it. Fabricated likes were part of the dating case.
- Treating a video call as proof. In the dating case, paid people took the calls.
- Using one password for an AI service and for your email. A harvested login then opens both.

## Try it yourself

- Search your inbox for the last "payment failed" or "verify your account" message and run the five checks on it. Read the sender address one character at a time.
- List the AI apps on your phone and check each publisher's name against the vendor's own site.
- Ask one relative which AI services they pay for, and agree where each of you would check a billing notice.

## Next course: Prompt engineering for beginners

You can now check what reaches you. The [Prompt engineering course for beginners](https://mindket.com/learn/prompt-engineering/prompt-engineering-basics) covers the other half, how to ask an AI for what you want and get a clear answer.

## Check yourself

1. An email says your ChatGPT payment method has stopped working and offers a button to update it. What is the safest first move?

   A. Press the button to see whether the page looks real
   B. Reply and ask the sender to prove it is OpenAI
   C. Open your ChatGPT account yourself and look at billing there
   D. Forward it to a friend and ask what they think

   Answer: C. The button and the reply address are the parts you cannot trust. Your own account shows the real billing status, and in the forum case the sender address did not match OpenAI's domains.

2. What did Anthropic say about the recruitment-fraud operation in its March 2025 report?

   A. It had not confirmed successful scams from that operation
   B. It had confirmed thousands of victims
   C. It had found no use of Claude at all
   D. It had traced every message to one person

   Answer: A. The report says Anthropic had not confirmed successful instances of scams from this operation. It describes the polished messages and the targets, and names no losses.

3. Why was the reseller Anthropic describes dangerous for people who signed up?

   A. It charged more than the vendor
   B. It refused to take payment
   C. It ran slowly
   D. Its tooling harvested the credentials of anyone who signed up

   Answer: D. Anthropic reports that the reseller was neither cheap nor Claude, that traffic went silently to a different model and that its tooling harvested the credentials of everyone who signed up.

4. Why is an app's place in the App Store not proof that it is the real ChatGPT or Gemini app?

   A. The App Store only lists old apps
   B. SpiderLabs reports that malicious iOS apps pushed by phishing emails were downloaded from it
   C. Real apps are never sold there
   D. Only Android apps are checked

   Answer: B. SpiderLabs describes emails that push users to download malicious iOS apps from the App Store, so a listing shows where an app is distributed and not who made it.

## Frequently asked questions

### How do criminals use AI in scams?

The reports here show two uses of AI itself, messages polished by a model and personas that chat with users. They show two ways of borrowing its name, a fake AI reseller and phishing that impersonates an AI brand. Cloned voices are another use, covered in [lesson 2](https://mindket.com/learn/spot-ai-fakes/spot-deepfakes).

### Do the cases in this lesson show how much money people lost?

No. The pages we read explain how each scam works, and the dating case counts personas and people reached, but none gives a loss figure. Anthropic also says it has not confirmed successful scams in the recruitment operation. Treat the cases as patterns to recognize, not as a measure of how common AI scams are.

### Is an email asking me to update my ChatGPT payment details real?

Treat it as unverified until you have checked your account. The forum member who posted this example says the sender address did not match OpenAI's domains. Open your billing page yourself, because the email's own button is the one thing you cannot trust.

### How do I find the real app for an AI service?

Start from the vendor's own website, follow its download link into the store, and compare the publisher name on the listing with the vendor's company name. A search inside the store does not give you that check.

### Is the quality of the writing a clue?

Not any more. In the recruitment case the operators used an AI model to polish poor English, so fluent writing no longer separates a real recruiter from a scammer. Treat a clean message as neutral.

## Sources

- [Anthropic: Detecting and countering malicious uses of Claude, March 2025](https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025) (read 2026-11-06)
- [Anthropic: Detecting and countering misuse of AI, September 2026](https://www.anthropic.com/threat-intelligence-report-september-2026) (read 2026-11-06)
- [SpiderLabs on X, 5 March 2026](https://x.com/SpiderLabs/status/2029557536488038488) (read 2026-11-06)
- [OpenAI Developer Community: Scam alert, fake OpenAI subscription email requesting payment details](https://community.openai.com/t/scam-alert-fake-openai-subscription-email-requesting-payment-details/1266793) (read 2026-11-06)

[Start prompt engineering](https://mindket.com/learn/prompt-engineering/prompt-engineering-basics)