Chrome's New AI Scam Detection: What It Does

Google is adding new scam detection to Chrome, built on its Gemini AI model. The aim is to catch deceptive websites earlier and to warn people before they run commands from a so-called ClickFix scam. These changes sit inside Chrome's Enhanced Protection setting, part of Safe Browsing, rather than being switched on for every Chrome user by default.

ClickFix is a tactic where a scam page tells you to copy a command and paste it into PowerShell or Command Prompt, often disguised as a fix for some fake error. Once you run it, the command does the damage, not the website itself. That's what makes it effective: you're doing the clicking, not the attacker.

What this actually means for you

Chrome's existing Safe Browsing already shows a full red warning page for sites it's confident are dangerous. The new addition is a 'suspicious site' warning that sits a level below that: for pages that show deceptive patterns but haven't yet met the bar for the full red warning. It's a middle ground, there to catch things that look wrong before they're proven dangerous.

On top of that, Chrome is moving from an on-device Gemini model to a more capable server-side one for Enhanced Protection users. This model looks at things like which brand a page is pretending to represent, what it seems to want you to do, and how that compares with known scam patterns, alongside domain reputation and other signals Chrome already checks.

For ClickFix specifically, Chrome can now notice when you copy a suspicious command from a webpage. It strips out anything that looks like personal information, sends the rest to Safe Browsing for analysis, and if it comes back flagged as dangerous, shows you a warning before you paste it anywhere. You still make the final call, but you make it with a warning in front of you instead of none.

Google says any page content sent off-device for this analysis is processed briefly and not stored, logged, or used to train its models, and that this only happens when a site already shows strong signs of being a scam. Most ordinary browsing shouldn't trigger it at all.

What to do

• If you use Chrome, open Settings, then Privacy and Security, then Safe Browsing, and check whether Enhanced Protection is switched on. These new features are built for that tier.
• Treat any webpage that asks you to open PowerShell or Command Prompt and paste something in as a warning sign in itself. Legitimate fixes for your computer almost never work this way.
• If Chrome shows you a 'suspicious site' warning, don't dismiss it just because it isn't the full red page. It's there because something about the site didn't look right.
• Keep Chrome updated. Features like this arrive in stages, so an outdated version may not have them yet.

What this does not fix

This is a browser feature, not a shield against everything. It doesn't protect you in other browsers, in apps, or over text messages and phone calls, where plenty of scams still happen. It relies on Chrome and Google's detection being right, and no detection system catches everything; some scam sites will still slip through, especially new ones. It also doesn't undo anything if you've already run a harmful command or handed over details before the warning appeared. It is not yet confirmed whether this is fully live for all Enhanced Protection users or still rolling out gradually, so don't assume it's already working for you.

If you've already pasted something into Command Prompt that you're now unsure about, or you've received a message pushing you toward a site like this, Veystrix's free scam checker at /tools/scam can look at the wording for you, and the URL checker at /tools/url can check a link before you open it. Neither replaces caution, but both can give you a second opinion when something feels off.