Phishing at chase.com: how to spot a fake Chase email or text
Quick answer
If an email or text that says it's from Chase asks you to click a link, confirm your login or fix a payment problem, treat it as phishing. Don't click. Open Chase from the app or a number on your card, and report the message at ReportFraud.ftc.gov.
- Pretends to be
- Chase
- Last updated
How it works
Scammers copy Chase's logo and tone and send an email or text about your account. The FTC lists the usual stories: suspicious activity or log-in attempts, a problem with your account or payment information, a request to confirm personal or financial details, or an invoice you don't recognize.
Every version ends the same way: a link or attachment. The link leads to a look-alike page that collects your username, password, card number or Social Security number. The FTC says scammers use that information to get into your email, bank and other accounts, or sell it to other scammers.
Chase is the company being impersonated here, not the sender. Real companies might email you, but the FTC says legitimate companies won't email or text a link to update your payment information.
Red flags
- A message about suspicious activity or a locked account that you weren't expecting
- A generic greeting instead of your name
- A link or attachment you're asked to open to confirm, update or verify something
- Pressure to act right now or lose access
- A request for a password, full card number or Social Security number
- A sender or link address that doesn't match the bank's real website
Example message
Chase alert: we noticed unusual sign-in activity on your account. To avoid a hold, verify your details now at [link]. If this wasn't you, call [phone number].
What to do
- 1
Don't click or reply
Don't open the link or attachment, and don't call the number in the message. Delete it after you report it.
- 2
Check your account the safe way
Open your bank's app or type the website address yourself. Or call the number on the back of your card. If there's a real problem, you'll see it there.
- 3
If you entered your login, change it now
Create a new, strong password on that account and anywhere you reused it, and turn on two-factor authentication. If you can't log in, call the bank using the number on your card.
- 4
If you gave card or Social Security numbers
Tell your bank or card issuer right away and ask them to stop or reverse any charges. Go to IdentityTheft.gov for a recovery plan based on what you gave up.
- 5
If you clicked or opened an attachment
Update your device's security software, run a scan and remove anything it flags.
- 6
Report it
Forward phishing emails to reportphishing@apwg.org and texts to 7726 (SPAM), then report to the FTC.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Scammers need your name, number and often your address before a message feels believable. They get them from people-search sites, data brokers and breach dumps, then buy or trade the lists. Serus finds the data brokers and people-search sites that list you and removes you from them, and it alerts you when your email or phone number shows up in a breach, so fewer scammers can reach you. Nothing stops every scam message, but a smaller public footprint means a smaller target list. See how data brokers get your data.
More Chase scams
Frequently asked
Does Chase send emails asking me to confirm my login?
The FTC says legitimate companies won't email or text a link to update your payment information. If you're unsure, contact the bank using a phone number or website you know is real, not the details in the message.
The message used Chase's logo. Doesn't that make it real?
No. The FTC's own phishing example uses a real company's logo in the header and is still fake. Logos are easy to copy.
What should I do if I already clicked the link?
Don't enter anything. If you did, change your password, turn on two-factor authentication, call your bank at the number on your card, and run a security scan. IdentityTheft.gov has steps based on what you shared.
Where do I report a fake Chase message?
Forward emails to reportphishing@apwg.org, forward texts to 7726 (SPAM), and report to the FTC at ReportFraud.ftc.gov.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
