Chase Credit Journey scam emails: how to tell a fake alert from a real one
Quick answer
Credit Journey is a real Chase feature, so scammers copy its alerts. An email that says your data was found on the dark web or in a breach and asks you to click and sign in may be fake. Don't use its link. Open the Chase app yourself, and forward the email to phishing@chase.com.
- Pretends to be
- Chase
- Last updated
How it works
Chase Credit Journey is a real service. Chase says that if you're enrolled you can get alerts when your personal information is found on the dark web or in a known data breach. That's what makes the fake version work: the email looks like something you might expect.
The fake alert tells you your information was exposed and asks you to click through to "review" or "secure" your account. The link leads to a page made to look like Chase's login, which collects your username, password and codes. Scammers then log in as you.
Chase tells customers not to click links or attachments in suspicious emails, to go to the organization's website directly if unsure, and to forward suspicious emails that claim to be from Chase to phishing@chase.com. Chase is the company being impersonated here, not the scammer.
Red flags
- An alert you didn't expect, or that you never enrolled in Credit Journey for
- A link that asks you to sign in, confirm your Social Security number or enter a code
- A sender or link address that isn't chase.com
- A threat that your data was found and you must act now
- A text or call that asks for the one-time code Chase sent you
Example message
Chase Credit Journey alert: your personal information was found online. Sign in now to review and protect your accounts: [link]
What to do
- 1
Don't click, reply or call back
Don't click anything in the message. Open the Chase app or type chase.com yourself and check for alerts there. Forward the email to phishing@chase.com, then delete it.
- 2
If you clicked or typed in details, act on those accounts
Sign in to Chase from the app and change your password. Never give a one-time code to a caller. If you shared card details, call the number on the back of your card.
- 3
If you paid or shared card details, call your card issuer
Use the number on the back of your card, not one from the message. Say it was fraud and ask them to block the card and reverse the charge.
- 4
Delete it and report it
Report the message at the official channels below, then delete it. Reports help investigators spot patterns.
- 5
Check where your details are listed
A real alert or a fake one is a reason to see where your email and phone number are exposed, and to freeze your credit if your Social Security number was involved.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
If your email is on a breach list or a people-search site, scammers can aim breach-themed messages at you. Scammers often pick targets using names, phone numbers and emails pulled from people-search sites and old breaches. Serus finds the data brokers that list you and removes you from them, and it alerts you when your email shows up in a breach, so fewer scammers can reach you. Our guide to what to do after a data breach covers the steps if your details leaked.
More Chase scams
Frequently asked
Is Chase Credit Journey real?
Yes. Chase says enrolled customers can get alerts about dark web exposure and data breaches. Scam emails copy that kind of alert.
How do I check an alert is real?
Don't use the email's link. Open the Chase app or type chase.com and look for the alert there.
Where do I forward a suspicious Chase email?
Chase says to forward it to phishing@chase.com.
Is Chase the scammer?
No. Scammers pretend to be Chase. Chase warns customers about these emails.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
