Detecting scams and phishing with ChatGPT

A second look before you click

Millions of people receive fraudulent emails, phishing messages, or offers that seem too good to be true every single day. The danger isn’t ignorance; it’s encountering one of these messages on a tired day, between meetings, when it looks convincing enough to be real. ChatGPT with web search gives you a second pair of eyes: it can analyze a message, check whether an address or website has been flagged, and deliver a reasoned opinion in seconds. This lesson shows you how to use it to verify the legitimacy of a suspicious message, site, or offer.

Red flags that should make you stop

Even before opening ChatGPT, you can spot certain clues with the naked eye. Artificial urgency is the most common: “Your account will be closed in 24 hours,” “Offer valid only today”—time pressure is designed to short-circuit your thinking. Spelling mistakes in a supposedly official email remain a tell, as does a sender address that mimics but doesn’t match the real one, such as [email protected] instead of the legitimate @amazon.fr domain. Hover over any shortened or masked link before clicking to see where it actually leads. Finally, two requests should trigger an immediate stop: any demand for sensitive information—password, card number, verification code—and any request to open an unexpected attachment, such as an unknown invoice or a document labeled “verify urgently.”

A warning is necessary here: modern phishing often contains no spelling errors. Campaigns are carefully written, mimic original branding, and sometimes include real details from your relationship with the impersonated company. A well-written message is not necessarily legitimate, and a single reassuring signal is never enough to draw a conclusion.

Have ChatGPT check it

For a suspicious email, copy its content—without clicking any links—and ask: “Here is an email I received. Can you analyze whether this is phishing or legitimate? Check the sender address, the tone of the message, and the links mentioned.” ChatGPT identifies red flags in the text and searches for whether the message matches documented phishing campaigns.

If you have doubts about a website, focus your query on its reputation and age: “Is the site [URL] legitimate? Search for reviews, scam reports, and check how long this domain has existed.” A domain created three weeks ago to sell products at half price often disqualifies itself.

When faced with an abnormally generous commercial offer, verify both the market price and the seller: “I saw an offer for [product] at [price] on [site]. Is this a normal price? Are there any scam reports linked to this site or offer?” And before sharing information with an unfamiliar company, ask: “Is the company [name] based in [location] legitimate? Search for reviews, its business registration number, legal notices, and any scam reports.” The absence of identifiable legal notices is an answer in itself.

Know exactly what you get in return. ChatGPT reads text: it analyzes the message you copied and searches for public information about the domain or company. It is not a security tool: it does not scan attachments like an antivirus and cannot detect malicious code hidden in a file. Never send it a link and ask it to open it; instead, describe the domain, and do not paste personal data contained in the message. A favorable opinion from ChatGPT does not authorize you to click an unexpected attachment—it replaces neither an antivirus nor a phone call to your bank to confirm they actually sent the message.

Where to report in France

Analysis is not enough: you must report fraudulent messages. Three public services or government partners are essential to know. Cybermalveillance.gouv.fr is the national assistance program for victims: it helps identify the attack and guides your response. Signal Spam collects reports of unwanted emails and phishing. 33700 gathers reports of unwanted SMS messages and calls. If you doubt a message from your bank, call them using a number you already know, never the one provided in the message.

Stay updated on techniques

Modus operandi evolve quickly, and knowing current trends is better than reacting case by case. AI scams, in the form of fake free tools that harvest your data, are multiplying; voice deepfakes mimic the voice of a relative or supervisor on the phone; fake crypto investments promise unrealistic returns; SMS phishing, or smishing, plays on pending packages and fines to pay; tech support scams display a fake security alert on your screen to trick you into calling a number. Regularly ask, “What are the most common scams in France right now?” This two-minute check keeps you informed so you don’t discover a technique only after falling victim to it.

Your turn

Calibrate the tool. Find a suspicious message in your inbox, copy its content into ChatGPT, and request an analysis, then compare it with your own assessment. Next, repeat the process with a perfectly legitimate message—a order confirmation, an authentic bank notification—to see if the distinction is made correctly.

This second test is the most instructive of the two. If the analysis flags a message you know is authentic as suspicious, you have just learned where the tool’s caution threshold lies, and you will know how to weigh its verdicts rather than treating them as final sentences. A second look has value only if you understand how it looks.

Official sources: Cybermalveillance.gouv.fr · Signal Spam · 33700 (reporting services) · Does ChatGPT tell the truth? (OpenAI Help Center)

Key takeaways

• ChatGPT provides a valuable second look at a suspicious email, site, or offer
• Copy suspicious content into ChatGPT without clicking links
• Classic red flags remain valid: urgency, spelling errors, suspicious addresses, requests for sensitive information
• Scams evolve: use web search to stay informed about new techniques
• ChatGPT complements but does not replace antivirus software and your own vigilance