How to Turn On Chrome's AI Scam Protection and Spot the 'Paste This to Fix It' Trick
A web page that asks you to type a command is not fixing anything.
What happened
On October 21, Google added Gemini-powered scam checks to Chrome's Enhanced protection setting, according to BleepingComputer and other tech outlets. It is designed to flag scam pages such as fake antivirus alerts and fake browser updates, and to warn you before you paste a suspicious command.
That last part matters because of a trick security agencies and IT departments keep warning about, nicknamed ClickFix. A page claims something is broken or that you must 'verify you're human,' then tells you to press a few keys and paste in a line of text. That text is a command that installs the crook's software. You do the hacking for them.
No setting catches everything, but this one is free and takes two minutes. The rule that goes with it costs nothing at all.
What to do
- Open Chrome's settings. Click the three dots at the top right, then Settings, then Privacy and security, then Security.
- Choose Enhanced protection. It sends more information to Google to check pages, which is the trade-off; Google's own description is on that screen.
- Learn the one rule: no real website, company or 'security check' will ever ask you to copy and paste a command into your computer. If one does, close the tab.
- Know the other tells. Pop-ups that say your computer is infected, a fake 'update your browser' page, or a phone number to call for 'support.' Close the tab; if it won't close, restart the computer.
- Already pasted something? Disconnect from the internet, don't type any passwords, and get help from someone you trust or a reputable repair shop. Then change your important passwords from a different device.
The prompt
I saw this message on a web page and I'm not sure if it's real. Here is exactly what it says (I have not followed any instructions yet): [paste the text of the pop-up or page, without any personal details]. Tell me in plain English: Is this likely a scam? What are the warning signs? What should I do right now, step by step? If it asks me to paste or type a command, say so clearly.
Ask from your phone if you're worried about the computer, and don't paste anything personal.
Where it still needs a grown-up
- Enhanced protection shares more browsing data with Google to work. Read the description on the settings screen and decide if the trade is right for you.
- No browser setting catches every scam. The 'never paste a command' rule is the real protection.
- If you've lost money or given out banking details, call your bank right away and report it at ReportFraud.ftc.gov.
The verdict
Let the robot guard the door. Then don't open it for strangers anyway.