Direct answer: A fake AI app or chatbot scam copies the look of a popular tool and then steals a login, installs malware, or talks you into sending money. Download apps only from the official Apple App Store or Google Play Store. Do not type passwords, bank numbers, or Medicare numbers into a chat that appeared in a text, an ad, or an unknown website.
The software itself is not the whole problem. The problem is a look-alike that borrows a famous name and then asks you to hurry.
Why these scams are getting harder to spot
On December 3, 2024, IC3 warned that criminals use AI-generated text to write messages that look believable. The same alert said criminals embed AI-powered chatbots in fraudulent websites to prompt people to click malicious links. They also create fake social media profiles and images so a stranger can look like a real company or a real person.
The FBI San Francisco Field Office made a similar point on May 8, 2024. AI-driven phishing can now use proper grammar and spelling and can tailor a message to a specific person. CISA, the Cybersecurity and Infrastructure Security Agency, says the same thing in its phishing guidance. Poor spelling used to be a common clue. With AI, some emails will have perfect grammar, so you have to look at other signs.
Those other signs still show up. CISA says to watch for urgent or emotionally charged language, requests for personal or financial information, shortened links you do not trust, and email addresses or web addresses that are slightly wrong.
If you want a basic tour of a real chatbot before you download anything, read ChatGPT for seniors. That guide is about using an official tool carefully. This page is about avoiding a copy that was built to hurt you.
How to check an AI app before you install it
On March 31, 2026, IC3 published a public service announcement on data security risks of mobile apps (alert I-033126-PSA). One of its practical tips is to download verified apps from official app stores. IC3 also warns that unofficial third-party app stores can carry a higher malware risk. It tells users to keep software updated, read terms before they agree, disable data sharing they do not need, and report problems to IC3.
Use this store checklist:
- Search the official store on your phone, not a link that arrived by text or email.
- Confirm the developer name matches the real company, not a close spelling.
- Read recent reviews for complaints about charges, logins that failed, or leftover accounts after deletion.
- Look at the permission list. A writing tool that wants your contacts, microphone, and location for no clear reason is a bad sign.
- If a family member already uses the real app, ask them to look at the listing with you.
CISA’s phishing advice applies to download messages too. If a note says your account will be closed unless you install an update right now, do not click the link. Open the official store yourself or type the company’s address if you already know it.
Paid “pro” upgrades should also stay inside the official app. A text that offers ChatGPT, Copilot, or another famous tool at a bargain price, then sends you to a payment page, is a common trick.
How website chatbots get used in scams
A chat window on a website can be useful when you already trust the site. It can also be a trap. IC3 says criminals put AI-powered chatbots on fraudulent websites and use them to push malicious links.
Be wary when a chat does any of the following:
- Pops up after you click an ad and immediately asks you to log in.
- Claims it can open your Medicare, Social Security, or bank account for you.
- Offers a refund, a prize, or a lower premium if you share a card number in the window.
- Sends you to a shortened link to “verify” who you are.
- Gets impatient or threatening if you say you want to call the company instead.
Medicare.gov tells people to protect their Medicare number and other personal information and to check claims regularly. It also says not to give your Medicare number or Social Security number to anyone except your doctor or people you know should have them. A chatbot on a random site is not on that list.
If the chat is about a health question, keep identifiers out of it and verify answers with your clinician. Using AI to prepare for a doctor visit explains how to do that without pasting private records.
What never to type into an unknown app or chat
Keep these items out of any tool you do not already trust, and keep them out of most chatbots even when you do trust the brand:
- Social Security, Medicare, or bank account numbers.
- Passwords, one-time passcodes, or remote-access PINs.
- A photo of your driver’s license or insurance card.
- A credit card number typed into a chat window.
- Private medical files you would not put on a postcard.
IC3’s December 2024 alert also reminds people not to send money, gift cards, or cryptocurrency to someone they have met only online or over the phone. That rule covers a chatbot that claims to be a relative, a tech-support agent, or an investment adviser.
Voice cloning often travels with these schemes. If a chat turns into a call that sounds like family and asks for money, hang up and use the steps in how to spot an AI voice-clone scam.
What to do if you already downloaded the wrong app
You can still reduce the damage.
- Delete the app from your phone.
- Change the passwords for any account you opened inside that app, and change your email password if you used the same one.
- Call your bank or card issuer if you entered a payment method.
- Check recent charges and, if you use Medicare, review claims through a secure Medicare.gov account or your plan statements.
- File reports at ic3.gov and ReportFraud.ftc.gov.
IC3 asks victims of financial fraud to include names, phone numbers, email addresses, payment dates and amounts, and a short description of how contact started. You do not need every detail to file.
CISA’s last step for a suspicious message is simple: delete it. Do not reply. Do not click an unsubscribe link inside a message you already distrust.
I built this site after watching my grandmother stretch SNAP and Medicare until she passed at 87. She was careful with any form that asked for numbers, and a look-alike app would have been stressful for her. I want families to treat a download the same way she treated a suspicious letter.
Frequently asked questions
How can I tell a real AI app from a copy?
Open the official app store on your phone and search there, rather than following a texted link. Check that the developer name matches the real company. If the listing is slightly misspelled, has almost no reviews, or asks for odd permissions, stop and ask a family member to look with you. IC3 recommends downloading verified apps from official stores and avoiding unofficial third-party stores.
Is a chatbot on a company’s website always safe?
No. A chat window does not prove the site is real. IC3 says criminals embed AI-powered chatbots in fraudulent websites to push malicious links. If you did not type the company’s address yourself, treat login or payment requests in that chat as unsafe. Call the number on a statement or official site instead.
What if an email about an AI tool has perfect spelling?
That no longer proves the note is honest. CISA says AI can produce messages with perfect grammar, so you should look for urgency, requests for personal or financial information, strange links, and slightly wrong addresses. If you think the note might be real, do not click. Look up the company another way.
Can I pay for an AI upgrade through a link in a text?
You should not. Stay inside the official app or the company’s website, and type the address yourself if you already know it. Bargain “pro” offers that arrive by text are a common way to steal card numbers or logins. If a charge appears that you do not recognize, call your card issuer and report the incident.
Where do I report a fake AI app or chatbot?
File a complaint with the FBI Internet Crime Complaint Center at ic3.gov and with the Federal Trade Commission at ReportFraud.ftc.gov. If a Medicare number may have been exposed, call 1-800-MEDICARE (1-800-633-4227) as well. Keep notes on dates, names, and any payments you made.
Your next step
Before you install a new AI app this week, search for it inside the official store and confirm the developer name with a family member. If you also want a callback plan for phone scams, continue with how to spot an AI voice-clone scam.
Sources
- FBI Internet Crime Complaint Center: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (I-120324-PSA, December 3, 2024).
- FBI Internet Crime Complaint Center: Data Security Risks of Using Foreign-Developed Mobile Apps (I-033126-PSA, March 31, 2026).
- FBI San Francisco Field Office: FBI Warns of Increasing Threat of Cyber Criminals Utilizing Artificial Intelligence (May 8, 2024).
- CISA: Recognize and Report Phishing.
- Medicare.gov: Reporting Medicare fraud and abuse.
- Federal Trade Commission: ReportFraud.ftc.gov.