Chrome Scam Protection ⚡ Turn on Enhanced Protection
Enable Chrome Enhanced Protection for Chrome scam protection: get suspicious website warnings, ClickFix attack protection, and stronger Safe Browsing. Learn how.
Chrome's New Scam Defenses: What They Do and How to Turn Them On
A website can look legitimate and still be a trap. It might borrow a familiar brand, claim your computer is infected, or push you to paste a command to fix a problem that doesn't exist. Chrome has long warned users about websites Google flags as dangerous. Now it's adding more defenses: warnings for sites that look suspicious, better detection for fake tech-support and update scams, and protection against a social engineering trick called ClickFix.
These changes are helpful - but they're not a reason to treat every warning as proof of an attack or every page without a warning as safe. They also rely on Chrome's strongest Safe Browsing setting, Enhanced Protection, which comes with a different privacy trade-off than standard protection. Here's what the warnings mean, how the new detection works, what Enhanced Protection shares with Google (according to the company), and how to enable it on Chrome and your Google Account.
What Chrome's new website warnings mean
Chrome is adding a clearer split between websites it considers dangerous and those it considers suspicious. The difference matters because "a concern" isn't always the same thing as "this site is malicious."
A dangerous-site warning is Chrome's stronger intervention. It means the page is known (or assessed) to pose a serious risk, and Chrome strongly recommends leaving. A suspicious-site warning is more cautious. Chrome has spotted patterns associated with deceptive or misleading sites, but it allows you to continue if you believe the page is legitimate.
The alerts also look different. Google says the formats, icons, colors, and wording are meant to help you tell the two apart. In the update, the dangerous-site screen is red and more forceful, while the suspicious alert is less severe. The suspicious warning may also explain what triggered the concern and include a "Learn more" link.
Why a site might be marked suspicious
Google says Chrome compares sites against patterns found on deceptive or misleading pages. Google's Gemini model can also help assess signals like the page's content, what brand it seems to represent, the site's apparent intent, and the domain's reputation. Those signals feed into a scam-likelihood assessment - not a public guarantee that any specific site is fake.
And in real life, context matters. A newly created business site, a small organization's donation page, or a legitimate service with unusual wording can look "off" compared with the more polished sites you're used to. A warning should make you pause and verify - not assume the site is safe just because you recognize the logo, and not assume it's malicious just because it looks unusual.
If Chrome warns you, the lowest-risk move is to close the tab or use the option to return to safety. If you still need the page, verify it independently. For example, use a bookmark you already trust or type the organization's known web address yourself. Don't treat a link in a suspicious email - or a phone number shown on the page - as proof the page is genuine.
Google also says the new warning type lets Chrome protect users against a wider set of suspicious patterns without treating every uncertain case as confirmed dangerous. In other words, the browser is trying to communicate the level of concern, not label everything the same way. You can read Google's guidance on Safe Browsing in Chrome.
How Chrome detects more scams
This update also expands scam detection beyond the classic phishing pages. Google says its AI-assisted detection can spot more types of tech-support scams, fake antivirus alerts, and fake browser update pages.
A lot of these scams lean on urgency more than technical sophistication. The page may claim your device is infected, say your browser is out of date, or insist you call support right away. The goal is usually to sell unnecessary software, get you to install a tool, or convince you to hand over remote access. The "scan result" can look convincing, but the claim is coming from the website - not from a verified scan of your device.
Google says a server-side Gemini model can analyze page content, domain reputation, and other signals to reach a conclusion. The point is to recognize patterns that don't show up in a simple list of known bad addresses. That matters because scam pages can change quickly - faster than static blocklists.
What Google says about privacy
A security feature that analyzes web pages naturally raises the question: what data leaves your device? Google says it minimizes what it sends to its backend and only sends it when a page triggers high-level signals tied to scams. Google also says the page content submitted for this analysis isn't logged, retained, or used to train its AI models.
That said, "Google says" isn't the same as "no privacy impact." Enhanced Protection is meant to be stronger and more proactive, which can mean more data being shared with Google than standard Safe Browsing. If you're using a work device - or you have strict privacy requirements - check your organization's policies before changing settings. The right configuration depends on the sensitivity of the device and the risks you're trying to manage.
If you want a practical rule: use the stronger setting on personal devices when reducing exposure to phishing and scams is a priority, and make a deliberate policy choice for managed devices. Don't turn it on everywhere by default just because it's "more secure."
How Chrome responds to ClickFix attacks
ClickFix is a social engineering approach that aims to get you to run a malicious command yourself. A page may show a fake error or claim a routine security check failed, then tell you to copy and paste a command into a system tool. The scam works because you - on your own device - carry out the steps that trigger the attack.
ClickFix is different from a more familiar malicious download. The victim may never be asked to install an obvious file. Instead, it relies on instructions that look like they fix a problem. And because the action is "user-driven," it can be harder for traditional browser defenses to catch before the command is run.
Google says Chrome can now detect suspicious commands copied in these situations. After you copy the command - but before you get a chance to paste it - Chrome checks clipboard activity. It may clear personal data from the clipboard, then analyze what was copied. If the content looks dangerous, Chrome shows a warning.
What to do if a page asks you to paste a command
If a website tells you to paste something into a terminal, command prompt, PowerShell, or another system utility, treat it as a serious warning sign. A legitimate site shouldn't require an unfamiliar command to prove you're human, update Chrome, remove a virus, or restore account access.
If Chrome warns you, don't follow the instructions. Close the page and avoid calling any number or downloading tools the site recommends. If you already pasted or ran the command and you think the device may be compromised, disconnect from the network, avoid entering passwords on the device, and contact your organization's IT team (or a trusted security professional). On a personal device, use reputable security software and change important passwords from a separate, trusted device if you suspect credentials were exposed.
Chrome's clipboard check is a helpful extra control, not permission to follow suspicious instructions until the browser stops you. Social engineering is built to create pressure and make you act quickly. Often, the best move is a short pause - especially if you don't understand what the command does.
How to enable Enhanced Protection
Google says these new defenses require Enhanced Protection, the strongest Safe Browsing option in Chrome. The wording may vary slightly depending on the device or Chrome version, but the setting should be in Chrome's privacy and security controls.
On desktop
- Open Chrome and select the three-dot menu.
- Choose Settings.
- Select Privacy and security.
- Open Security.
- Under Safe Browsing, choose Enhanced protection.
On Android or iPhone
- Open the Chrome app and open its menu.
- Go to Settings.
- Tap Privacy and security.
- Select Safe Browsing.
- Choose Enhanced protection.
The exact wording and menu placement can differ across operating systems and Chrome releases. If you can't find the option, update Chrome and check the current Safe Browsing settings in the app. Also, features can take time to roll out across accounts and devices - so a missing warning or control doesn't automatically mean something is wrong.
Enable Enhanced Safe Browsing for your Google Account
Google also recommends enabling Enhanced Safe Browsing for your Google Account. Sign in on the web, open Security & sign-in, find Enhanced Safe Browsing, and turn it on. You can start at the Google Account security settings.
Keep in mind: Chrome's browser setting and the account-level setting are separate controls. Turning on one doesn't guarantee the other is enabled. If you want both layers, check each setting directly. For work or school accounts, an administrator may control some options.
Before you change anything, think about the trade-off for your situation. Enhanced Protection is intended to deliver stronger, more proactive defenses, while standard protection may share less information for security checks. Google's Safe Browsing information has more context on the service. If you're responsible for a team, document what setting you chose and explain what users should do when they encounter a warning.
What the protection can - and cannot - do
This update targets real gaps: sites can look suspicious before they're confirmed dangerous, fake tech-support pages can imitate system alerts, and ClickFix tries to exploit the user instead of relying only on a malicious download. The extra checks can make those tactics harder to pull off unnoticed.
But browser warnings aren't a complete security plan. They can't guarantee every new scam will be caught, and the absence of a warning doesn't mean a page is trustworthy. Scams evolve: attackers change domains, wording, and techniques. Legitimate sites can also be compromised, and misleading pages can slip through at first.
Use Chrome's warning as one input, then fall back on basics:
- Check the full domain. Look for misspellings, extra words, and unexpected domain endings. A padlock/HTTPS protects the connection, but it doesn't prove the site is honest.
- Avoid links in unexpected messages. Open trusted sites using a saved bookmark or an address you type yourself.
- Don't install software from a pop-up. Use Chrome's built-in update options for browser updates and get apps from the official app store or the vendor's site.
- Never grant remote access because a page says you're infected. Contact the company through a known, independently verified channel.
- Keep your browser and operating system updated. Warnings work alongside patches; they don't replace them.
For businesses, the same logic applies on a larger scale. A warning can reduce the chance that one employee follows a malicious page, but it won't replace endpoint protection, good access controls, backups, and incident-response procedures. Decide who should handle reports, and make it easy for staff to ask whether an unusual instruction is legit. If a defense depends on everyone making the perfect judgment under pressure, it's not much of a defense.
Conclusion
Chrome's updated scam defenses are designed to tackle several different problems: suspicious websites, fake antivirus or browser-update pages, and ClickFix instructions that try to get you to run commands yourself. Enhanced Protection is the Safe Browsing setting Google says you need for these defenses, and there's an additional account-level option available separately.
Turn it on if it matches your privacy needs and how you manage devices. Then keep the real rule in mind: a browser warning deserves attention, but the absence of one isn't proof that a site is safe. Check the destination, verify urgent requests independently, and never run a command you don't understand just because a page claims it will fix something. For the original reporting and feature details, see ZDNET's coverage of Chrome's scam protection.