Chrome Flags Scam Sites in Real Time, but There Is a Catch

Two tiers of warnings and a clipboard wipe

Instead of waiting for static blocklists to update, Chrome now scores suspicious pages dynamically.

Online social-engineering schemes have shifted away from crude phishing forms toward active manipulation. The most prevalent campaigns trick users into running rogue scripts under the guise of fake antivirus alerts or bogus browser updates. Chrome's update targets these direct-manipulation tactics by assigning sites a dynamic fraud likelihood score.

When you land on a borderline domain, Chrome deploys an overlay warning stating that the site does not seem right, allowing you to proceed or dismiss it if you trust the destination. Confirmed malicious domains receive Google's traditional, severe full-page red screen, actively discouraging any further interaction.

The most aggressive measure targets ClickFix social-engineering attacks, where fraudulent prompts instruct visitors to copy command-line snippets to solve a supposed error. If Chrome detects this behavior on a shady site, it actively clears the system clipboard and fires an alert, preventing users from accidentally pasting payload scripts into their local terminal or Run dialog.

The privacy tradeoff behind Chrome scam site warnings

These automated interventions do not run locally on Chrome's standard setup. To take advantage of them, users have to manually switch on Enhanced Protection within Chrome's privacy and security settings.

Standard Safe Browsing checks downloaded lists on your device to preserve anonymity, but real-time scoring of zero-day scam pages requires sending visited URLs and situational telemetry back to Google's infrastructure. While tech teams have wrestled with whether telemetry bloat is draining AI budgets on enterprise infrastructure, consumer web users face their own constant calculation over how much continuous browsing data to share in exchange for a safety net.

Availability and how to enable it

The new scam detection tools are rolling out globally to desktop users across the US, UK, and Europe. Because the feature is tied directly to Chrome's account security tier, there is no separate fee or platform restriction.

To enable the protections, navigate to Settings > Privacy and security > Security inside Chrome, and select Enhanced Protection. If left on Standard Protection, the browser will continue using traditional list-based threat detection without the new clipboard wipes or predictive scam overlays.