1
Hype and novelty
New features appear weekly, so a "new model" or "early access" message does not seem odd.
How it showed up here"You have been selected for early access."
AI Tool Impersonation (Claude, ChatGPT & More)
This short course is required for everyone at Charitybuzz. It takes about ten minutes: a few focused lessons, a quick quiz, and a confirmation that goes on your training record. Everything in it comes from the kinds of messages and requests our team is actually receiving, so what you learn here is what you will use at work.
What this covers How attackers pose as Anthropic (Claude), OpenAI (ChatGPT), Microsoft Copilot and other AI tools to steal accounts, keys and company data.
What this is about
AI tools are now part of daily work, which makes them a new favorite disguise. Scammers send fake messages "from" Anthropic, OpenAI, Google or Microsoft about billing problems, suspended accounts, usage limits, security incidents or brand-new features — all with a link to a copy of the sign-in page.
There is a second risk beyond fake emails: fake AI apps and browser extensions that promise a free or "pro" version and quietly steal what you type, and the habit of pasting company or partner data into tools we have not approved. This module covers both.
Take the message apart
A fake AI billing notice aimed at the person who manages the company's AI workspace. Click every detail that should make you stop. There are 7.
0 of 7 red flags found Click anything in this message that looks suspicious.
Action required: your Team workspace will be suspended
Dear Customer,
We were unable to process the latest payment for your organization's workspace. Access for all members will be suspended in 12 hours and all projects and chat history will be permanently deleted.
Update Payment Method
To speed up verification, paste your organization API key into the form.
Billing Team
Link goes to:—
Click anything in this message that looks suspicious.
Spot the signs
Quick check: for each item, decide whether it is a red flag or looks fine. Real addresses: Claude is at claude.ai (company site anthropic.com), ChatGPT at chatgpt.com (company site openai.com).
0 of 6 answered
https://claude.ai/This is the real Claude address. Typing it yourself is the safest way to reach it.
https://claude-ai-login.com/billingA look-alike with extra words. The real owner of this address is claude-ai-login.com, which is not Anthropic.
https://anthropic.billing-support.net/update-paymentThe real owner is billing-support.net. "anthropic" is just a name added in front.
An email: "Your AI subscription is suspended. Update your card within 24 hours or lose all conversations"Threats to delete your data and a short deadline are pressure tactics. Check billing by going to the tool yourself.
A browser extension that promises "free unlimited AI" and asks to read and change all your data on all sitesAn extension with access to every site can read your email and files. "Free pro" offers are a common lure.
Opening the AI tool your company approved by typing its address yourselfGoing to a tool yourself is always safer than following a message.
Why this works on smart people
2
Real money and real work
People pay for these tools and rely on them, so a billing alert feels urgent.
How it showed up here"Payment failed. Account paused."
3
Keys are valuable
API keys and logins can be sold or used to run up bills and reach company data.
How it showed up here"Your API key was exposed. Click to rotate."
4
Unfamiliar territory
Because the tools are new, we are less sure what normal looks like.
How it showed up hereA convincing "usage policy update".
How this lands at Charitybuzz
Here is how AI-related risks show up at a company like Charitybuzz:
Everyone using AI tools
The billing or suspension notice
An email says your Claude, ChatGPT or Copilot account has a payment problem or has been suspended and asks you to sign in or update a card.
The tell
The sign-in page is not on the tool's real address, and the deadline is short.The right move
Do not click. Open the tool yourself by typing its address, check billing there, and report the email.Engineering & IT
The "exposed API key" alert
A message claims your API key has leaked or will be deleted unless you sign in and rotate it through a link.
The tell
Real providers show key alerts inside your console, and do not ask for your login through email links.The right move
Open the provider's console yourself and check keys there. Never paste keys into pages reached from a message.Everyone
Pasting company or partner data into unapproved tools
Someone pastes a bidder list, donor details, consignment contracts or login details into a free AI tool or extension to "save time".
The tell
Free or unfamiliar tools may store or share what you give them.The right move
Use only the AI tools approved for Charitybuzz work, and never paste personal data, bank details or credentials. Ask John if unsure.Red flags to watch for
A sign-in page not on the tool's real address
Hyphens and extra words such as "login" and "billing" are common in fake addresses.
Billing threats and short deadlines
Real billing issues can be seen inside your account.
Claims your API key leaked
Check the provider's console yourself.
"Early access", "free pro", or "unlimited"
Used to entice you to install or sign in.
Extensions that want access to all your data
They can read everything you see in the browser.
Asking for your password or code
No real provider does so by message.
Unknown AI apps asking for your Google login
Granting access can expose your email and files.
Pasting sensitive data into a tool
If you would not email it to a stranger, do not paste it into an unapproved tool.
Safe use of AI tools
- Open the tool by typing its address
- Use only company-approved tools for work data
- Check billing and keys inside your account
- Install extensions only if IT approves
- Keep personal and financial data out of prompts
Risky or fake
- Reach the tool through a message link
- Use a free "pro" app from an unknown source
- Follow a "your key leaked" link
- Install extensions that read all sites
- Paste partner or donor data into unapproved tools
What to do instead
Go to the tool yourself
Type claude.ai, chatgpt.com or the tool's own address, and look at billing or notices there.
Check API keys in the console
Never follow a message link to "rotate" a key.
Use approved tools for company data
If you are not sure a tool is approved, ask John before pasting anything.
Install only what IT approves
Browser extensions and desktop apps with broad access need a check first.
Report it
Use Gmail's Report phishing and tell John.
If you clicked — or entered something
Signed in on a fake AI page? Change that password and any shared password
Also turn on two-step verification for the tool, and sign out of other sessions.
Pasted company data or a key into an unapproved tool? Tell John
If a key was shared, it should be revoked and replaced. Do it quickly.
Report it — even if you think you got away with it
In Gmail, open the message, click the ⋮ menu and choose Report phishing. Then email [email protected] with a one-line summary of what you did (clicked, opened a file, typed a password, approved a prompt). Fast reports let IT block the sender for everyone.
Typed your password? Change it now
From a device you trust, go to myaccount.google.com by typing it yourself, change your password, and review Security → Your devices. If you reuse that password anywhere else, change it there too.
Approved a sign-in prompt or read out a code? Call IT immediately
This is the most urgent case: the attacker may already be in your account. Contact Charitybuzz IT ([email protected]) right away so they can end every session and reset access.
Opened an attachment or installed something? Stop and tell IT
Don't keep working on that device and don't try to "clean it up" yourself. Leave it on, disconnect it from Wi‑Fi if you can, and contact IT.
Key takeaways
- Reach AI tools by typing their address, never through a message.
- Billing threats and "your key leaked" alerts are common lures. Check inside the tool yourself.
- Do not install AI extensions or apps IT has not approved.
- Keep partner, donor, bank and login details out of AI prompts unless the tool is approved for it.
- If unsure, ask John before you click, install or paste.
Knowledge check
Confirm your training record
This creates the completion record Charitybuzz keeps for compliance. Please use your work details.
Training complete
Your completion has been recorded. Thank you for helping keep Charitybuzz, our nonprofit partners, and our bidders safe.
Certificate ID: —
View & print certificateKeep this handy
- Reach AI tools by typing their address, never through a message.
- Billing threats and "your key leaked" alerts are common lures. Check inside the tool yourself.
- Do not install AI extensions or apps IT has not approved.
- Keep partner, donor, bank and login details out of AI prompts unless the tool is approved for it.
- If unsure, ask John before you click, install or paste.