Chase Bank phishing email scam: how to spot fake fraud alerts in 2026

Q: How do I report a Chase phishing email so the page gets taken down?

Forward the email with full headers preserved to phishing@chase.com. Chase's security team files takedown requests with hosting providers and registrars. Also file at ic3.gov (FBI) and reportfraud.ftc.gov (FTC). All three reports together take under ten minutes and feed the federal takedown apparatus.

Quick answer

The "Chase fraud alert" email is a phishing lure that uses urgent language ("Suspicious login from Chicago", "Your card has been temporarily restricted") to push users onto a credential-harvesting clone of the Chase login page. Verify any alert by opening the Chase mobile app or typing chase.com manually into the browser. Real Chase alerts appear inside the Secure Message Center, never as a "Verify now" button linked from an outside email. If a Chase email asks for your full Social Security number, account number, or one-time passcode by reply or via a link, it is phishing.

The play: what the Chase phishing email looks like

The email arrives with the Chase octagonal blue logo, the JPMorgan Chase wordmark, and a header bar painted in Chase brand blue (#117ACA). The body opens with one of three high-volume framings observed by the FTC Consumer Sentinel Network and ABA security advisories during 2026:

Fraud alert. "We detected a suspicious login from Chicago, IL on a Windows device. If this wasn't you, secure your account now."
Credit card hold. "A temporary hold has been placed on your Chase Sapphire card pending verification. Restore access by confirming your information."
Information update. "Annual review required. Please update your account information by May 31 to avoid service interruption."

Each variant places a single blue button in the middle of the email, labeled "Secure my account," "Verify now," "Restore card," or "Update information." The visual mimicry is high enough to pass a glance on a phone screen, where the sender domain is often truncated and the link preview is hidden.

Real Chase emails are conservative. They link to chase.com only, never threaten immediate account closure inside the message, and per Chase's published security policy (chase.com/security) never ask you to verify or restore an account by clicking a link inside an email. The right action on any real Chase security event is to open the Chase mobile app or type chase.com manually into a fresh browser tab and read the alert inside the Secure Message Center.

The trap page: lookalike Chase login

Click the button and you land on a near-perfect Chase login clone. The blue header, the rounded input fields, the "Forgot username/password?" link, the JPMorgan Chase footer disclaimer, all replicated pixel for pixel. What changes is the domain. Patterns logged by the Anti-Phishing Working Group (APWG) and the FTC in 2026 include:

Brand-hyphen-keyword: chase-secure.com, chase-alerts.net, chasebank-alert.com, chase-verify.com
JPMorgan variants: jpmorgan-chase.net, jpmc-secure.com, jpmorganchase-login.com
Brand-dot-subdomain-on-not-chase: chase.com.secure-login.xyz, chase.online-banking.help, chase.com.verify.support
Free hosting: chase-restore.vercel.app, chase-secure.netlify.app, chase-login.pages.dev, chase-bank.web.app
Shortened wrappers: bit.ly, tinyurl.com, and t.co wrappers that hide the destination behind a 301 redirect to one of the above

The user enters Chase username and password. The page then prompts for the One-Time Passcode (OTP) that Chase sends for new-device logins. This is the kill step. The attacker is running an adversary-in-the-middle (AiTM) proxy: as the victim types the OTP, the attacker relays the credentials to real chase.com, triggers the genuine Chase OTP to the victim's phone, and harvests the code from the fake page. The attacker now has an authenticated Chase session and begins moving money via Zelle, wire transfer, or bill pay within minutes.

Why Chase customers are so heavily targeted

Scale. Chase has more than 80 million retail customers in the US. Any general-purpose phishing list contains Chase customers at a far higher hit rate than smaller bank lists.
Zelle integration. Chase accounts are pre-linked to Zelle. A successful credential theft enables instant peer-to-peer transfers up to daily limits ($5,000 to $10,000 per day) that are functionally irreversible once received.
Wire transfer capability. High-balance Chase Private Client and Sapphire Banking accounts can wire six-figure sums in a single session after the OTP step.
Broad surface. Chase Banking, Chase Credit Card, Chase Sapphire, Chase Auto Finance, and J.P. Morgan Wealth Management are distinct customer-facing surfaces. Attackers pick the most plausible angle per target.

Common subject lines and templates seen in 2026

Subject lines rotate weekly to evade keyword-based email filters, but the patterns cluster into a small set of recognizable shapes:

"Chase Alert: Suspicious sign-in detected from [city]"
"Action Required: Temporary hold placed on your Chase card"
"Your Chase account access has been restricted"
"Chase Fraud Protection: Unusual activity on account ending in 4729"
"Final notice: Confirm your Chase account or risk closure"
"JPMorgan Chase: Your annual security review is overdue"

Two tells repeat across all of them. First, a fabricated specificity that looks personalized but is not. "Account ending in 4729" is identical in every email the campaign sends, because the attacker does not actually know the recipient's account number. Second, the deadline pressure. Real Chase compliance reviews do not close accounts on a 24-hour deadline you can resolve by clicking an email link.

How to verify a Chase email is genuine

The verification rule is the same for every bank phishing scenario. Treat the email as informational only. Confirm any claim through a channel you opened yourself.

Do not click the button in the email. Not even to "see what it says." AiTM proxies start logging as soon as the page loads.
Open the Chase mobile app, or type chase.com manually in a new browser tab. Do not Google "Chase login" during a phishing wave. Top results have occasionally included paid ads pointing to typosquats; the FTC has warned about this pattern multiple times.
Sign in normally and open the Secure Message Center. Real Chase security events appear inside the app under Secure Messages. If the Secure Message Center is empty, the email is fake.
Check Profile and Settings, then Activity, for unrecognized sign-ins. Chase logs every login with approximate location and device.
If anything looks off, call the number on the back of your Chase card or 1-800-432-3117 (Chase Fraud Services). Never call a phone number from the email itself.

The 7 red flags in a Chase phishing email

Sender domain is not @chase.com. Real Chase mails from addresses on chase.com, jpmchase.com, or email.chase.com. Anything else (@chase-secure.help, @chase-alerts.support) is forged. Some mobile clients hide the real sender behind a display name; open full headers.
Urgency framing. "Within 24 hours," "immediate action required," "to avoid closure." Real Chase compliance and fraud workflows do not run on a 24-hour email-click deadline. Pressure is a tell.
Link domain is not chase.com. Long-press on the button on mobile, or hover without clicking on desktop. The real domain is whatever sits immediately before the first single slash after https://. chase.com.secure.xyz is the secure.xyz domain pretending to be Chase. Only an exact match on chase.com or jpmorgan.com is genuine.
"Verify," "Secure," "Restore," or "Update" button language. Real Chase emails ask you to sign in or to call the number on the back of your card. Phishing emails ask you to verify, secure, restore, unlock, or confirm by clicking.
Asks for full Social Security number, debit card PIN, or full account number. Chase has stated explicitly across its security center that it does not ask for these details by email.
Generic greeting. Real Chase uses the legal name on file. "Dear Customer" or "Dear Chase User" indicates a bulk send to a leaked email list.
Mismatched timing. If you did not just attempt a login, did not just initiate a wire, did not just apply for a card, and the email arrives claiming an event you did not trigger, log in directly (not via the email link) and check Activity and Secure Messages.

How to report a Chase phishing email

Reporting takes under five minutes and shortens the campaign's lifespan because Chase, hosting providers, and registrars use these reports to seed takedown queues.

Forward the email to phishing@chase.com. This is the official Chase abuse address listed at chase.com/security. Forward with full headers preserved, then delete the email.
If you clicked or entered any information, call Chase Fraud Services immediately at 1-800-432-3117. For credit cards, the number on the back of the card also routes to fraud. Reporting within hours dramatically improves the odds of reversing a fraudulent transfer.
File a complaint at ic3.gov (FBI Internet Crime Complaint Center).
Report to the FTC at reportfraud.ftc.gov so the case feeds the FTC Consumer Sentinel Network used by state attorneys general and federal agencies.
Report to FDIC consumer alerts at fdic.gov/consumer-resource-center if the lure invokes deposit insurance or regulatory enforcement language.

How SafeBrowz blocks this threat

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI.

Layer 1 - Local detection: 60+ URL patterns + 550+ brand-specific signatures (including Chase, JPMorgan Chase, and the major JPM customer-facing surfaces, plus Cyrillic and Punycode homograph variants) + community whitelist/blacklist, all running directly in the extension before the page renders. The chase-hyphen-keyword pattern family (chase-secure, chase-alerts, chase-verify) and the jpmorgan-hyphen lookalikes match instantly off the brand database.
Layer 2 - API checks: aggregates Google Safe Browsing, PhishTank, URLhaus, ScamAdviser, and 30+ scam TLDs for known malicious domains. New Chase typosquats are typically reported to PhishTank within hours of campaign launch.
Layer 3 - AI deep scan (Premium): 100+ language content analysis catches novel Chase login clones in seconds by recognizing Chase UI (blue header, octagon logo, Chase-style form fields) served from any domain other than chase.com or jpmorgan.com.

Detection signatures come from threat-intelligence research and brand database analysis, not from user browsing data. Per-user URL history is never stored.

If you already clicked and entered credentials

The window between credential submission and account drain is measured in minutes when Zelle or wire transfer is involved. Move fast.

Call Chase Fraud Services at 1-800-432-3117 immediately. Tell them you submitted credentials to a phishing page and ask them to flag the account, freeze outgoing transfers, and review recent activity. This is the single most important step.
Open the Chase mobile app or type chase.com manually and change your password. Use a long, unique password not reused on any other site.
Update the security questions and sign out of all sessions from Profile and Settings. Phishing pages often capture security answers alongside the password.
Review the last 30 days of Activity for unauthorized Zelle transfers, bill pay setups, wire transfers, added payees, new linked external accounts, or address changes. Address changes are a known precursor to follow-on card fraud.
Place a fraud alert at the three major credit bureaus. Equifax, Experian, and TransUnion all offer free fraud alerts; one call to any of them propagates to the other two. The FTC consolidates instructions at identitytheft.gov.
Consider a credit freeze if you submitted Social Security number or date of birth on the phishing page. A freeze is free, reversible, and prevents new accounts from being opened in your name.
Change any reused passwords immediately on email, Amazon, retirement accounts, and any other site where the same or a similar password is used.
File reports. Forward the email to phishing@chase.com, file at ic3.gov and reportfraud.ftc.gov.

How to protect your Chase account going forward

Use the Chase mobile app as your primary entry point. Email links should be treated as informational only. App-first habits make the lookalike-domain attack near-impossible to land.
Enable two-step verification in Profile and Settings. While SMS 2FA is bypassable in AiTM kits, it still blocks the much larger volume of non-AiTM credential stuffing attacks.
Set transaction alerts to $0 threshold in the Chase app. You will get a push notification on every charge, transfer, and login, including unauthorized ones.
Lock your card in-app when not in use. A locked card cannot be charged even if the number is stolen.
Install a browser-layer scanner so that even if a phishing link slips through your email filter, the fake page never renders.

Same pattern, different brand

The "bank fraud alert, verify immediately" template is a kit rented out to multiple crews and lobbed at every major US bank in rotation. The same lure runs against Bank of America, Wells Fargo, Citi, Capital One, and US Bank. The verification rule applies identically. Open the bank's mobile app, do not click the link, treat any request for full SSN, PIN, or one-time passcode as proof of phishing.

Install SafeBrowz free

Add the browser extension that runs every check in this article automatically, on every page, before it renders. Free forever.

Add to Chrome Add to Firefox Add to Edge

Upgrade to Premium for AI deep scan of novel Chase lookalike pages in 100+ languages.

Frequently asked questions

Does Chase ever email about fraud alerts and suspicious logins?

Yes. Chase emails about fraud alerts, suspicious sign-ins, large transactions, and card holds. Real Chase emails appear inside the Chase mobile app under the Secure Message Center in parallel. The real email exists, but it directs the user to log in at chase.com or call the number on the back of the card, never to click a verify button that leads off-domain. If there is no in-app Secure Message, the email is phishing.

What is the official Chase fraud reporting phone number?

Chase Fraud Services: 1-800-432-3117. This is listed in Chase's published security center at chase.com/security. For credit card fraud, the number on the back of the card also routes directly to the fraud team. Do not call any phone number printed inside a suspicious email; phishing crews routinely include fake "support" numbers as a follow-on harvest.

I entered my Chase username and password on a fake page. What now?

Call Chase Fraud Services at 1-800-432-3117 immediately to flag the account and freeze outgoing transfers. Log in at chase.com directly (not via the email) and change your password, update security questions, sign out of all sessions, and enable two-step verification. Review the last 30 days of activity for unauthorized Zelle transfers, wires, added payees, and address changes. The drain window can be under an hour.

Will Chase refund money stolen via a phishing email?

It depends on the transaction type. Unauthorized credit card transactions are protected under federal Regulation Z with a $50 maximum consumer liability and are typically reversed. Unauthorized debit card transactions reported within two business days are protected under Regulation E. Zelle transfers authorized by the customer, even under duress or after phishing, are historically much harder to recover, though Chase and other Zelle banks have expanded reimbursement for confirmed impersonation scams in recent policy updates. Reporting speed is the single largest determinant of recovery.

How do I report a Chase phishing email so the page gets taken down?

Forward the email with full headers preserved to phishing@chase.com. Chase's security team files takedown requests with hosting providers and registrars. Also file at ic3.gov (FBI) and reportfraud.ftc.gov (FTC). All three reports together take under ten minutes and feed the federal takedown apparatus.

Are Chase phishing texts the same as Chase phishing emails?

Same scheme, different channel. The SMS version (smishing) is even more compressed: "Chase Alert: Sign-in attempt from new device. Tap to verify: chase-secure.com/xyz." The verification rule is identical. Do not tap the link. Open the Chase app or call 1-800-432-3117. Forward the SMS to Chase at the dedicated smishing address listed in the Chase Security Center, then delete and block the sender.

What if the email contains my real name and partial account number?

Personalization is increasingly common because email lists from third-party data leaks now sometimes include name, partial address, and partial card number alongside the email address. A personalized lure is not proof of legitimacy, only proof that the attacker bought a better list. Apply the same verification rule: open the Chase app or type chase.com manually, and confirm the alert inside Secure Messages.

How does SafeBrowz catch a Chase phishing page I have never seen before?

SafeBrowz runs a 3-layer architecture. Layer 1 matches the URL against a 550+ brand database including Chase and JPMorgan Chase plus 60+ pattern templates. Layer 2 cross-references PhishTank, Google Safe Browsing, URLhaus, and ScamAdviser. Layer 3 (Premium) performs AI content analysis in 100+ languages, recognizing Chase branding served from any domain other than chase.com or jpmorgan.com and blocking before render. Detection signatures come from threat-intelligence research and our brand database, not from individual user browsing.

"Chase Bank" phishing email scam: how to spot fake fraud alerts in 2026