The “Free Claude Max Upgrade” Never Asks for Your Card — It Wants Your Whole Google Account (2026)

No — it's a phishing page, and the missing card field is the camouflage. Malwarebytes documented the campaign on September 23, 2026: a “giveaway” claiming Anthropic passed 100 million users and is giving away 10,000 free Claude Max subscriptions, complete with the real logo and colors, invented five-star reviews, and a footer linking to genuine Anthropic pages. Every route funnels to one prize — your Google login, typed into a fake browser window with a painted-on padlock and address bar. Two tests beat it: drag the window past the page's edge (a real popup escapes), and trust your password manager when it refuses to fill.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL free Read the full guide

From the research desk — this pattern is one of those documented in This Week's Scam Wave, in Numbers — September 29, 2026 →

Why you’re seeing this now

Malwarebytes documented this campaign on September 23, 2026, and the craft is in what it doesn't do. It never asks for card details — the FAQs promise that repeatedly, and it's true — so the usual scam radar stays quiet. The real logo and colors are copied, the five-star reviews are invented, and the footer's links lead to genuine Anthropic pages: the strongest trust signal on the site, and it cost the operator nothing. The prize is your Google login — the account that holds your email, documents, and the reset links for everything else (and, if you use Google to sign in to Claude, your paid Claude account too). Every route funnels there: Apple sign-in is “temporarily unavailable,” and the email box discards whatever you type. Clicking Google draws a fake browser window inside the page — padlock, correct-looking address, draggable. Two tests beat it: try dragging the window past the page's edge (a real popup escapes; a fake is trapped), and trust your password manager when it refuses to fill your Google password there.

The exact words they use

Quoted from documented versions of this script so you can recognize it on sight. The words are the scammer’s — the patterns inside them are what give the con away.

The page claims Anthropic has passed 100 million users and is giving away 10,000 free one-month Claude Max subscriptions — with a counter warning that fewer than 750 slots remain. The counter is generated in your browser and resets every time you reload.

Script language quoted for recognition — if the message in your hand reads like this, you already have your verdict.

Five red flags — any one is enough

A “giveaway” of a paid AI subscription — 10,000 free upgrades, a live counter of slots “running out.”

No card required — that's the camouflage. The target is your Google account.

Only one sign-in method “works”; the others are “temporarily unavailable.”

The sign-in window opens inside the page — the address bar and padlock are drawn by the site, not your browser.

Your password manager stays silent on a page claiming to be Google. Believe it over your own eyes.

Your next three moves

Verify through a channel you open yourself: type anthropic.com into your browser or open the Claude app and check for the giveaway there — a real promotion lives on the company's own site, not on a page an ad or message handed you.

Refuse the Google login on any page the giveaway funnels you to. A “free upgrade” that needs your Google password is after the account itself — your email, documents, and the reset links for everything else. Never type it into a window drawn inside a webpage, however correct the address bar looks.

Report the page at reportfraud.ftc.gov and to the FBI at ic3.gov — and paste its link into the $2 instant check before anyone else in your contacts opens it.

It never asked for my card — how is that a scam?

The missing card field is the camouflage: the page's own FAQs promise repeatedly that no card is needed, and it's true. The prize is your Google login — the account that holds your email, documents, and the reset links for everything else.

The sign-in window showed a padlock and the right address — doesn't that prove it?

No — the window was drawn inside the page by the site itself: padlock, correct-looking address, even draggable. Try dragging it past the page's edge: a real popup escapes; the fake is trapped.

The footer linked to real Anthropic pages — why?

Because it costs the operator nothing and buys your trust: Malwarebytes found the real logo and colors copied, five-star reviews invented, and footer links to genuine Anthropic pages — the strongest trust signal on the site, free for the taking.

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Spot the scam before it spots you.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.