Fake Stripe Customer Support Chatbot Scam
Criminals operate fake Stripe merchant-support chatbots on lookalike sites, harvesting API keys, bank account details, and Dashboard credentials from merchants seeking help.
Part of: Fake Customer-Service Chatbots
Last reviewed: 8 June 2026
Stripe has a genuine merchant support chat accessible through the Stripe Dashboard at dashboard.stripe.com. Because Stripe's interface is complex and questions about payouts, disputes, and integrations are common, merchants frequently search for Stripe support online. Scammers place paid advertisements for fake Stripe help sites that appear near the top of search results.
The stakes in Stripe chatbot fraud are particularly high compared to consumer-facing variants because merchants may disclose API keys — which grant programmatic access to payment infrastructure — or banking details needed for payout verification. A compromised Stripe account can expose an entire business's payment processing and customer data.
Stripe's legitimate support agents authenticate merchants through the Dashboard session and never ask for raw API keys.
How this scam works on the Stripe brand
A merchant searches for 'Stripe payout delayed support' and clicks a paid ad leading to stripe-merchanthelp.com. A chat window opens. The agent asks: 'To look up your account, please provide your Stripe Dashboard email address and your API secret key so I can diagnose the issue.' Merchants unfamiliar with the security implications may comply.
Alternatively, the chat asks the merchant to log in to their Dashboard through a login form embedded on the support page — a fake dashboard.stripe.com clone. Credentials entered there are captured. The agent then asks the merchant to read out the two-factor authentication code they just received, completing the account takeover.
With a live Stripe session, the scammer can change the bank account on file for payouts, add fraudulent payout destinations, and in some integrations, access customer payment data.
Common red flags
- The support site was reached through a search ad rather than from dashboard.stripe.com.
- The chat agent requests your Stripe API secret key — Stripe support never requires this.
- You are asked to log in to Stripe through a form on a site other than stripe.com.
- The agent requests the two-factor code just sent to your phone.
- The URL in the browser bar is not stripe.com or dashboard.stripe.com.
- The agent immediately asks for credentials rather than guiding you to reproduce the issue.
- After providing details, you receive a Dashboard notification about a payout-account change you did not make.
How to protect yourself
- Access Stripe support only from within the authenticated Dashboard at dashboard.stripe.com — never through external links.
- Know that Stripe support never needs your API secret key — the support agent can look up your account from their end using your authenticated session.
- Rotate your API keys immediately if you believe they have been shared with an unauthorised party.
- Enable Dashboard login notifications so you are alerted to any new session from an unfamiliar device.
- Use restricted API keys for integrations and only share keys with verified services listed on the Stripe App Marketplace.
How to report it
- Forward phishing emails and URLs to [email protected].
- Contact Stripe support at dashboard.stripe.com/contact to secure your account.
- Report to the FTC at reportfraud.ftc.gov.
- Report the phishing domain to Google Safe Browsing.
- File with ic3.gov if business funds or customer data were exposed.
Frequently asked questions
What's the difference between a restricted and a secret Stripe API key, and does it matter which I share?
Both should be treated as sensitive, but a secret key grants full account access, including payouts and refunds. Neither should ever be shared with a support chat — use restricted keys only for specific, verified third-party integrations you've deliberately set up.
How would I notice if a scammer changed my Stripe payout bank account?
Stripe sends a notification to your registered email whenever payout details change, and you can also check Settings > Bank accounts and scheduling in your Dashboard at any time. Review this immediately if you've had any suspicious support interaction.
Should I ever trust a phone number for Stripe support found through a Google search?
Be cautious — verify any phone number against the official contact page reached by navigating to stripe.com/contact yourself, rather than trusting a number from a search ad or unfamiliar site. Stripe support is primarily accessed through the authenticated Dashboard.
Does Stripe ever need my API secret key in a support chat?
No. Stripe support agents access account information through their own authenticated tools, not by having merchants provide API keys. Never share a secret key with anyone, including someone claiming to be Stripe.
What should I do if I shared my API key in a chat?
Immediately go to dashboard.stripe.com, navigate to Developers > API keys, and roll (regenerate) all compromised keys. Review your recent payouts and dispute activity for unauthorised changes.
How do I access the real Stripe live chat support?
Log in to your Stripe Dashboard at dashboard.stripe.com, click the question mark or Help icon, and choose Contact Support. The chat is available within the authenticated session — you never need to provide credentials again.