A fraudulent email impersonating OpenAI Account Services claims a ChatGPT subscription payment has failed, directing recipients to a fake billing page designed to collect personal and credit card information.
GlobalGuard's MailGuard is intercepting a phishing email that impersonates OpenAI Account Services and attempts to trick ChatGPT users into handing over personal and payment information.
The email claims that a recent payment for the recipient's ChatGPT subscription could not be processed. It urges them to update their billing information through a link, warning that their service could be interrupted if the issue is not resolved.
While the message uses OpenAI and ChatGPT branding to appear legitimate, the sender details and website destination reveal a very different story. The link redirects recipients through a shortened URL to a website hosted on an unrelated domain, where they are prompted to enter personal details and credit card information.
This is a familiar phishing tactic: exploit the trust people place in a widely used service, create concern about losing access, and make a fraudulent request for sensitive information appear like a routine account-management task.
How the ChatGPT payment phishing email works
The email arrives with the display name OpenAI Account Services and the subject line:
Action Required: Payment issue on your ChatGPT account.
It opens with a generic greeting, "Dear Customer", and claims that a routine account check identified a problem processing the recipient's latest ChatGPT subscription payment.
Recipients are then instructed to verify and update their billing information using a link labelled "Update Payment Details".
The message also introduces a sense of urgency, telling recipients to resolve the issue before 10 November to avoid an interruption to their service.
The phishing email impersonates OpenAI Account Services and uses a supposed ChatGPT subscription payment failure to encourage recipients to click a link and update their billing details.
There are several warning signs in the message.
The sender address does not belong to OpenAI. Although the display name claims to be OpenAI Account Services, the visible sender address is admin(at)laporzione.com. The sending address identified by GlobalGuard's operations team is www-data(at)laporzione.com. Neither uses an OpenAI domain.
The email body also displays account-services(at)openai.com, which may make the message appear more credible at a glance. However, an email address written within the body does not establish who actually sent the message.
The greeting is generic. The message begins with "Dear Customer" rather than addressing the recipient by name. While this alone does not prove an email is fraudulent, it is another reason to be cautious when a message claims to concern a personal account or subscription.
The link does not lead to an OpenAI website. The email uses a Linktree shortened URL (tr.ee) to conceal the final destination. Shortened links can make it difficult for recipients to assess where they will be taken before clicking.
The combination of an unrelated sender domain, generic greeting, payment-related pretext and concealed website destination should raise immediate suspicion.
A fake ChatGPT billing page requests personal and payment information
Clicking the link takes the recipient through to a phishing website hosted at doing-memory.de.
The landing page imitates a ChatGPT billing-address screen. It displays the ChatGPT logo and presents what appears to be a familiar account billing process, including a ChatGPT Plus subscription summary.
The page asks for information including:
Example phishing content shown using OpenAI branding. Not affiliated with OpenAI.
The fraudulent website imitates a ChatGPT Plus billing screen, but the browser address bar reveals that the page is hosted on doing-memory.de, not an official OpenAI website.
Example phishing content shown using OpenAI branding. Not affiliated with OpenAI.
The page then presents a continuation step as part of what appears to be a normal billing process.
GlobalGuard's operations team was unable to establish what happened beyond the subsequent credit card details screen. During testing, the page displayed a spinning logo before returning to the card-entry screen.
What is clear is that the page requests personal and payment information under the guise of resolving a ChatGPT subscription issue. Anyone who enters these details risks exposing sensitive information to the operators of the phishing site.
Why this type of phishing email can be convincing
The scam relies on a relatively simple but effective psychological trigger: concern about losing access to a service.
For people who use ChatGPT regularly, a notification about a failed subscription payment may appear plausible. Updating billing information is also a familiar process, making it easier for recipients to respond without questioning the request.
The use of familiar branding and a page that imitates a legitimate billing interface adds another layer of credibility. Someone who glances at the logo and page layout may not immediately notice that the website address has nothing to do with OpenAI.
This is why checking the sender and destination matters. A recognisable company name, logo or professional-looking page does not establish that a message or website is genuine.
The use of a shortened URL is another important warning sign. While legitimate organisations sometimes use link-shortening services, recipients should be cautious when an unexpected payment request directs them through a shortened link rather than an official company website.
How to recognise and avoid the scam
If you receive an email claiming that your ChatGPT subscription payment has failed, do not use the link in the message to update your details.
Instead, access your account through the official ChatGPT website or application and check your subscription status directly.
More generally, take care with unexpected emails that ask you to verify personal information, update payment details or resolve an account problem. Before taking action:
If you have already entered personal or payment information on a suspicious website, contact your bank or card provider promptly if card details were supplied. Change any passwords that may have been disclosed or reused elsewhere, and report the incident through the appropriate channels.
GlobalGuard advises all recipients of these emails to delete them immediately without clicking on any links. Responding or providing personal details can lead to identity theft, data breaches, and financial losses.
Reach out to speak to a GlobalGuard expert about securing your inboxes against advanced, malicious email-borne threats with our AI-powered email security solutions.