ChatGPT Billing Phish and Fake Snap Support Scams

How the attacks worked

Two separate incidents in this roundup share the same underlying playbook: impersonate a trusted brand and pressure the target into an immediate action. In the first, phishing emails impersonated ChatGPT Plus billing, telling recipients an urgent payment update was needed and directing them to an embedded link to enter payment card details. In the second, a convicted attacker posed as Snapchat support over the phone, asking victims to read back the one-time authentication code they had just received in order to "verify" or "secure" their account.

Why it succeeded

Both scenarios relied on borrowed trust and urgency rather than technical exploitation. ChatGPT has entered the top 10 most-impersonated brands, meaning recipients are increasingly likely to encounter a message that looks plausible simply because the brand is popular and widely used. Microsoft remains a heavily impersonated brand as well, showing that attackers gravitate toward services people already trust and use daily. In the Snapchat case, the attacker leaned on the appearance of legitimate support outreach, which lowered the target's guard long enough to extract the authentication code before it expired.

What to watch for

• An unexpected billing notice for a service the recipient may not even use
• A request to pay or update payment information through an embedded link rather than logging in directly through the official site or app
• Any caller claiming to be "support" who asks for a verification or authentication code
• Unsolicited contact creating urgency around an account issue that was never reported by the user
• Pressure to act immediately without time to verify the request through official channels

Building resistance

Defenders across finance, executive, and IT/helpdesk roles are common targets for billing-themed phishing, while all employees remain potential targets for support impersonation calls. Practical steps include:

• Verify billing messages independently and avoid clicking embedded payment links, going instead to the official site or app
• Treat any request for a one-time passcode or MFA code as a red flag, regardless of who claims to be asking
• Use phishing-resistant MFA wherever possible to reduce the impact of stolen codes
• Train customer support and helpdesk staff to recognize social engineering attempts that mimic their own workflows
• Reinforce that legitimate support representatives will never ask a user to read back a verification code

The common thread across both cases is impersonation of a trusted name paired with a call to act quickly, whether that means paying, verifying, or sharing a code. Recognizing that pattern, rather than trying to spot every individual brand being spoofed, is the more durable defense.

What is the ChatGPT billing phishing scam?

It is a phishing campaign that sends fake ChatGPT Plus billing notices urging recipients to click an embedded payment link and enter payment card details, part of a broader trend of AI brands entering the top 10 most-impersonated brands.

How did the Snapchat support scam work?

An attacker impersonated Snap representatives and used social engineering to convince victims to read out authentication codes they had just received, which allowed account takeovers and theft of private content.

How can employees avoid falling for these scams?

Verify billing messages independently instead of clicking embedded payment links, and never share one-time passcodes with anyone, even someone claiming to be official support.

Why is brand impersonation so effective?

Widely trusted brands like Microsoft and popular AI tools create a false sense of legitimacy, and urgency around billing or account security pressures people into acting before they verify the request.