Fake ChatGPT Billing Emails Steal Card Details

How the Attack Worked

According to Check Point, ChatGPT entered the top 10 most impersonated brands in Q2 2026. One documented example involved a fake email claiming a ChatGPT Plus subscription payment had failed. The message was dressed up to look exactly like an OpenAI billing notice, using the opening line "ChatGPT Plus payment failed" to create a sense of urgency. Victims who clicked through were directed to a page built purely to steal full credit card details.

This type of scheme fits a broader pattern Check Point calls brand phishing, where a scammer impersonates a trusted, well-known company by email and/or fake websites in order to steal login credentials, payment details or personal information. The report also references other cases, including cloned storefronts and a fake PayPal login page, showing that this approach is used across multiple well-known brands, not just one.

Why It Succeeded

The email's effectiveness relied on close visual mimicry of a legitimate OpenAI billing notice combined with a plausible, low-friction pretext: a routine payment failure. Because subscription billing issues are common and often require quick action to avoid service interruption, recipients may feel pressured to resolve the problem immediately rather than pausing to verify the source. The target audience for this kind of lure is broad, spanning all employees as well as finance, procurement, and accounts payable staff who regularly handle payment information.

What to Watch For

• An unexpected billing failure notice that pressures immediate action
• A link leading to a payment page requesting full credit card details
• Emails that closely replicate a well-known brand's look and formatting but request unusual or sensitive information
• Any request to re-enter payment credentials outside of a normal account login flow

Building Resistance

Organizations can reduce risk from this style of attack with a few practical habits:

• Treat unexpected subscription or payment failure emails as suspicious, and verify by logging in through a typed URL or saved bookmark instead of clicking email links.
• Train staff to focus on what information a message is requesting and where its links actually lead, rather than relying on logos or formatting to judge legitimacy.
• Reinforce that brand phishing targets both credentials and payment data, so employees should never enter card details from a link in an unsolicited message.
• Encourage reporting of suspicious billing or subscription emails to IT or helpdesk teams so patterns can be tracked across the organization.

This technique aligns with tactics such as Spearphishing Link and Malicious Link user execution, both commonly used in brand-impersonation campaigns designed to harvest payment or credential data at scale.

What did the fake ChatGPT email look like?

It was designed to look exactly like an OpenAI billing notice, claiming a ChatGPT Plus payment had failed and needed to be fixed.

What happened if someone clicked the link?

The link led to a page built purely to steal full credit card details from the victim.

Is ChatGPT the most impersonated brand?

No. Microsoft remained the most impersonated brand in the report, accounting for 23% of observed phishing attempts, though ChatGPT entered the top 10 in Q2 2026.

What should employees do with unexpected billing emails?

Verify the request through a trusted path, such as typing the official site address directly or using a known bookmark, rather than clicking the link in the message.