Scammers Send Fake ChatGPT Billing Notices to Steal Credit Card Details and OTPs

Attackers are impersonating OpenAI in fraudulent ChatGPT Plus billing emails that lead recipients to payment pages designed to steal credit card information and one-time passwords (OTPs).

The campaign pairs realistic-looking subscription notices with a live operator who can decide when to prompt for a verification code, creating an opportunity to approve an unauthorized charge.

The messages claim a subscription payment failed and instruct recipients to update their billing details. This tactic follows a pattern seen in other impersonation campaigns that exploit trust in well-known AI services to harvest financial data.

In this operation the checkout pages are hosted on short-lived WordPress sites and are reached via links that route through tracking services or redirect wrappers. Researchers at Fortra discovered the phishing campaign and detailed its infrastructure in research published on October 26, 2026.

Importantly, Fortra observed phishing activity rather than malware: the investigation did not reveal any executable downloads or compromises of victims’ machines.

Hackers Exploit ChatGPT’s Popularity With Fake Billing Notices

The attack starts with an email that mimics an OpenAI payment notification. Links in those emails redirect through tracking domains before landing on a fake checkout page hosted on ephemeral WordPress instances.

Researchers observed the same landing page reused for multiple recipients within a single sending wave, indicating shared infrastructure behind separately tracked messages.

The checkout page imitates a legitimate payment form: it identifies card brands and formats card numbers, expiry dates, and CVV fields as victims type.

Similar WordPress-based payment phishing schemes have previously used convincing checkout interfaces to harvest card details and verification codes, though Fortra did not establish a direct link to those earlier operations.

After victims submit their details, the page collects the card number, expiry date, CVV and cardholder name and then displays a loading animation indefinitely.

The site’s client-side code intentionally keeps the spinner running instead of processing a response or advancing automatically.

While the victim’s browser is stalled, it repeatedly polls an operator dashboard, keeping the session alive and checking for instructions from a human operator.

A live operator can choose to redirect the victim to an OTP-capture page, show an error, or terminate the session. In one test that ran four minutes and three seconds, the victim’s browser generated 969 requests—mostly polling traffic to the operator dashboard.

This interaction gives attackers a window to capture a bank verification code while the victim believes the subscription update is being processed.

Real-time OTP interception appears in other payment-fraud kits as well; the observed ChatGPT-themed operation relies on repeated polling to receive operator instructions. Capturing an OTP can facilitate authorization of fraudulent transactions, although not every captured submission results in a successful charge.

Fortra found identical client-side code and a shared application identifier across independently deployed sites examined about a week apart. Sites went offline and were replaced during the investigation. It remains unclear whether the attackers purchased new hosting accounts or compromised existing customer sites.

The attackers’ infrastructure also complicated analysis: some unexpected requests returned generic errors, and a token-generating path appeared to influence access.

Interception-based analysis disrupted the session flow, while passive browser inspection allowed researchers to capture the payment submission and the polling behavior without breaking it.

For defenders, recurring page structure and distinctive dashboard polling traffic present more reliable detection opportunities than treating isolated hostnames as the only indicators. The broader prevalence of live financial phishing operations underscores why stolen verification codes require immediate attention.

Users should verify billing issues from within their account pages rather than following links in emails. Organizations should investigate similar messages and report fraudulent hosting. When blocking infrastructure, take care because legitimate customers may share the same hosting platform.

Indicators of compromise (IoCs):

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate Threat Intel from 16K SOCs.