Fake ChatGPT billing emails steal card details and bank codes

A phishing campaign is sending emails that claim your ChatGPT Plus payment failed. The link goes to a fake checkout page that collects your card details. A person on the other end then decides what you see next, and that can include a request for the one-time code your bank sends you.

What happened

The emails pose as OpenAI, the company behind ChatGPT. The fake checkout asks for the card number, expiration date, security code and cardholder name. Once you submit, the page shows a loading animation that never ends. That is not a glitch. The delay gives the scammer time to choose your next screen.

The page keeps checking in with the scammer's control panel about every half second. The scammer can send you to a page asking for a bank code, show an error, or end the session. A bank code could help approve fraudulent charges, though success depends on how the bank checks payments.

Why it is hard to shut down

The fake pages sit on disposable WordPress websites hosted on nxcli.io, a hosting service run by Nexcess. Each uses a random ten-character address. Several sites vanished during the investigation, and new ones appeared with the same setup. Researchers at Fortra found identical forms and code across sites captured a week apart, which points to a reusable kit.

Links in the emails also pass through redirect and tracking services. That lets scammers send each person a different link while reusing the same fake page. A padlock in the browser does not help here. It only means the connection is private, not that the site is real.

Who it affects

Anyone who pays for or uses ChatGPT Plus could get one of these emails. Companies should also watch for them, since staff may receive them at work. If you never clicked and never typed in card details, you are in the clear. Deleting the email is enough.

What is not known

• Whether the attackers set up the hosting accounts or broke into existing customer sites.
• How a later, differently styled page relates to the original kit.
• Whether related reports from Cofense come from the same group. That is not proven.

The WordPress folders in the web addresses do not show that WordPress itself was hacked. This is a phishing scheme, not a confirmed software flaw.

What to do

The alert box above lists the steps. The short version is to skip the email link and check billing yourself inside ChatGPT. For companies, security teams can filter the known malicious addresses and review nxcli.io traffic. Blocking the whole service could also cut off legitimate customers.