Scam watch: the fake ChatGPT Plus "payment failed" email after your card

A fake email from "OpenAI Support" is doing the rounds with the subject "Payment failed for ChatGPT Plus ($20.00)". It is not from OpenAI, and OpenAI is not involved. Its only job is to get a card number, and sometimes a ChatGPT login, typed into a fake page.

Businesses are an easy target: many staff pay for AI tools on a company card, and "payment failed" feels like admin, not a risk.

What the email looks like

The email opens with "$20.00 payment to OpenAI Ireland Limited was unsuccessful". It says it could not charge "the credit card you provided" and asks the reader to "update your payment method to continue your subscription without interruption". Then comes a big "Update payment method" button.

It is built from a copy of a genuine payment receipt, with an OpenAI company name, a Dublin address and a VAT number in the footer. Two links near the bottom even go to OpenAI's real help centre. That mix of real links and one fake button is deliberate.

The tell-tale signs:

• The sender. The display name says "OpenAI Support", but the real sender is a free Gmail address with a random name. Replies go to the same free address.
• The checks it passes. It passes the basic checks mail systems run, because it really was sent through Gmail. That proves which service sent it, not who is behind it.
• The button. "Update payment method" does not go to chatgpt.com or openai.com. It goes to a storage space with a random name on Amazon's cloud, an address ending in s3[.]amazonaws[.]com.
• The timing. It lands in the early hours of a Saturday, when nobody is around to ask.

How the scam works

1. The email goes to a long list of business addresses, ChatGPT users or not.
2. Someone who uses ChatGPT, or looks after the company card, clicks the button.
3. A fake checkout page opens. Researchers have found pages in this family asking for the email address, card number, expiry date, security code, name and billing address. Some also ask for the ChatGPT password.
4. After the details go in, the page shows a loading screen and then an error saying the payment failed. Testing by the security firm MailGuard showed this is designed to make the victim try again, which hands over more card details.
5. Some kits have a live person watching. Researchers at Fortra found a kit in which an operator can ask the victim for a one-time verification code as well. The fake pages move from one website to another, so blocking one does not stop the scam.

How the scammers make money

• Selling the card. Stolen cards are traded on criminal markets. NordStellar, a security firm from the team behind NordVPN, studied 50,705 stolen card records collected in May 2025 and found an average price of about $8 per card. Listings that include the owner's name, address and email help criminals pass fraud checks.
• Using the card. The trade is split into roles. "Harvesters" collect card details, "validators" run small test payments to see which cards work, and "cash-outers" turn them into value: gift cards and vouchers, goods to resell, travel bookings or crypto. The money then passes through several steps to hide where it came from.
• Using the login. A stolen ChatGPT password gets tried on email and other accounts, because people reuse passwords. A work account can also hold chats about the business.

The set-up costs almost nothing: a free email account, a cloud storage page and a copied template. A handful of victims out of thousands makes it pay.

In the UK, fraud using stolen card details online ("remote purchase fraud") reached £423.5m in 2025, according to banking industry figures reported by Which?, and phishing emails are one way those details are stolen. Check Point named fake "ChatGPT Plus payment failed" emails when ChatGPT entered its top ten most faked brands in phishing for April to June 2026.

How to spot it

• Check the sender address, not the name. A free Gmail address is never OpenAI.
• Hover over the button, or press and hold on a phone. If it does not go to chatgpt.com or openai.com, close the email.
• It never names your card or its last digits.
• If nobody in the business pays for ChatGPT Plus, it is fake.
• A real billing problem shows inside ChatGPT. Type chatgpt.com yourself, sign in and check billing in your settings.

How to protect your business

• Never update card details from a link in an email. Always sign in the long way.
• Keep a list of the software subscriptions the business pays for, on which card, and who owns each one.
• If your bank offers virtual cards, use a separate card with a low limit for software subscriptions.
• Turn on 2-step sign-in for ChatGPT and for email accounts.
• Forward scam emails to [email protected], the National Cyber Security Centre's reporting service. In Gmail, also use "Report phishing" in the message menu.
• Show your team this email, especially anyone with a company card.

If you clicked, typed or paid

1. If you typed card details: call your bank on the number on the back of the card. Ask them to stop the card and check for payments you don't recognise, including small test payments.
2. If you typed your ChatGPT password: go to chatgpt.com yourself and change it. Sign out of all sessions, turn on 2-step sign-in, and change it anywhere else you used it. If the business uses OpenAI API keys, OpenAI advises rotating them.
3. Tell OpenAI. Its Help Center has a page on how to report fraud or suspicious activity.
4. If you lost money: report it at reportfraud.police.uk, the national service that replaced Action Fraud in England, Wales and Northern Ireland. In Scotland, report it to Police Scotland.

A real billing problem waits inside your account. If an email wants your card details in a hurry, close it and sign in yourself.