A fraudulent email impersonating OpenAI Account Services claims a ChatGPT subscription payment has failed, directing recipients to a fake billing page designed to collect personal and credit card information.
MailGuard is intercepting a phishing email that impersonates OpenAI Account Services and attempts to trick ChatGPT users into handing over personal and payment information.
The email claims that a recent payment for the recipient's ChatGPT subscription could not be processed. It urges them to update their billing information through a link, warning that their service could be interrupted if the issue is not resolved.
While the message uses OpenAI and ChatGPT branding to appear legitimate, the sender details and website destination reveal a very different story. The link redirects recipients through a shortened URL to a website hosted on an unrelated domain, where they are prompted to enter personal details and credit card information.
This is a familiar phishing tactic: exploit the trust people place in a widely used service, create concern about losing access, and make a fraudulent request for sensitive information appear like a routine account-management task.
How the ChatGPT payment phishing email works
The email arrives with the display name OpenAI Account Services and the subject line:
Action Required: Payment issue on your ChatGPT account.
It opens with a generic greeting, "Dear Customer", and claims that a routine account check identified a problem processing the recipient's latest ChatGPT subscription payment.
Recipients are then instructed to verify and update their billing information using a link labelled "Update Payment Details".
The message also introduces a sense of urgency, telling recipients to resolve the issue before 10 November to avoid an interruption to their service.
Example phishing content shown using OpenAI branding. Not affiliated with OpenAI.
The phishing email impersonates OpenAI Account Services and uses a supposed ChatGPT subscription payment failure to encourage recipients to click a link and update their billing details.
There are several warning signs in the message.
The sender address does not belong to OpenAI. Although the display name claims to be OpenAI Account Services, the visible sender address is admin(at)laporzione.com. The sending address identified by MailGuard's operations team is www-data(at)laporzione.com. Neither uses an OpenAI domain.
The email body also displays account-services(at)openai.com, which may make the message appear more credible at a glance. However, an email address written within the body does not establish who actually sent the message.
The greeting is generic. The message begins with "Dear Customer" rather than addressing the recipient by name. While this alone does not prove an email is fraudulent, it is another reason to be cautious when a message claims to concern a personal account or subscription.
The link does not lead to an OpenAI website. The email uses a Linktree shortened URL (tr.ee) to conceal the final destination. Shortened links can make it difficult for recipients to assess where they will be taken before clicking.
The combination of an unrelated sender domain, generic greeting, payment-related pretext and concealed website destination should raise immediate suspicion.
A fake ChatGPT billing page requests personal and payment information
Clicking the link takes the recipient through to a phishing website hosted at doing-memory.de.
The landing page imitates a ChatGPT billing-address screen. It displays the ChatGPT logo and presents what appears to be a familiar account billing process, including a ChatGPT Plus subscription summary.
The page asks for information including:
The fraudulent website imitates a ChatGPT Plus billing screen, but the browser address bar reveals that the page is hosted on doing-memory.de, not an official OpenAI website.
The page then presents a continuation step as part of what appears to be a normal billing process. MailGuard's operations team was unable to establish what happened beyond the subsequent credit card details screen.
During testing, the page displayed a spinning logo before returning to the card-entry screen.
What is clear is that the page requests personal and payment information under the guise of resolving a ChatGPT subscription issue. Anyone who enters these details risks exposing sensitive information to the operators of the phishing site.
Why this type of phishing email can be convincing
The scam relies on a relatively simple but effective psychological trigger: concern about losing access to a service.
For people who use ChatGPT regularly, a notification about a failed subscription payment may appear plausible. Updating billing information is also a familiar process, making it easier for recipients to respond without questioning the request.
The use of familiar branding and a page that imitates a legitimate billing interface adds another layer of credibility. Someone who glances at the logo and page layout may not immediately notice that the website address has nothing to do with OpenAI.
This is why checking the sender and destination matters. A recognisable company name, logo or professional-looking page does not establish that a message or website is genuine.
The use of a shortened URL is another important warning sign. While legitimate organisations sometimes use link-shortening services, recipients should be cautious when an unexpected payment request directs them through a shortened link rather than an official company website.
How to recognise and avoid the scam
If you receive an email claiming that your ChatGPT subscription payment has failed, do not use the link in the message to update your details.
Instead, access your account through the official ChatGPT website or application and check your subscription status directly.
More generally, take care with unexpected emails that ask you to verify personal information, update payment details or resolve an account problem. Before taking action:
If you have already entered personal or payment information on a suspicious website, contact your bank or card provider promptly if card details were supplied. Change any passwords that may have been disclosed or reused elsewhere, and report the incident through the appropriate channels.
Stay Safe, Know the Signs
MailGuard advises all recipients of the emails to delete them immediately without clicking on any links. Responding or providing your personal details can result in your sensitive information being used for criminal activity and may have a severe negative impact on your business and its’ financial well-being.
MailGuard urges users not to click links or open attachments within emails that:
Reach out to our team for a confidential discussion by emailing expert@mailguard.com.au or calling 1300 30 44 30.
All that it takes to devastate your business is a cleverly worded email message that can steal sensitive user credentials or disrupt your business operations. If scammers can trick one person in your company into clicking on a malicious link or attachment, they can gain access to your data or inflict damage on your business.
For a few dollars per staff member per month, you can protect your business with MailGuard's specialist AI-powered, zero-day email security. Special Ops for when speed matters! Our real-time zero-day, email threat detection amplifies our client’s intelligence, knowledge, security and defence. Talk to a solution consultant at MailGuard today about securing your company's inboxes.
Stay up-to-date with MailGuard's latest blog posts by subscribing to free updates. Subscribe to weekly updates by clicking on the button below.