Hackers Exploit ChatGPT’s Popularity With Fake Billing Notices That Target Credit Cards and OTPs

Threat actors are exploiting ChatGPT's massive user base by crafting convincing impersonation emails that mimic OpenAI's billing communications, tricking users into surrendering payment card details and one-time passwords on fraudulent pages. The attack is particularly dangerous because live operators intercept OTPs in real time, bypassing multi-factor authentication protections that users may have assumed kept them safe. This incident highlights how brand trust can be weaponized against end users who lack the skills to identify subtle indicators of phishing. When users are not trained to verify sender domains, inspect URLs, and treat unsolicited billing prompts with suspicion, even technically robust security controls can be circumvented through pure social engineering.