Fake ChatGPT Billing Emails Harvest Credit Cards and OTPs via Phishing
Written by AI from the linked story. Not reviewed by an editor. How this works
Threat actors are exploiting ChatGPT's massive user base by crafting convincing impersonation emails that mimic OpenAI's billing communications, tricking users into surrendering payment card details and one-time passwords on fraudulent pages. The attack is particularly dangerous because live operators intercept OTPs in real time, bypassing multi-factor authentication protections that users may have assumed kept them safe. This incident highlights how brand trust can be weaponized against end users who lack the skills to identify subtle indicators of phishing. When users are not trained to verify sender domains, inspect URLs, and treat unsolicited billing prompts with suspicion, even technically robust security controls can be circumvented through pure social engineering.
Tactical Insight
Immediate actions
- Train all employees and users to verify the sender domain and hover over links before clicking any billing-related email.
- Report suspected phishing emails to your security team or email provider using built-in reporting tools immediately upon receipt.
Long-term improvements
- Deploy anti-phishing email gateway controls (DMARC, DKIM, SPF) to reject spoofed messages impersonating known brands.
- Implement phishing-resistant MFA (e.g., FIDO2/passkeys) instead of OTP-based methods, which are vulnerable to real-time interception by adversaries.
- Conduct regular simulated phishing exercises to measure and improve user detection rates across the organisation.
Detection measures
- Enable browser-based safe browsing and anti-phishing filters to warn users when they navigate to known or suspected credential-harvesting pages.
- Monitor for anomalous payment authorisation attempts or geo-inconsistent login activity and trigger automatic account holds pending user verification.