Gmork
Usar no Chrome

Os guias estão disponíveis apenas em inglês por enquanto.

Scam library · Email & phishing

Fake ChatGPT or OpenAI payment email scam

The email looks like a routine ChatGPT invoice: the logo is right, the subject says a subscription payment is required, and a countdown — often 48 hours — tells you to update your payment information or lose access. A large button in the middle does the rest of the work.

In September 2026, researchers at the Cofense Phishing Defense Center described this exact lure. The message used real OpenAI branding and was signed 'The OpenAI Team,' but it did not come from an OpenAI address. The button led to a login page that copied ChatGPT's design. Anything typed there went to the scammer, and the next screen was only an error.

What the message looks like

Email · example, not real

From: The OpenAI Team <support@openai-billing[.]example>

Subject: Subscription Payment Required — update within 48 hours

We could not process the payment method on your ChatGPT account. Update your payment information within 48 hours to avoid an interruption in service.

Update Payment Information: account-billing[.]example/openai/pay

This is a made-up example based on phishing emails security researchers have documented. OpenAI will not need you to handle billing through a surprise button in an unexpected message.

How this scam works

Steal the password first, then the card. After you 'sign in' on the fake page, some kits also show a billing form that looks like a normal checkout. Others stop at the password and one-time code, then use that access to change the email on the account or run up charges. OpenAI's own security guidance tells people to be cautious with emails that ask for credentials or send them to pages that demand account details, and to double-check both the sender address and the URL.

Official OpenAI mail comes from a short list of company domains, including openai.com, email.openai.com, and mail.openai.com. OpenAI also says it will not discuss the details of your account over social media, and that a social account asking for login help is not something to engage. The safe habit is simple: ignore the button and open ChatGPT or your OpenAI account by typing the address yourself or using the app you already installed from the official store.

Red flags

  • A sender address that is not an official OpenAI domain such as openai.com, email.openai.com, or mail.openai.com.
  • A 24- or 48-hour deadline and a large 'Update Payment Information' button.
  • A login or checkout page whose address is not the real ChatGPT or OpenAI site you typed yourself.
  • A request for your password, one-time code, or full card details after you arrived from an email link.
  • A social-media account or unfamiliar number offering to 'restore' or 'verify' your ChatGPT access.

How to tell it’s fake

  1. Look at the actual from address, not just the display name. If it is not one of OpenAI's published email domains, treat the message as fake.
  2. Do not use the button. Open chatgpt.com or the ChatGPT app yourself and check billing or payment settings there.
  3. Hover over links before clicking. A page can copy every logo and still sit on a completely different website.
  4. If you do have a ChatGPT subscription and the note still seems plausible, get a second look from someone you trust or a scam expert before you type a password or card number.

What to do if you clicked, paid or shared info

Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.

If you clicked a link or called back

  • Close the page. If you did not enter anything, you are likely fine; delete the email and report it as phishing in your inbox. If you use the same password elsewhere, change it anyway out of caution.

If you paid

  • Call your bank or card issuer immediately and ask to dispute the charge and watch for more attempts. Then open your real ChatGPT or OpenAI billing page yourself — not through the email — to see whether anything actually changed. Report the scam at ReportFraud.ftc.gov.

If you shared personal info, a password or a code

  • If you typed your password or a one-time code, change your OpenAI password at once, turn on multi-factor authentication if it is not already on, and use OpenAI's settings to review security history and log out of all sessions. If you use the API, revoke keys you worry were exposed and check usage for activity you do not recognize. Contact OpenAI Support from the official Help Center.

Where to report and get help (U.S.)

If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.

  • Your bank or card issuer
    Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account.
  • Federal Trade Commission (FTC) · ReportFraud.ftc.gov
    Report the scam and get a step-by-step recovery plan.
  • FBI Internet Crime Complaint Center (IC3) · ic3.gov
    Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details.
  • AARP Fraud Watch Network Helpline · aarp.org helpline
    Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern.
  • IdentityTheft.gov · IdentityTheft.gov
    If you shared your Social Security number or someone opened accounts in your name.

How Gmork Scam Guard would warn you

When a fake ChatGPT billing page opens in Chrome or Edge, Scam Guard can warn you that the address does not match the real service and flag emails that push you to 'update payment details' on a short deadline. It cannot see a message that never opens in the browser, so if you are unsure, that is a good moment to check the real account yourself or ask a scam expert before you sign in.

Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.

Usar no ChromeAdicionar ao EdgeAdicionar ao FirefoxAdicionar ao Opera

Questions people ask

Does OpenAI email people about billing?
It can send mail from published company domains such as openai.com, email.openai.com, and mail.openai.com. Even then, do not handle a payment problem through a link in the message. Open your account yourself and look at billing there.
The login page looked exactly like ChatGPT. How can I tell?
Copied logos are easy. The address bar is the tell. OpenAI publishes its official sites and apps; a page you reached from an unexpected email is not a safe place to type a password.
Someone on social media offered to fix my locked ChatGPT account. Should I reply?
No. OpenAI says it will not go into the details of your account over social media, and that a handle asking for login details or offering account help is not something you should engage.

Sources

Related scams

Browse the full scam library · Scam-safety guides