{"id":"fake-chatgpt-payment-card-phishing-may-2026","category":"scam","status":"closed","title":"Fake ChatGPT Plus payment-renewal emails harvest personal and card details","tldr":"Fake ChatGPT Plus billing emails led recipients to forms stealing personal and payment-card details. Microsoft observed 4,500 emails, 97% targeting South Africa. Check billing directly in ChatGPT; contact your bank immediately if you supplied card details.","summary":"Microsoft detected a ChatGPT-themed phishing attack on 5 May 2026 involving 4,500 emails, with 97% targeting South Africa. Messages claimed recipients needed to update their ChatGPT Plus payment method within seven days to avoid being moved to the free plan. Linked pages requested names, addresses and complete card details, including expiry dates and verification codes. Microsoft connected the activity to a broader campaign using similar themes and infrastructure that sent up to 100,000 emails in a day to Switzerland, Austria and South Africa. These are email counts, not confirmed victim counts. Microsoft assessed the activity as impersonation rather than a compromise of OpenAI. Bangladesh’s CIRT repeated the warning in July. As at 3 November, the reviewed sources do not establish how many people submitted details, financial losses, a takedown or arrests. There is no software patch for this scam.","action":"Do not use the email’s payment links; open chatgpt.com yourself and check Settings > Billing, or check your app-store purchase history if you subscribed there. If you supplied card details, contact your bank or card issuer immediately to secure the card and report any unauthorised payments.","product":"Email recipients targeted by fake ChatGPT Plus billing notices","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["chatgpt","openai","phishing","payment-card-theft","email-scam"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"AI brands as bait: How threat actors are using the AI hype in social engineering","url":"https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/","by":"Microsoft","date":"2026-06-08"},{"kind":"advisory","title":"AI-Branded Social Engineering, Phishing, and Malware Delivery Campaigns","url":"https://www.cirt.gov.bd/advisories/ai-branded-campaigns-july-2026","by":"BGD e-GOV CIRT","date":"2026-07-09"},{"kind":"news","title":"Hackers are capitalizing on AI hype to ramp up social engineering attacks – and they're using big brands like Anthropic, OpenAI, and DeepSeek as ‘bait’ to lure victims","url":"https://www.itpro.com/security/cyber-attacks/hackers-are-capitalizing-on-ai-hype-to-ramp-up-social-engineering-attacks-and-theyre-using-big-brands-like-anthropic-openai-and-deepseek-as-bait-to-lure-victims","by":"IT Pro","date":"2026-06-11"},{"kind":"advisory","title":"Report Fraudulent ChatGPT or API Credit Purchase Charges","url":"https://help.openai.com/en/articles/7242625-report-fraudulent-chatgpt-or-api-credit-purchase-charges","by":"OpenAI","date":""},{"kind":"advisory","title":"Finding past ChatGPT invoices","url":"https://help.openai.com/en/articles/12356340-finding-past-chatgpt-invoices","by":"OpenAI","date":""}],"started":"2026-05-05","closed":"2026-07-09","created":"2026-11-03T21:39:14.480Z","updated":"2026-11-03T21:39:14.480Z","cve_notes":[],"timeline":[{"at":"2026-07-09","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"Bangladesh’s BGD e-GOV CIRT issued an advisory repeating Microsoft’s findings about the ChatGPT payment scam and warning that similar lures could target Bangladeshi users.","url":"https://www.cirt.gov.bd/advisories/ai-branded-campaigns-july-2026","by":"BGD e-GOV CIRT","patch":null},{"at":"2026-06-08","added":"2026-11-03T21:35:43.306Z","kind":"disclosed","text":"Microsoft published its findings and reported related activity sending up to 100,000 emails in a day to Switzerland, Austria and South Africa. It assessed the activity as brand impersonation rather than a compromise of the legitimate AI services.","url":"https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/","by":"Microsoft","patch":null},{"at":"2026-05-05","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"Microsoft detected 4,500 phishing emails impersonating ChatGPT, with 97% targeting South Africa. The linked pages collected names, addresses, card numbers, expiry dates and card verification codes.","url":"https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/","by":"Microsoft","patch":"na"}],"url":"https://hard.fyi/live/fake-chatgpt-payment-card-phishing-may-2026/","json":"https://hard.fyi/api/live?id=fake-chatgpt-payment-card-phishing-may-2026"}