If you pay for ChatGPT, an email saying there is a problem with your subscription could easily get your attention. Maybe your card expired. Maybe the payment failed. Either way, you probably want to fix it before anything happens to your account. Cybercriminals are counting on that reaction.
Security researchers at Cofense uncovered a phishing campaign that impersonates OpenAI and ChatGPT. The fake email looks like a routine subscription notice. However, the button inside can lead to a convincing copy of the ChatGPT login page. Cofense says the campaign targets account credentials and payment information.
Missed CyberGuy LIVE? Watch the Get Better Healthcare With AI replay
Our free CyberGuy LIVE class, Get Better Healthcare With AI , has ended, but you can still watch the full replay. Kurt “CyberGuy” Knutsson walks you through five practical ways AI can help you organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare smarter questions for your doctor. No technical experience is needed.
Watch the free replay now at CyberGuyLive.com
SCAMMERS KNOW THE BEST TIME TO TEXT YOU
The scam starts with an email that looks polished enough to make you pause. According to the Cofense Phishing Defense Center, it uses the real ChatGPT logo and claims your subscription payment needs attention. Then comes the pressure. The message prominently displays “Subscription Payment Required.” It also warns that you have 48 hours to act. A large “Update Payment Information” button gives you an obvious way to supposedly fix the problem. Finally, the message signs off as “The OpenAI Team.” If you are checking email between meetings or quickly scrolling on your phone, all of that can feel believable. Cofense says the attackers combine familiar images, bold wording and urgency to push people into acting quickly.
The sender’s email address is one of the biggest red flags. Cofense found that the phishing message came from support@9527db6e1a[.]nxcli[.]io. That domain has nothing to do with OpenAI. OpenAI currently lists several domains that it uses for legitimate customer emails. They include @openai.com, @mail.openai.com and @email.openai.com, along with other official OpenAI domains used for specific communications. That makes the full sender address worth checking. Do not rely on the name that appears in your inbox. A scammer can make the display name look reassuring while using a completely unrelated address behind it.
FAKE CHROME UPDATE SCAM COULD INFECT YOUR COMPUTER
The button inside this phishing email adds another layer of deception. Cofense found that clicking “Update Payment Information” first sent users through a Google API redirect. The link then forwarded them to the attacker’s malicious site. That can make a suspicious link look more convincing at first glance because Google appears along the way. We have seen criminals abuse trusted services in similar attacks before. CyberGuy previously covered how hackers used legitimate Google Cloud tools to send phishing messages that looked like authentic Google notifications. So, seeing Google somewhere in a link does not tell you where you will eventually land. On a computer, hovering over a button can sometimes reveal the destination before you click. Still, redirects can make that check less useful. The safer option is to skip the email link entirely.
Once someone clicks through, the scam gets harder to spot. Cofense says the phishing page closely copies the ChatGPT login experience, complete with familiar logos, text and icons. However, the domain in the browser does not match the legitimate ChatGPT login domain identified by Cofense. If a victim enters login information, the fake site captures it and sends it to the attacker. The page then sends the victim to an error screen, which could easily look like a temporary login problem. By then, the attacker may already have the credentials. That is why it is worth checking the address bar before you enter a password. Scammers can copy the look of a login page. They cannot make an unrelated domain belong to OpenAI.
We reached out to OpenAI for comment but did not hear back before our deadline.
If an email says there is a payment problem, skip the button. Go directly to ChatGPT.com or open the official app and sign in yourself. For web subscriptions, OpenAI says to check Settings → Billing . Some accounts may show Settings → Account → Payment → Manage instead. If you subscribed through Apple or Google Play, manage your subscription through that store.
Expand the sender information and look at the actual email address. In this campaign, the sender used an nxcli.io domain. OpenAI publishes the domains it uses for legitimate communications, which gives you something concrete to compare against.
Check the browser address bar before entering a password or payment information. If the domain looks unfamiliar, close the page. Then open the service yourself through its official app or website. This same habit can protect you from fake banking sites. We recently covered criminals who bought sponsored search ads that sent victims to lookalike bank login pages.
Never reuse your ChatGPT password on other accounts. We recommend using a unique password and suggest a password manager to generate and store it. That way, one stolen password cannot easily unlock several of your accounts.
OpenAI supports two-factor authentication, or 2FA. You can enable it from the Security section of your ChatGPT settings. Depending on your account, available verification methods may include an authenticator app, push notification, text message or passkey. 2FA adds another hurdle if someone gets your password. However, enabling 2FA does not automatically end sessions that are already logged in.
Strong antivirus software can help warn you about malicious links and phishing websites. It can also block other threats that may arrive through scam emails. Keep that protection updated on every device where you check email or sign in to important accounts. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com
Change your password immediately if you entered it on a suspicious site. Then open ChatGPT and go to Settings → Security → Active sessions . Review the listed devices and sessions. If you see something you do not recognize, log it out.
OpenAI also lets you go to Settings → Security → Active sessions and choose Log out of all session s. The company says signing out across every device can take up to 30 minutes. If you use Google, Microsoft or Apple to sign in to ChatGPT, secure that account as well.
If you gave a suspicious site your card information, call the number on the back of the card. Tell the issuer that your payment information may have been compromised. Then review recent transactions for anything you do not recognize. Your card issuer may recommend replacing the card. Follow its instructions rather than waiting for a fraudulent charge to appear.
Cofense says the phishing campaign targeted people using ChatGPT through personal and work accounts. If you entered work credentials or used a company-managed account, contact your IT or security team. They can review account activity and take additional steps if necessary.
This scam works because the email looks like something you might actually expect to receive. A payment problem feels routine, and that can make people lower their guard. If you get a billing warning from ChatGPT, do not use the link in the message. Open ChatGPT yourself and check your account there. If you already entered your password on a suspicious page, change it right away and review your active sessions. If you shared payment information, contact your card issuer.
Have you ever received a subscription warning that looked completely legitimate, and what tipped you off before you clicked? Let us know by writing to us at Cyberguy.com
Sign up for my FREE CyberGuy Report
Copyright 2026 CyberGuy.com. All rights reserved.
