ChatGPT fake billing notices use live operator polling to steal cards

Fake billing emails tied to ChatGPT Plus are leading recipients to payment pages built to collect credit card details and one-time passwords. Fortra identified the phishing operation and documented its infrastructure in research published on October 26, 2026.

What the billing lure collects

The campaign starts with an email that pretends to be an OpenAI payment notice and says a subscription payment failed. It asks the recipient to update billing information, then sends them through tracking services or redirect wrappers to a fake checkout hosted on short-lived WordPress instances. Researchers saw the same landing page reused across multiple recipients in one sending wave, which points to shared infrastructure behind separately tracked messages.

The checkout page imitates a payment form and recognizes card brands while users enter card numbers, expiration dates, and security codes. After submission, the page sends the card number, expiration date, security code, and cardholder name to the server, then leaves the victim on a loading animation that never ends. The captured code tells the page to keep the spinner running instead of processing a response or advancing on its own.

How the session is controlled

The browser keeps contacting an operator dashboard so the victim’s session stays active and waits for instructions. A human operator can send the victim to a one-time-password capture page, show an error, or end the session. In one test that lasted four minutes and three seconds, the page generated 969 requests, mostly dashboard polling traffic.

That setup creates a chance to capture a bank verification code while the victim thinks a subscription update is in progress. Similar real-time OTP interception has appeared in other payment-fraud kits, but this ChatGPT operation uses repeated polling to receive instructions. Capturing a code could help authorize fraud, and it does not mean every submission leads to a successful transaction.

What the investigation found and did not find

Fortra found identical client-side code and a shared application identifier across independently deployed sites that were examined about a week apart. Sites disappeared and were replaced during the investigation. It remains unresolved whether the attackers bought hosting accounts themselves or compromised existing customer sites.

The investigation also showed that the infrastructure can complicate analysis. Unexpected requests returned generic errors, while a token-generating path appeared to affect access. Researchers reported that interception-based analysis disrupted the session flow, while passive browser inspection captured the payment submission and polling behavior without breaking it.

Why defenders should watch this pattern

Recurring page structures and dashboard traffic give defenders better detection opportunities than isolated addresses. Broader live financial phishing operations show why stolen verification codes need urgent attention. Users should verify billing through their account rather than through an email link, and organizations should investigate matching messages and report fraudulent hosting. Broad infrastructure blocks require care because legitimate customers share the platform.

Indicators of compromise (IoCs)

Licensed under CC BY-ND 4.0 International